Copilot & Foundry: The Microsoft AI Stack for Small Business · Lesson 3 of 10
Tier 2: Copilot Studio (Compose)
Time: ~30 min reading + ~15 min worksheet Goal: Know what Copilot Studio actually is, what it's made of, when it's the right tool, and how the governance/pricing works.
---
Copilot Studio is Microsoft's low-code platform for building AI agents. Agents that live in Teams, on your website, inside SharePoint, or connected to external channels. It's part of the Power Platform family — the same ecosystem as Power Automate, Power Apps, and Power BI.
You build agents visually: drag-and-drop topic flows, pick from a list of knowledge sources, configure actions, test, publish. No code required for most things, though you can drop into Power Fx or code when you need to.
Copilot Studio is the "compose" tier in our three-tier model. You're not writing AI from scratch — you're composing an agent from ingredients Microsoft provides.
Copilot Studio agents are built from five main building blocks. Know them cold.
1. Topics
The fundamental unit of conversation. A topic is a handler for a specific kind of question. "Password reset" might be one topic. "Expense policy" another. "Request time off" another.
Each topic has:
- Trigger phrases — the words that make the agent pick this topic ("I forgot my password", "how do I reset my password", etc.)
- A flow — what the agent does once triggered (ask questions, look up data, respond)
You can author topics manually (for precise flows) or generatively (let AI build them from a description).
2. Actions
Things the agent can *do* beyond responding with text. Send an email, create a ticket, query an API, update a record, trigger a Power Automate flow.
Actions are where agents become more than chatbots. An agent that can only talk is a Q&A bot. An agent that can take actions is the beginning of actually useful automation.
3. Knowledge sources
What the agent searches when it doesn't have a built-in topic for a question. Can be:
- SharePoint sites
- Documents (PDFs, Word, etc.) uploaded directly
- Websites (public URLs)
- Dataverse tables
- External systems via connectors
- Custom enterprise search indexes (via Azure AI Search)
Copilot Studio handles the retrieval automatically — you point it at sources, it does the RAG.
4. Connectors
Pre-built integrations to external systems. Over 1,000 of them — Salesforce, ServiceNow, QuickBooks, SAP, Jira, Zendesk, DocuSign, Box, Dropbox, on and on. This is one of the biggest reasons Copilot Studio exists and why it's powerful for SMB work.
Some are standard (included); some are premium (extra cost). You can also build custom connectors if you need one that doesn't exist.
5. Triggers
What starts a conversation or an autonomous agent action. Could be:
- A user typing something
- An email arriving in a monitored inbox
- A scheduled time
- An event in another system (via connector)
- An @mention in Teams
Triggers are what enable agentic behavior — the agent doing something without a user asking.
Copilot Studio's sweet spot:
- Internal helpdesk bots — IT, HR, Finance, Facilities Q&A
- Knowledge Q&A on a defined set of docs — policies, SOPs, product catalogs (up to ~500 docs, performance-wise)
- Workflow-triggering bots — "submit an IT ticket", "request PTO", "open a support case"
- Customer-facing FAQ bots — deployed to a website or Teams channel
- Departmental "assistants" — a sales team's proposal helper, an HR onboarding assistant
- Teams-embedded agents — naturally integrates with the collaboration surface
- Simple autonomous agents — monitor an inbox, classify, draft a reply, route
Where it starts to struggle:
- Knowledge bases above ~500 docs — relevance drops, latency rises
- Heavy custom logic — you'll end up writing Power Fx and wishing you had real code
- Non-Microsoft LLMs — you're on OpenAI through Azure; no Claude, Llama, Mistral inside Copilot Studio natively
- Highly regulated data with custom residency requirements — Copilot Studio can do some of this, but this is where Foundry shines
- Multi-agent orchestration — getting better with A2A (agent-to-agent) patterns, but still simpler than what Foundry enables
This is the key thing for scoping. If your client's problem fits in Copilot Studio's sweet spot, start there. If it doesn't, you've just learned Foundry is probably in your future.
Microsoft talks about "makers" and "coders" when discussing Copilot Studio vs. Foundry. This framing is useful for scoping but can also be condescending if you overuse it — don't call your client's IT person a "maker" to their face.
The real distinction:
Makers build in Copilot Studio because:
- Low-code/no-code is faster
- Power Platform governance is enough for their needs
- Their problem fits within standard building blocks
- They want to hand the solution to non-technical owners for ongoing upkeep
Coders use Foundry because:
- They need architectural flexibility that low-code can't provide
- They're building a product, not a workflow tool
- They need specific models or behaviors that aren't in the standard toolkit
- They're willing to take on the ongoing engineering cost
Many real engagements involve both. We'll cover the architecture patterns in Module 5.
