Microsoft Copilot Studio — Complete Guide
Basics · Topics & Nodes · AI & GenAI · Integration · Security · ALM · Scenarios · Cheat Sheet
Table of Contents
- Core Concepts — Basics
- Topics, Nodes & Variables
- AI Features & Generative AI
- Actions & Integrations
- Security & Authentication
- ALM & Deployment
- Monitoring & Analytics
- Scenario-Based Questions
- Cheat Sheet — Quick Reference
1. Core Concepts — Basics
What is Microsoft Copilot Studio?
Copilot Studio (formerly Power Virtual Agents) is a low-code platform for building AI-powered chatbots and copilots. It lets makers create, test, and publish conversational agents that can answer questions, automate tasks, and integrate with data sources — without deep coding skills. It is part of the Microsoft Power Platform.
What is the difference between Copilot Studio and Azure Bot Service / Bot Framework?
| Copilot Studio | Azure Bot Service / Bot Framework | |
|---|---|---|
| Audience | Makers, citizen developers | Professional developers |
| Authoring | GUI-based, low-code | SDK, pro-code (C#, JS, Python) |
| Integration | Built-in Power Platform | Custom, full control |
| Complexity | Low–medium | Medium–high |
| Best for | Business use cases, quick delivery | Complex custom bots, advanced logic |
The two can be combined — a Bot Framework bot can be surfaced via Copilot Studio as a Skill, or a Copilot Studio copilot can be extended with Bot Framework skills.
What are the key components of a Copilot Studio copilot?
- Topics — conversational flows triggered by user intent
- Entities — data types used to extract information from user input
- Actions — integrations (Power Automate flows, HTTP calls, connectors)
- Knowledge sources — documents, URLs, SharePoint, Dataverse for generative answers
- Channels — where the copilot is published (Teams, web, phone, etc.)
- Variables — store and pass data within/across topics
- Authentication — controls who can access the copilot
What is a Topic in Copilot Studio?
A Topic is a self-contained conversational flow. It defines what triggers it (trigger phrases or events) and what the copilot says/does in response. Topics contain nodes (message, question, condition, action, etc.) that form the dialogue logic. System topics handle built-in scenarios like greeting, escalation, and error handling.
What are System Topics and can you name five important ones?
System Topics are built-in topics that handle standard bot behaviours. They can be customised but not deleted.
| System Topic | When It Triggers |
|---|---|
| Greeting | First message from user |
| Escalate | User asks for a human agent |
| End of Conversation | Conversation ends normally |
| Fallback | No topic matches user input |
| Error | Unhandled error occurs in a topic |
What channels can Copilot Studio copilots be published to?
Microsoft Teams, custom website (embed script), SharePoint, Dynamics 365 Customer Service, Azure Bot Service (bridges to Slack, WhatsApp, Facebook Messenger, Line, Twilio SMS, Telephony), Power Pages portal, and mobile apps via the Direct Line API. A single copilot can be published to multiple channels simultaneously.
2. Topics, Nodes & Variables
What types of nodes are available in a topic?
| Node | Purpose |
|---|---|
| Message | Sends text, images, cards, or adaptive cards |
| Question | Asks user for input, stores answer in variable |
| Condition | Branches flow based on variable values |
| Action | Calls Power Automate flow, HTTP request, or connector |
| Redirect | Transfers flow to another topic |
| End conversation | Ends the current dialogue session |
| Generative answers | AI answers from knowledge sources |
| Set variable | Assigns a value to a variable |
| Send adaptive card | Renders rich card UI |
What are the types of variables in Copilot Studio and how do they differ in scope?
| Variable Type | Prefix | Scope | Persistence |
|---|---|---|---|
| Topic variable | Topic. |
Current topic only | Lost when topic ends |
| Global variable | Global. |
Entire conversation | Persists across all topic redirects |
| System variable | System. |
Read-only, platform-set | Available throughout conversation |
Key system variables:
System.User.DisplayName— logged-in user's nameSystem.User.Email— logged-in user's emailSystem.Channel— channel the user is on (Teams, Web, etc.)System.Activity.Text— the raw text of the user's last message
Tip: Use Global variables for user identity, session preferences, or data that needs to persist across multiple topic redirects. Use Topic variables for transient, within-topic data.
