The two extension paths (different physics)
- Graph connectors (index-time): your external content (wikis, ticket systems, file stores) is ingested into the Microsoft 365 index with ACL mapping; Copilot then ANSWERS from it like it answers from SharePoint. Data flows in once, searchably; permission-trimming fidelity is the whole game — a mis-mapped ACL leaks via a friendly chat answer.
- Agents / plugins (run-time): declarative agents (instructions + knowledge scoping) and API-calling agents (real actions against your endpoints) built in Copilot Studio or code. Nothing is pre-indexed; Copilot calls OUT during the conversation with the user's context. Latency, auth (OAuth on behalf of the user), and action-safety review replace the index concerns.
Rule of thumb: connectors for knowledge, agents for actions — and an agent that only needs knowledge should usually have been a connector.
The admin switchboards
Deployment rides the SAME app machinery as everything else (agents surface as apps: org catalog, permission policies, setup policies — earlier concepts apply verbatim), plus the Copilot-specific consoles: the M365 admin center's Copilot settings (org stances) and per-agent enablement. Licensing gates runtime: users need Copilot seats for the full experience; agent-specific consumption models exist for some scenarios — check current terms per agent type before promising costs.
Data-boundary answers (the meeting you WILL be in): connector content enters your tenant's index (tenant boundary, search-permission-trimmed); agent calls leave with the conversation's context to endpoints you registered — the manifest names them, review names the risk. Neither trains foundation models.
What to watch (proofs)
- The extension inventory: TAC Manage apps filtered to agents/Copilot apps + the Copilot admin pages — what is enabled, for whom; this joined list is the register auditors will ask for.
- Connector health & scope: M365 admin > Search & intelligence > connectors — ingestion state, item counts, ACL mapping config; a permission-trim spot check (search as a low-privilege user for a known-restricted doc) is the leak test.
- Agent behaviour: the agent's endpoint logs (yours) — calls arrive with expected auth for expected users; unexpected callers = a scoping error in the app policy layer.
- Adoption vs licence: Copilot usage reports against seat count — the utilisation number the renewal negotiation runs on.