Copilot Studio inherits Power Platform's governance model, which is genuinely solid:
Environments
Separate environments for dev, test, production. Agents flow through promotion pipelines. Permissions are per-environment.
Data Loss Prevention (DLP)
Admins define which connectors can talk to which other connectors. Prevents, for example, an agent from sending SharePoint data to a public social media connector.
Microsoft Purview integration
As of 2026, Purview integrates with Copilot Studio for DSPM for AI (posture management), audit logging, data classification, sensitivity labels, and DLP policy enforcement on agent prompts and responses.
Microsoft Sentinel
Security monitoring can extend to Copilot Studio activity — abnormal agent behavior, data exfiltration attempts, etc.
Environment routing
Agents can be routed to specific environments based on user, group, or geography. Useful for regulated industries with data residency requirements.
Audit and compliance certifications
Power Platform is SOC 2, ISO 27001, HIPAA, and others. BAAs are available on appropriate tiers.
This is a real differentiator vs. building on a non-Microsoft platform, especially for IT partners and consultants selling to regulated or compliance-conscious clients. The governance isn't an afterthought — it's a reason to pick Copilot Studio.
Copilot Studio's pricing model has changed multiple times. As of 2026 (verify live):
Included with M365 Copilot
If a user has M365 Copilot, they get some Copilot Studio capability bundled — typically the ability to create simple agents grounded on M365 data, with a monthly message allowance.
Copilot Studio standalone license
~$200/month per tenant, with a monthly message allowance. Designed for organizations building multiple agents.
Pay-as-you-go (PAYG)
Metered billing by "messages" — a unit of work that corresponds roughly to a user interaction with an agent. Rates and what counts as a message change periodically.
Capacity packs
Pre-paid bundles of messages, usually cheaper per-message than PAYG.
The short version: if you're building 1–2 agents for a small team, the included M365 Copilot capacity may cover you. For serious production usage (hundreds of daily interactions, multiple agents), you'll need a capacity pack or the standalone license.
The pricing is real but not huge for SMB scale. A production agent serving a 50-person company with reasonable usage might cost $200–$800/month in Copilot Studio consumption, plus a one-time build cost.
A real Copilot Studio agent build, by a skilled consultant, is typically:
- Simple internal Q&A agent (1 knowledge source, <10 topics, deployed to Teams): $5K–$10K
- Departmental agent (multiple knowledge sources, 15–25 topics, 2–3 actions, maybe one connector): $10K–$25K
- Cross-functional agent with integrations (complex actions, connectors to CRM/ERP, Power Automate flows triggered): $25K–$60K
- Multi-agent suite (3–5 related agents with governance framework): $40K–$120K
Again, this is the build. The Microsoft capacity fee is separate. And ongoing tuning is typically 10–20% of build cost annually.
Bundle it. Don't sell "a Copilot Studio agent" as a SKU. Sell "solve the HR helpdesk problem" — the agent is the deliverable. Owners care about the problem going away, not the tool.
New Copilot Studio builders make the same mistake: they create one giant agent that tries to answer everything.
It doesn't work. The agent gets confused, topics collide, performance degrades, and the user experience suffers.
The better pattern: several smaller, well-scoped agents (HR, IT, Sales, Finance) that each know their lane. If you need a single "front door," use a dispatcher pattern or the A2A (agent-to-agent) capability to route between them.
This is the #1 architectural lesson in Copilot Studio. You'll feel the temptation to build the "everything agent." Resist it.
---
- Copilot Studio is the low-code agent builder. Topics, actions, knowledge, connectors, triggers.
- Sweet spot: internal agents, knowledge Q&A under ~500 docs, workflow-triggering bots, Teams-embedded experiences.
- The 1,000+ Power Platform connectors are a major reason to choose it.
- Governance is a real asset — Purview, DLP, environments, audit logs inherited from Power Platform.
- Pricing is message-based or capacity-based. Not per-seat.
- Build costs for real agents range from $5K (simple Q&A) to $60K+ (cross-functional with integrations).
- Build multiple scoped agents, not one giant "everything" agent.
---
Next up: Module 4 — Tier 3: Foundry. Where the heavy lifting lives.
---
Time: ~15 min Goal: Internalize what Copilot Studio is, when to use it, and how to scope an agent build.
---
For each scenario, answer: Yes / Likely Yes / Probably Not / No, with a one-sentence why.
- A helpdesk bot for a 40-person firm, answering the top 30 common IT questions from a SharePoint knowledge base and creating ServiceNow tickets when needed.
→ ______________ / ______________
- An AI agent that reads 3 million insurance claims, detects fraud patterns with a custom model, and routes flagged claims to adjusters in a custom priority order.