How do trigger phrases work and what are best practices?
Trigger phrases are example sentences that train the NLU model to recognise user intent and route to the correct topic. The model uses semantic similarity — exact matches are not required.
Best practices:
- Add 5–10 diverse phrases per topic covering different phrasings
- Avoid overlapping phrases between topics — causes ambiguous routing
- Use natural, conversational language not technical keywords
- Include short and long versions: "reset password" and "I forgot my password and need to reset it"
- Avoid overly generic phrases like "help" — they match too broadly
What are Entities in Copilot Studio and what types exist?
Entities define the type of data to extract from user input in a Question node.
| Entity Type | Description | Example |
|---|---|---|
| Prebuilt | Platform-provided types | Date/Time, Number, Email, Phone, Boolean, Currency |
| Closed list | Fixed list of values + synonyms | Departments: HR, Finance, IT |
| Regex | Pattern-match input | Employee ID: EMP-\d{5} |
| ML-based | Trained on examples | Free-text concept extraction |
What is topic redirection and when should you use it?
Topic redirection uses a Redirect node to transfer the conversation flow to another topic mid-dialogue. It is the mechanism for reusing logic and building modular copilots.
Use cases:
- Reusable authentication flow called from multiple topics
- Common disambiguation step shared across intents
- Breaking a complex topic into smaller, maintainable sub-topics
- Routing to the Escalate system topic from multiple paths
Tip: Variables can be passed to and returned from redirected topics — use Input/Output variable mapping on the Redirect node.
How does the Fallback topic work and how do you customise it?
The Fallback system topic triggers when the NLU model cannot match the user's input to any topic with sufficient confidence. Customisation options:
- Add a Generative Answers node to attempt an AI answer before giving up
- Add a counter variable to track consecutive fallbacks — after N misses, escalate to human
- Offer the user a quick-reply menu of common topics
- Log unmatched utterances to Dataverse or Application Insights for continuous improvement
3. AI Features & Generative AI
What is Generative Answers in Copilot Studio?
Generative Answers is a node (and a global setting) that uses Azure OpenAI / GPT to automatically answer user questions by searching configured knowledge sources — without needing to author a topic for every question. The model retrieves relevant content and synthesises a natural language answer grounded in that content.
Key differentiator: This eliminates the need to manually create topics for every FAQ. The AI handles open-ended Q&A automatically from your content.
What knowledge sources can Copilot Studio use for Generative Answers?
| Knowledge Source | Description |
|---|---|
| Public websites / URLs | Crawls and indexes public web pages |
| SharePoint sites | Indexes document libraries and pages |
| OneDrive files | PDFs, Word docs, PowerPoint files |
| Dataverse knowledge articles | Dynamics 365 KB articles |
| Azure AI Search | Bring your own custom index |
| Uploaded files | Directly uploaded PDFs/docs in the studio |
Warning: Knowledge source quality directly determines answer quality. Content must be well-structured, accurate, and scoped to avoid hallucinated or irrelevant answers.
What is the difference between Classic topics and Generative AI mode?
| Classic Topics | Generative AI Orchestration | |
|---|---|---|
| Routing | Trigger phrases (NLU matching) | AI model decides based on topic descriptions |
| Predictability | Deterministic, fully controlled | Probabilistic, handles wider input range |
| Authoring effort | High — every flow hand-authored | Low — AI generates answers from content |
| Best for | Compliance, transactional flows | Open-ended Q&A, knowledge retrieval |
In practice: Most production copilots use both — classic topics for critical/compliance-sensitive flows and generative AI for open-ended Q&A.
What is prompt engineering in the context of Copilot Studio?
Prompt engineering refers to crafting the Instructions (system prompt) and topic descriptions given to the AI model to shape its behaviour, tone, scope, and decision-making.
Key areas:
- Copilot Instructions — global system prompt defining persona, scope, and constraints
- Example: "You are an HR assistant. Only answer HR-related questions. If asked about anything else, politely decline and redirect."
