Power Platform Community Forum Thread Details

Hi everyone,

I've recently been looking deeply into the differences between M365 Copilot and Copilot Studio, expecially around how the search process, the use of metadata, permissions handling and the possibility of steering anwers through prompts actually work.

I keep coming across very different and sometimes contradictory statements in community posts and videos. So I wanted to share my current understanding here and ask if I'm seeing this correctly.

Criterion	M365 Copilot (Graph Search)	Copilot Studio (Vector Search)
Search technology	Graph Search → structured search with keywords, metadata, relations & ACL-based filtering	Vector Search → semantic search based on embeddings of plaintext content
Use of metadata in search	Yes → metadata & relations actively used in search (filter, ranking, security)	No → metadata technically stored at indexing time but not used in the retrieval process or the generated answer
Permissions / Security Trimming	Yes → Microsoft Graph enforces runtime permissions and ACLs	No → Every bot user can receive answers from all Knowledge Sources, regardless of their SharePoint permissions
Prompt-based source steering	Possible → because source & metadata are known at search time	Not possible → source information is not known in the retrieval process, metadata not used
Authentication impact on permission	Microsoft Entra ID authentication only controls access to the chatbot itself.It does NOT enforce runtime permissions on Knowledge Sources. (graph search is responsible for the permission of the documents and sharepoint)	Microsoft Entra ID authentication only controls access to the chatbot itself. It does NOT enforce runtime permissions on Knowledge Sources.
Source attribution under the answer	Yes → based on structured source from Graph Search	Yes → based on data sources whose plaintext was retrieved; source is added after answer generation (attribution only), no influence on answer content
Recommended Prompt Strategy „Prefer SharePoint sources“	Possible and technically effective, because Graph Search uses source metadata	Not possible → Often recommended but technically ineffective in Copilot Studio, because source information is not considered in retrieval. This point specifically confused me, because it is mentioned so frequently but seems technically wrong.

I would really appreciate if someone coud confirm or correct my understanding. I'm trying to get a clear technical picture.

Many thanks in advance.

Categories:

General topics

Hey DM,

have you had any followup to this?

I'm certainly seeing the Vector (concept/semantic) search issue with SharePoint based agents.

I'm trying to see how I can set up some form of RAG to use keyword/metadata based search to augment the current semantic search, which is quite limiting.

But I'm skeptical about your permissions/security trimming conclusion for Copilot Studio. The connection is done via the Graph API, which is setup as an Enterprise Application with delgated authentication for Sites.Read.All and Files.Read.All, which means results are security trimmed to the current user.

I haven't gotten far enough in my testing to prove/disprove this, but on paper it should be OK. Have you looked at this closer?

Thanks

Craig