AB-730 Cheat Sheet

Copilot does not answer straight from the model's general knowledge. It first runs grounding, gathering relevant context such as your work content and adding it to your prompt, and only then sends that enriched prompt to the large language model that writes the response. Grounding is the step that makes an answer specific to your work, so a thin or generic answer usually means grounding had little context to work with, not that the model failed.

Trap Treating Copilot as if it answers purely from its training data; the personalization comes from the grounding step that pulls in your context, not from the model alone.

A Copilot request always runs in the same order: you enter a prompt, Copilot preprocesses it with grounding against Microsoft Graph, Copilot sends the grounded prompt to the LLM, and Copilot returns the response to the app and to you. Knowing the order tells you where an answer can go wrong: the grounding step decides what context the model ever sees.

For the licensed Microsoft 365 Copilot, the work context for grounding comes from Microsoft Graph, which holds your emails, chats, documents, and meetings. Grounding improves the specificity of your prompt so the answer is relevant and actionable for your task, and it can include text from files you point at as well as content Copilot discovers for you.

To ground well, Copilot has to pick the right items out of all your files and messages. It uses semantic indexing over your Microsoft Graph data, which matches on meaning rather than exact keywords, so a prompt about "the budget overrun" can surface the right spreadsheet even when that phrase never appears in it. It runs automatically behind grounding and respects your permission boundaries; there is nothing for an end user to configure.

Microsoft 365 Copilot Chat is the free secure-chat tier and is grounded in the web only, so it does not reach your files, emails, or chats on its own. The licensed Microsoft 365 Copilot requires the add-on license and grounds in your work content in Microsoft Graph plus the web. When a task depends on your work content, the tier, not the wording of the prompt, decides whether Copilot can answer.

Trap Rewording the prompt to fix a free-tier user who gets nothing from their work content; the web-only tier cannot reach work content at all, so the fix is the license or supplying the content.

Using Microsoft 365 Copilot Chat needs no extra license because it answers from the web. Grounding answers in your work content in Microsoft Graph is the value the paid Microsoft 365 Copilot add-on unlocks. So a generic web question is fully served by the free tier, and only work-content tasks justify the license.

Web-only does not mean work-blind. A Copilot Chat user can bring organizational content into a single chat three ways: as part of the prompt (paste it, upload with the "+" button, or type "/" to pick a file from the ContextIQ menu); by using Copilot Chat side-by-side in apps like Teams and Outlook where it is aware of content you have open; or through a pay-as-you-go agent with access to organizational content. The difference from the licensed tier is that the free tier only sees what you give it, one chat at a time.

Because Copilot grounds in the content each person can access, the identical question can return different answers for different users when their permissions differ. This is expected behavior, not a malfunction, and rewording the prompt will not make the answers match. The variation traces to differing context, the documents and messages each account can see.

Trap Calling differing answers between two colleagues a bug; each answer is grounded in what that person can access, so different access legitimately yields different results.

Where you invoke Copilot shapes what it works against: Copilot in Word operates on the open document, Copilot in Excel on the spreadsheet, Copilot in Outlook on the mail thread. Choosing the right app is the simplest way to point Copilot at the content you mean before you even refine the prompt.

When Copilot grounds an answer in your content it returns clickable citations to the source items, so you can open the cited document or message and confirm the claim rather than trusting the wording. Checking citations is the right move whenever an answer looks plausible but you are not certain it is correct.

Copilot inside a Teams chat uses only that one chat thread as its source and cannot reach other chats, meeting transcripts, emails, or files. The scope is by design, so do not expect it to combine sources it was never given; for cross-source work you need an experience that grounds more broadly.

Trap Expecting Copilot in a Teams chat to pull in a related email or another chat; that experience reads only the current thread and cannot reference other chats or data types.

When a Copilot answer is thin or wrong, the high-value fix is almost always to correct the context rather than the wording: confirm your tier can reach work content, reference the right file, and use the right app. The model is the same engine everywhere; what changes between a good and a poor answer is what grounding could collect.

Trap Blaming the model's writing quality for a thin answer when the real gap is that grounding had no access to the needed file or work content.

A fabrication, also called a hallucination, is a confident but wrong or invented claim. Microsoft's term for it is ungrounded content: text that appears correct but isn't present in the source materials. It happens because the model is probabilistic, so even a response grounded in your files can include information that isn't in those inputs. The danger is that it reads as plausible, so an invented figure or policy clause survives a quick skim.

Trap Assuming a response grounded in your own documents cannot be fabricated; grounding lowers the risk but Copilot can still add claims not present in the inputs.

Prompt injection is a hostile instruction smuggled into content Copilot references, such as a forwarded email, a shared file, or a web page, that tries to hijack the response. Because the payload rides in the grounding data rather than your prompt, it is also called indirect or cross-prompt injection. The user-facing tell is behavioral: output that instructs you to send a payment, share a file, or click a link is acting on orders you never gave.