- Topic descriptions — natural language descriptions used by the AI orchestrator to decide when to invoke a topic
- Generative Answers prompt customisation — modify how answers are phrased or constrained
Tip: Clear, specific instructions drastically reduce off-topic answers and hallucinations. Explicit scope constraints are more effective than vague persona descriptions.
How do you prevent a copilot from answering out-of-scope questions?
- Set clear Copilot Instructions with explicit scope boundaries
- Configure content moderation — enable the content safety filter in AI settings
- Limit knowledge sources to relevant content only
- Customise the Fallback topic to handle unmatched inputs gracefully
- Enable "Only search in my knowledge sources" — prevents model using general world knowledge
- Use topic scoping — disable generative answers globally and enable it only on specific topics
What is AI Builder and how does it integrate with Copilot Studio?
AI Builder is a Power Platform service providing pre-built and custom AI models (document processing, sentiment analysis, object detection, etc.). In Copilot Studio, AI Builder models are called via Power Automate flows in an Action node.
Example use case: extract data from a scanned invoice the user submits, then use the extracted fields (invoice number, amount, vendor) in the conversation flow.
4. Actions & Integrations
What are Actions in Copilot Studio and what types are available?
| Action Type | Description |
|---|---|
| Power Automate flow | Call a cloud flow, pass variables in/out |
| HTTP request | Direct REST API call with custom headers, body, auth |
| Connector action | Use a Power Platform connector (SharePoint, Dataverse, O365, etc.) |
| Prompt action (AI Builder) | Run a GPT prompt via AI Builder |
| Bot Framework Skill | Call a pro-code skill built with Bot Framework SDK |
How do you call a Power Automate flow from Copilot Studio and pass data back?
The flow must use the "When a copilot calls a flow" trigger.
Steps:
- In Power Automate: add trigger → define input parameters (text, number, boolean)
- Add flow logic (query Dataverse, call API, send email, etc.)
- Add "Return values to copilot" step → define output variables
- In Copilot Studio: Action node → map topic variables to flow inputs → map flow outputs to variables
- Use returned values in subsequent Message/Condition nodes
Flow inputs: LeaveType (text), StartDate (text), EndDate (text)
Flow outputs: BalanceRemaining (number), RequestId (text), Status (text)
Tip: Flow inputs/outputs are strongly typed. Mismatch between flow output type and variable type is a common source of runtime errors.
How do you make a direct HTTP call from a Copilot Studio topic?
Use the HTTP request action node (no Power Automate needed):
- Add Action node → "Send an HTTP request"
- Set method (GET/POST/PATCH/DELETE), URL, headers, and body
- Configure authentication: None, API Key, Bearer token, or OAuth
- Define the response schema — the copilot parses JSON and maps fields to variables
- Handle error responses via condition branching
Note: The target endpoint must be publicly accessible or accessible via on-premises data gateway.
How do you integrate Copilot Studio with Dataverse?
Three approaches:
| Approach | Best For |
|---|---|
| Connector action | Simple CRUD — list, create, update, delete rows |
| Power Automate flow | Complex queries, FetchXML, multi-step operations |
| HTTP request (Dataverse Web API) | Full OData query control, advanced filtering |
Copilot Studio copilots are always provisioned in a Power Platform environment with Dataverse — the copilot definition itself is stored as Dataverse records.
What is the Direct Line channel and when would you use it?
Direct Line is a REST API channel from Azure Bot Service that allows any custom application to communicate with a copilot programmatically.
Use when:
- Building a fully custom chat UI (mobile app, React component)
- Integrating the copilot into a non-Microsoft platform
- Sending proactive messages to users from external systems
- Passing custom context/user data into the conversation at startup
What is the Copilot Studio Web Chat embed?
After publishing, go to Channels → Custom website. Copy the embed script and add to your HTML:
<!-- Simple iframe embed -->
<iframe
src="https://web.powerva.microsoft.com/environments/{env}/bots/{botId}/webchat"
style="height:480px;width:360px;">
</iframe>
For full custom UI, use the Direct Line API with the Bot Framework Web Chat JavaScript library.
