Explanation:

Prompt injection is a generative AI security risk where an attacker inserts instructions (often hidden in text, documents, webpages, or user inputs) to override or manipulate the assistant's intended behavior. This can lead to unintended actions such as ignoring policy controls, producing unsafe outputs, or attempting to reveal sensitive information. Because generative AI systems follow natural-language instructions, they can be socially engineered to prioritize malicious content unless safeguards are in place. This is why prompt injection can cause data exposure (for example, attempting to extract confidential content from grounded sources) and can also embed harmful instructions that redirect the model's behavior. In enterprise settings like Microsoft
365 Copilot, mitigations include grounding boundaries, permission trimming, content filtering, and instruction hierarchy (system policies over user instructions). From a business governance perspective, users should treat untrusted inputs (emails, documents, web text) as potentially hostile and apply least-privilege access and validation when using AI outputs in decision-making.

Microsoft 365 Copilot operates within the security, compliance, and identity boundaries of a Microsoft 365 tenant. Shared prompts, prompt links, and Copilot artifacts are governed by organizational access controls and tenant isolation. If a prompt is created and shared from outside your organization, cross-tenant access may not be supported depending on the sharing configuration and administrative policies.
When a user attempts to open a prompt that resides in another organization's tenant without proper cross- tenant sharing permissions, Copilot cannot locate or validate the resource within the user's own environment.
As a result, the system displays a "Prompt not found" message.
Option B would typically result in an access or permissions error rather than the prompt being unavailable entirely. Sensitivity labels and scheduled prompts do not inherently cause a "not found" error. Therefore, the most likely cause is that the prompt exists outside your organization's tenant boundary and is not accessible to you.

The Researcher agent in Microsoft 365 Copilot is designed to gather and synthesize information from web and organizational sources. To support transparency and trust, Copilot provides citations alongside generated content when external or referenced material is used.
Citations allow users to review the original sources that informed the generated report. This aligns with Microsoft's Responsible AI commitment to transparency and verifiability. By selecting or reviewing citations, users can confirm that the information originates from credible and relevant references rather than unsupported model-generated text.
Instructions define how the agent behaves but do not validate source authenticity. Memory refers to conversational context retention and does not confirm source validity. Capabilities describe what the agent can do, not whether its output is grounded in legitimate sources.
Therefore, to verify that a report generated by the Researcher agent uses valid sources, you should review the citations.

Explanation:

Microsoft 365 Copilot does not train the underlying large language model on your organization's tenant data.
Instead, it uses your organization's data at run time to ground responses (for example, by retrieving relevant emails or documents you have permission to access). This separation protects confidentiality and supports enterprise compliance.
If a mailbox (or specific folders) is shared with you and your account has the required permissions, Copilot can summarize emails from that shared content because Copilot respects Microsoft 365 access controls ("permission trimming").
Copilot also relies on Microsoft 365's established security and compliance framework-identity, permissions, and policy enforcement-so it only surfaces content you're authorized to see. This ensures Copilot's outputs remain aligned with organizational governance, information protection, and least-privilege access principles.

Explanation:

Microsoft Purview is the correct choice because it is Microsoft's unified compliance and data governance solution that helps organizations apply and enforce policies across Microsoft 365 content- including Copilot- related interactions where those interactions are captured in services such as Microsoft 365 audit, eDiscovery, and Purview compliance experiences. Purview supports capabilities such as data loss prevention (DLP), retention, eDiscovery, audit, and sensitivity labeling so organizations can manage and govern data and AI- assisted content in line with regulatory and internal requirements. In contrast, Microsoft Entra ID focuses on identity and access management, Intune focuses on device and application management, and Defender for Cloud focuses on cloud security posture management. Governance policies for Copilot-generated conversations and associated compliance controls align most directly with Purview, which is designed to manage information protection and compliance across the Microsoft 365 environment.