Trap Treating a Copilot summary's embedded instruction as a legitimate task because Copilot surfaced it; the instruction came from the untrusted content, not from you.

Over-reliance, also called automation bias, is the human failure of accepting incorrect or incomplete output without verifying it. Microsoft flags it as especially dangerous because mistakes in AI output can be hard to detect, and lists consequences from lost productivity and broken trust to financial and physical harm. It is the failure that turns a rare fabrication into a shipped mistake, because the human check that would have caught it was skipped.

A citation check is the act of opening the file, page, or email Copilot cited and confirming it actually says what the response claims. When a response is grounded in work content, Copilot attaches clickable references to the sources precisely so users can verify the response. It is the fastest way to catch a fabrication, because the failure shows up immediately when the source does not contain the claim.

Trap Treating the presence of a citation as proof the claim is correct; a citation only helps if you open it and confirm it supports the sentence.

Human review, which Microsoft frames as human oversight, is a person checking the output against expectations and requirements before anyone acts on it. It catches problems a citation check cannot: wrong tone for the audience, a sourced but ill-judged recommendation, an omission, or bias. For consequential or external work it is non-negotiable, because the product disclaimers Microsoft adds reduce but do not remove the need to review accuracy.

Scale how hard you verify to what a wrong answer would cost. A low-stakes reversible draft needs little more than a quick read; medium-stakes work others act on earns a citation check on the specific claims; high-stakes work earns a citation check plus human review. The more a mistake would cost, the more verification it earns, so the stakes set the floor for rigor.

Judge stakes by where the output goes and what acting on a mistake would cost, not by how long the text is. A one-line figure pasted into a board deck is high-stakes; a long internal brainstorm is low-stakes. The exam will offer a long but throwaway output as the high-rigor choice to see if you confuse volume with consequence.

Trap Picking the longest output as the one needing the most verification; rigor follows where the output lands and the cost of error, not word count.

Microsoft advises exercising caution and evaluating outcomes when using Copilot for consequential decisions or sensitive domains, naming financial services, healthcare, housing, employment, and legal status as needing particular care. For these, a person must validate the output before it is used, and high-stakes uses like diagnosing patients or prescribing medication are to be avoided. The throughline is that a human stays in the loop wherever a wrong answer carries legal, financial, or personal harm.

Grounding a prompt in your documents improves accuracy and is Microsoft's main mitigation against ungrounded content, but it does not remove the need to verify, because a grounded response can still include content not present in its input sources. Grounding raises the floor; the citation check and human review still set the ceiling. Lean on grounding to get better drafts, not as a reason to skip checking.

Trap Skipping verification because the prompt was grounded in trusted files; grounding reduces fabrication but cannot guarantee every claim came from the sources.

Two patterns deserve suspicion in any response: a factual claim with no citation, and a citation that, once opened, does not support the claim. Both are how fabrication shows up in a grounded response. When you spot either, treat the claim as unverified and check it against a trusted source before reusing it.

Naming the risk points to the step that catches it: a fabrication is caught by a citation check, prompt injection by cross-checking against a trusted source and distrusting output that acts on hidden instructions, and over-reliance by human review before use. On a scenario item, identify the risk first, then choose the proportionate step rather than a generic answer.

Specifics are where fabrication hides, so check every figure, date, name, and quoted clause against its cited source rather than trusting the surrounding prose. A single wrong number can invalidate a whole document, which is why a citation check focuses on the exact claims an exam question would turn on. The fluent narrative around a figure is no evidence the figure itself is right.

Microsoft's guidance is to review responses and verify they match your expectations before relying on them, so treat what Copilot returns as a starting point, the way you would treat a first draft from a new colleague. The responsibility for the final content stays with the person who uses it, not the tool that drafted it. This framing is why review is expected even when the output looks finished.

Checking whether a response is accurate and trustworthy is distinct from controlling what data Copilot can reach. Whether Copilot can open a file, and how permissions and sensitivity labels limit what it sees, is data protection, not output verification. On a scenario about a wrong or hijacked answer, the responsible-AI behavior is the verification step, not a permissions or labeling control.

Trap Answering a fabrication or prompt-injection scenario with a permissions or sensitivity-label fix; access controls govern what Copilot can reach, not whether its answer is correct.

Microsoft frames an effective prompt as up to four parts. Goal is what you want Copilot to do, Context is the background that narrows it, Expectations set the tone and format of the output, and Source is the work content to ground on. Goal answers "what," Context answers "for what situation," Expectations answers "in what shape," and Source answers "based on what." Adding the right parts is what turns a generic answer into a usable one.

All a prompt strictly needs is a clear Goal to get a response. Context, Expectations, and Source are optional and you add them as the task warrants: a quick factual question ("what is our vacation policy?") needs only a Goal, while a polished deliverable usually wants all four. They are dials to turn up, not a mandatory form to fill in.

Trap Assuming every prompt must spell out all four parts; over-specifying a simple lookup wastes effort, and a clear Goal alone is enough for it.