5. Security & Authentication
What authentication options does Copilot Studio support?
| Option | Description | Best For |
|---|---|---|
| No authentication | Public copilot, any user can interact | Public-facing bots |
| Only for Teams and Power Apps | Seamless SSO via Microsoft 365 identity | Internal enterprise Teams bots |
| Manual (Azure AD / OAuth) | Configured Azure AD app registration, OAuth flow | Web channel authenticated bots |
Tip: For internal enterprise copilots on Teams, "Only for Teams and Power Apps" gives seamless SSO — the user's identity is inherited without any login prompt.
How does SSO work in Copilot Studio deployed to Microsoft Teams?
When deployed to Teams with "Only for Teams and Power Apps" authentication:
- Teams silently authenticates the user using their Microsoft 365 session
- The copilot receives user identity via:
System.User.DisplayNameSystem.User.EmailSystem.User.Id
- An auth token is available for use in Power Automate flows to call Graph API or other Microsoft services on behalf of the user
- No login prompt is shown — completely seamless
Warning: SSO token is Teams-specific and not available in the web channel. For web channel authentication, configure Manual OAuth with Azure AD.
What security roles are needed to build and publish a Copilot Studio copilot?
| Role | Purpose |
|---|---|
| Copilot author | Create and edit copilots in the environment |
| Environment Maker | Create flows, connections, and solutions |
| Basic User | Access the environment's Dataverse |
To publish to Teams, the maker also needs Teams admin approval to install the app. Full System Administrator is not required for authoring.
How do you secure sensitive data in conversations?
- Never store sensitive data (passwords, SSNs, card numbers) in Global variables
- Use OAuth token to call APIs on behalf of the user rather than storing credentials
- Enable Data Loss Prevention (DLP) policies in the Power Platform admin centre to block connectors that could leak data
- Set conversation logging to off for sensitive copilots (Settings → Security → Conversation logging)
- Review session transcripts access — stored in Dataverse, secured by Dataverse security roles
6. ALM & Deployment
How do you manage and deploy Copilot Studio copilots across environments?
Copilots are stored as Dataverse components and packaged in Power Platform solutions.
# Export solution via CLI
pac solution export --path ./solution.zip --name MyCopilotSolution
# Import to target environment
pac solution import --path ./solution.zip
ALM pipeline steps:
- Add the copilot to a solution in the maker portal
- Export as managed solution (for prod) or unmanaged (for dev)
- Import into target environment via admin centre or CLI
- Configure connection references and environment variables post-import
- Use Azure DevOps / GitHub Actions with Power Platform Build Tools for CI/CD automation
Warning: Connection references and environment variables must be configured in each target environment post-import — they are not included in solution values.
What is the difference between managed and unmanaged solutions for copilots?
| Managed Solution | Unmanaged Solution | |
|---|---|---|
| Editable in target env | No (read-only) | Yes |
| Used in | Production, UAT | Development |
| Deletion behaviour | Deleting solution removes components | Components remain on solution deletion |
| Recommended for | Deployment pipeline | Active development |
How do you handle environment variables in Copilot Studio deployments?
Environment variables store configuration values that differ per environment (API URLs, app IDs, feature flags). Define them in the solution, set values per environment during or after import. Reference them in Power Automate flows called by the copilot.
7. Monitoring & Analytics
How do you monitor and analyse copilot performance?
Built-in Copilot Studio analytics:
| Metric | Description |
|---|---|
| Total sessions | Number of conversations started |
| Engagement rate | % of sessions where user sent more than one message |
| Resolution rate | % of sessions resolved without escalation |
| Escalation rate | % of sessions handed off to human agents |
| Abandonment rate | % of sessions where user dropped off |
| CSAT | Customer satisfaction score (if survey enabled) |
Advanced analytics:
- Export session data to Azure Application Insights for custom dashboards
- Build Power BI reports on Dataverse session transcript tables
- Use the Conversation transcripts entity in Dataverse to query raw conversation data
How do you identify and fix low-performing topics?