→ ______________ / ______________
- An HR onboarding assistant in Teams that walks new hires through benefits enrollment, answers handbook questions, and creates a first-week checklist.
→ ______________ / ______________
- A customer-facing chatbot on a website that uses Claude 4.7 (not GPT) as its underlying model and needs 100ms response times.
→ ______________ / ______________
- A bot that monitors a shared mailbox, classifies incoming emails into 12 categories, drafts responses for 6 of those categories, and routes the rest to humans.
→ ______________ / ______________
- A quoting agent that pulls product data from the company's proprietary on-prem ERP (via a custom connector), formats quotes in the brand template, and emails them to prospects.
→ ______________ / ______________
- A research assistant that needs to fine-tune a model on 200K of the company's historical documents and serve responses with full audit trails for compliance.
→ ______________ / ______________
Client: 60-person accounting firm. They want an internal "Ask IT" agent. You've done discovery and learned:
- Their IT helpdesk fields ~40 tickets/week, about 25 of them are "top 10" recurring questions
- Their documentation is scattered across a 200-page SharePoint wiki and a few PDFs
- They have M365 Business Premium and a ticketing system (FreshService) with a Power Platform connector available
- Owner wants password resets automated end-to-end; other tickets should route to humans with context
Design the agent. Fill in:
Topics (list 5–8 the agent should have):
- ______________
- ______________
- ______________
- ______________
- ______________
- ______________
- ______________
Knowledge sources:
- ______________
- ______________
Actions:
- ______________
- ______________
Connector needed:
- ______________
Channel(s) to publish to:
- ______________
Your estimated build price: $________ Your delivery timeline: ______ weeks
A client says: *"We want one agent. One front door. It should handle HR questions, IT tickets, sales proposals, policy lookups, and basically whatever people throw at it. Everything goes through one bot."*
Write a 60-second response that pushes back constructively.
Your response: ```
```
---
Exercise 1:
- Yes — classic Copilot Studio use case. Small knowledge base, internal, existing connector.
- No — 3M records + custom fraud model + custom routing = Foundry territory. Copilot Studio is the wrong shelf.
- Yes — onboarding assistant in Teams is a textbook fit.
- Probably Not — non-OpenAI models aren't native to Copilot Studio. The 100ms requirement suggests production-scale architecture anyway. This is Foundry.
- Likely Yes — monitor inbox, classify, draft, route. All within Copilot Studio's autonomous agent capabilities. Edge case if volume is huge, but for SMB-scale, this works.
- Likely Yes — custom connector to on-prem ERP is achievable with Copilot Studio + a data gateway. Complexity depends on the ERP's APIs.
- No — fine-tuning is a Foundry thing. Copilot Studio doesn't expose fine-tuning controls.
Exercise 2 — sample scope:
Topics:
- Password reset (with automated flow)
- Software install request
- VPN connection issues
- Email / Outlook issues
- Printing problems
- New employee IT setup
- Request access to a file/folder/app
- "I don't know what my problem is" (graceful escalation)
Knowledge sources:
- SharePoint IT wiki
- PDF: "Employee IT Handbook"
Actions:
- Trigger password reset (via Entra/Graph)
- Create FreshService ticket with user context (name, issue category, conversation transcript)
Connector:
- FreshService connector (premium)
Channel:
- Teams (primary), with availability in the Teams mobile app for remote workers
Estimated build price: $18K Timeline: 5 weeks
The build includes discovery, topic authoring, knowledge source prep, ticket integration testing, pilot phase, and handoff documentation.
Exercise 3 — sample response:
> "I hear you, and I get why that feels clean. Here's why I'd push back: every agent we've seen try to be 'everything' ends up worse than several smaller agents doing specific jobs well. The AI gets confused about which kind of question is coming in, the topics start colliding, and users end up with a mediocre experience across the board. Here's what I'd do instead — build three focused agents (HR, IT, Sales) with clear lanes. If you really want a single entry point, we use an orchestrator agent that just routes people to the right specialist. Each specialist agent then does its specific job better than a one-size bot ever could. Same user experience on the front end, much better quality underneath. Can I show you the architecture?"
Why this works: It validates the user experience goal (single entry point), explains the real problem with the proposed approach, and offers the better pattern (orchestrator + specialist agents) — which happens to be more work and therefore more money, but more importantly is the right answer.
---
Check yourself: Could you walk into a meeting and scope a 5-topic Copilot Studio agent with price and timeline in under 30 minutes? That's the bar for Module 4.
Previous: Tier 1: Microsoft 365 Copilot (Consume) · Next: Tier 3: Microsoft Foundry (Customize)