Copilot Studio / Copilot M365 - Search, Metadata, Permission & Prompt Behavior

Hi everyone,

I've recently been looking deeply into the differences between M365 Copilot and Copilot Studio, expecially around how the search process, the use of metadata, permissions handling and the possibility of steering anwers through prompts actually work.

I keep coming across very different and sometimes contradictory statements in community posts and videos. So I wanted to share my current understanding here and ask if I'm seeing this correctly.

Criterion	M365 Copilot (Graph Search)	Copilot Studio (Vector Search)
Search technology	Graph Search → structured search with keywords, metadata, relations & ACL-based filtering	Vector Search → semantic search based on embeddings of plaintext content
Use of metadata in search	Yes → metadata & relations actively used in search (filter, ranking, security)	No → metadata technically stored at indexing time but not used in the retrieval process or the generated answer
Permissions / Security Trimming	Yes → Microsoft Graph enforces runtime permissions and ACLs	No → Every bot user can receive answers from all Knowledge Sources, regardless of their SharePoint permissions
Prompt-based source steering	Possible → because source & metadata are known at search time	Not possible → source information is not known in the retrieval process, metadata not used
Authentication impact on permission	Microsoft Entra ID authentication only controls access to the chatbot itself.It does NOT enforce runtime permissions on Knowledge Sources. (graph search is responsible for the permission of the documents and sharepoint)	Microsoft Entra ID authentication only controls access to the chatbot itself. It does NOT enforce runtime permissions on Knowledge Sources.
Source attribution under the answer	Yes → based on structured source from Graph Search	Yes → based on data sources whose plaintext was retrieved; source is added after answer generation (attribution only), no influence on answer content
Recommended Prompt Strategy „Prefer SharePoint sources“	Possible and technically effective, because Graph Search uses source metadata	Not possible → Often recommended but technically ineffective in Copilot Studio, because source information is not considered in retrieval. This point specifically confused me, because it is mentioned so frequently but seems technically wrong.