- Review Topic analytics — find topics with high abandonment or escalation rates
- Check session transcripts for those topics — find where users drop off
- Look for confusing question nodes, unclear messages, or missing branches
- Check if the topic is being triggered by wrong intents (update trigger phrases)
- A/B test message variations and monitor CSAT scores
8. Scenario-Based Questions
Scenario: Copilot always routes to the wrong topic. How do you debug it?
Situation: User says "I need to reset my access" but routes to Password Reset instead of Account Access topic.
- Open the test panel and check which topic is triggered
- Review overlapping trigger phrases between the two topics — "reset" appears in both
- Add more distinctive trigger phrases to the correct topic: "restore access", "unlock my account", "account blocked"
- Remove or reword ambiguous phrases from the wrong topic
- Use the Topic Checker in Copilot Studio to surface conflicts and warnings
- If using AI orchestration, improve the topic description — more specific descriptions improve routing accuracy
Scenario: Design a leave request copilot integrated with an HR system.
Requirement: Employee asks for leave, copilot checks balance, creates request, notifies manager.
Architecture:
- Auth — deploy to Teams with SSO. Use
System.User.Emailto identify the employee - Leave Balance topic
- Action → Power Automate flow → query HR API → return balance
- Message node displays available days
- Apply Leave topic
- Question nodes: leave type (closed-list entity), start date (Date entity), end date (Date entity), reason (text)
- Condition node: check requested days ≤ available balance
- If yes → Action → flow → POST to HR API → create record
- Flow returns:
RequestId,Status - Confirmation message with reference number
- Notifications — flow sends approval email to manager via Outlook connector
- Error handling — if API call fails, Error node message + redirect to Escalate topic
Scenario: Generative Answers returns incorrect or hallucinated information. What do you do?
- Update knowledge source content — outdated documents produce outdated answers
- Narrow scope — remove broad/generic sources that introduce noise
- Enable "Only search in my knowledge sources" — prevents model using general world knowledge
- Add constraints in Instructions — "Always base answers only on the provided company documents. If information is not in the documents, say you don't know."
- For high-stakes topics — replace Generative Answers with a classic authored topic for full control
- Review session transcripts — identify patterns of incorrect answers and fix source content
Critical: Never rely solely on Generative Answers for compliance, legal, or safety-critical information. Always use authored classic topics for those areas.
Scenario: How do you escalate to a human agent and pass context?
Requirement: Transfer to a live agent in Dynamics 365 Customer Service with full conversation context.
- Customise the Escalate system topic — collect missing info, set global variables
- Set context variables:
Global.CustomerNameGlobal.IssueCategoryGlobal.AccountIdGlobal.ConversationSummary
- Use the Transfer conversation node (available with D365 Customer Service / Omnichannel integration)
- Pass context to agent via the context variable object — appears in agent's panel
- Full transcript is automatically visible to the agent in Omnichannel
Tip: Context passed to the agent reduces average handling time. Always include issue category, account ID, and a summary of what the copilot already tried.
Scenario: Copilot needs to behave differently for different departments.
| Approach | When to Use |
|---|---|
| Single copilot + department branching | 80%+ content shared across departments |
| Separate copilots per department | Completely different workflows/knowledge bases |
| Teams app scoping | Publish to specific Teams channels per department |
Single copilot implementation:
- On conversation start → Power Automate flow → look up user's department from Azure AD or HR system
- Store in
Global.Department - Use Condition nodes throughout topics to show department-specific content/links/forms
Scenario: Copilot needs to query a SharePoint list and display results.
- Action node → "Call an action" → Power Automate flow
- Flow: SharePoint "Get items" action → filter by relevant column → return as JSON string to copilot
- In Copilot Studio: parse the JSON response variable, loop with condition nodes to display results
- Or: for simple lookups, use the SharePoint connector action directly in the Action node
- Display results in a Message node with an Adaptive Card for better formatting
9. Cheat Sheet — Quick Reference
Global Objects / System Variables
| Variable | Description |
|---|---|
System.User.DisplayName |
Logged-in user's display name |
System.User.Email |
Logged-in user's email address |
System.User.Id |
Logged-in user's AAD object ID |
System.Channel |
Channel the user is interacting on |
System.Activity.Text |
Raw text of user's last message |
System.LastMessage.Text |
Previous user message text |
System.Conversation.Id |
Unique conversation session ID |
Variable Naming Convention
Topic.VariableName ← scoped to current topic only
Global.VariableName ← persists across entire session
System.User.Email ← read-only, platform-provided
Node Type Quick Reference
| Node | Icon Purpose | Key Setting |
|---|---|---|
| Message | Display output | Supports text, images, Adaptive Cards |
| Question | Collect input | Entity type determines validation |
| Condition | Branch logic | Supports AND/OR, variable comparison |
| Action | Call external | Flow / HTTP / Connector / Skill |
| Redirect | Go to topic | Can pass/receive variables |
| Generative answers | AI answer | Requires knowledge source configured |
| End conversation | Close session | Can trigger end-of-conversation survey |
Topic Design Patterns
Pattern 1: Authentication gate
├── Start
├── Check Global.IsAuthenticated
│ ├── Yes → proceed to main logic
│ └── No → Redirect to Auth topic
│ └── Set Global.IsAuthenticated = true
│ └── Return to original topic
Pattern 2: Error-resilient action
├── Action node (call flow/API)
│ ├── Success path → use returned variables
│ └── Error path → Message "Something went wrong"
│ └── Redirect to Escalate
Pattern 3: Fallback with generative AI
├── Fallback system topic
├── Generative answers node (try knowledge sources)
│ ├── Answer found → display it
│ └── No answer → increment Global.FallbackCount
│ └── If count ≥ 3 → Redirect to Escalate
│ └── Else → "Can you rephrase that?"
Authentication Setup Checklist
Teams SSO (internal)
☐ Set authentication to "Only for Teams and Power Apps"
☐ Verify System.User.Email is populated in test
☐ Use System.User.Email in flows to identify user
☐ No Azure AD app registration needed
Web channel (external)
☐ Create Azure AD app registration
☐ Set redirect URI to Copilot Studio callback URL
☐ Configure Manual authentication in Copilot settings
☐ Add Authenticate node to topics requiring login
☐ Store token in Global.AuthToken for flow use
ALM Deployment Checklist
Pre-export
☐ All topics tested in test environment
☐ No broken node references or missing variables
☐ Connection references defined in solution
☐ Environment variables defined with default values
☐ Copilot added to solution
Export
☐ Export as managed solution for prod deployment
☐ Include dependent flows and connectors
Post-import
☐ Set environment variable values for target env
☐ Reconnect connection references
☐ Test all topics in target environment
☐ Republish copilot to all channels
☐ Clear any cached responses
Common Errors & Fixes
| Error | Likely Cause | Fix |
|---|---|---|
| Topic routes incorrectly | Overlapping trigger phrases | Review and deduplicate phrases; use Topic Checker |
| Flow call fails | Type mismatch on input/output | Verify variable types match flow input/output types |
| Generative answers returns nothing | Knowledge source not indexed | Re-sync knowledge source; check URL accessibility |
| SSO not working | Wrong auth setting | Set "Only for Teams and Power Apps"; redeploy |
| Variable empty after redirect | Scope issue | Use Global variable instead of Topic variable |
| HTTP call returns 403 | Auth header missing | Add Bearer token header; check API permissions |
| Post-import flow broken | Connection reference not set | Reconfigure connection reference in target env |
Top 10 Tips
- Know the difference between Topic variables and Global variables — scope questions come up constantly.
- Classic vs Generative — always recommend both in combination; never only one.
- SSO on Teams = "Only for Teams and Power Apps" mode; web channel SSO requires Manual OAuth — test this.
- Fallback topic customisation — adding Generative Answers + escalation counter is the expected advanced answer.
- N+1 anti-pattern — never query inside a loop; consolidate in a single flow call.
- DLP policies control which connectors can be used — security questions will touch this.
- Trigger phrase best practices — 5–10 varied phrases, avoid overlap, avoid generics.
- Connection references must be reconfigured after solution import — ALM gotcha.
- Session transcripts in Dataverse are the raw data behind analytics — knowing this impresses.
- Topic Checker is the built-in tool for finding broken references and phrase conflicts — mention it proactively.
No comments:
Post a Comment