Copilot narrows its answer against the detail you give, so naming the audience, the length, the tone, and the exact deliverable removes its guesswork. A vague prompt leaves nothing to narrow against and returns something generic you then have to rewrite. Specificity in the prompt is usually cheaper than editing the output afterward.

When the format or voice matters, pasting one short example of the style you want teaches Copilot faster than a paragraph describing it. This is part of the Expectations: a concrete sample of the desired output shape is a clearer instruction than abstract adjectives. It is most useful when the format is hard to put into words.

To ground a prompt on exact work content, type the forward slash and start typing the item's name, then pick it from the suggestions. The feature is Context IQ (CIQ), and it can reference people, Microsoft 365 files, meetings, and emails, ranked by relevance and recency to you. So "summarize /Q3 Launch Plan" grounds on that file rather than whatever Copilot would have guessed.

Trap Pasting the whole file's text into the prompt instead; referencing it with "/" is cleaner, keeps the prompt short, and points Copilot at the live item.

When a prompt does not reference a specific file, person, or meeting, Copilot tries to determine the best source of data on its own, drawing on your work content. It often chooses well, but it can ground on the wrong document and produce a confident, wrong-sourced answer. Naming the Source removes that risk.

The same Goal grounded against different sources produces different answers, because the Source determines what Copilot reads before it writes. That makes selecting the right source part of writing the prompt, not an afterthought: reference the document when the task is about that document, and reference the person or meeting when it is about what they own or said.

Referencing people, meetings, emails, and files with "/" through CIQ requires a Microsoft 365 Copilot license. The free, web-grounded Copilot Chat supports file references only and cannot reach your work content on its own. Knowing the tier tells you whether the slash can pull in work items automatically.

Trap Assuming the free Copilot Chat can reference your emails or meetings with "/"; without a Copilot license it grounds on the web and your supplied files, not your work content.

The Copilot Prompt Gallery is Microsoft's catalog of curated prompts, available inside Microsoft 365 Copilot and Copilot Chat and organized by scenario. It is the fastest way to learn the shape of a good prompt: open a suggested prompt close to your task, then edit its Goal, Context, and Source to fit. Treat it as a starting template to adapt.

Trap Running a Gallery prompt unchanged and expecting a finished answer; it is a template to adapt to your situation, not a one-click result.

A first answer is a starting point, and Microsoft's guidance is to expect back-and-forth to get the result you want. Refine with short follow-ups like "make it shorter," "more formal," or "show me more" rather than re-typing the whole prompt. Stopping at the first response is the most common reason a prompt feels like it underdelivered.

When you refine with a follow-up in the same conversation, Copilot keeps the context from the earlier turns and builds on the draft it already produced. Starting a brand-new prompt instead drops that context and makes Copilot begin from scratch, which is slower and loses what you had already shaped. Refine in place to converge.

Trap Opening a fresh prompt to tweak a near-good answer; that loses the conversation's context, so reword in the same thread instead.

Using the same prompt more than once can produce different responses, because the underlying model has built-in variability. That means variation is expected behavior, not a malfunction, and refining toward the answer you want is the intended workflow rather than a sign the prompt was wrong.

Grounding on the right file with "/" improves the source, yet Copilot can still summarize it imperfectly, and a generative model can occasionally produce incorrect content. So review and verify the response, opening the cited items to confirm, rather than trusting a grounded answer blind. Referencing is about aiming, not proofreading.

Choose the source by where the truth lives: current public information that your organization has not documented (competitor pricing, industry news, market-size figures, new-market regulations) must come from web content, while proprietary facts (your sales figures, internal budget, survey results) must come from your organization's files and emails. When a single answer needs both, scope each part to its correct source rather than grounding the whole thing on one.

Trap Grounding a request for confidential internal figures on web content, which returns only generic public data and never your tenant's numbers.

To summarize or reply based on a long Outlook thread, open the thread and use Summary by Copilot or Draft with Copilot from within it. Copilot then grounds its output in the messages of that specific conversation, producing recaps and replies that reflect the full back-and-forth rather than your memory of it; a thread summary even includes numbered citations that jump to the matching message.

Trap Building a custom agent to handle a one-off thread summary, when Copilot in Outlook already grounds on the open conversation.

To draft from scratch, open a blank Word document, type what you want into the Copilot prompt box, and select Generate; Copilot returns a first draft. Put the tone and length in the prompt itself ("professional, one page, three sections") so the first pass lands closer to what you need. This is the right path when there is no existing file to build on; the moment a real source should shape the result, reference it instead.

After Copilot generates a draft in Word, you choose Keep it to accept it, Regenerate to get a different version of the same request, or Discard to drop it. You are not locked into the first attempt: typing a follow-up like "make it more concise" or "add a risks section" in the compose box revises the draft in place. You can also select existing text, a list, or a table and ask Copilot to rewrite just that selection.

Typing "/" in the Copilot prompt box opens a picker to name the file Copilot should draft from, which grounds the result in your own terminology, data, and numbers instead of generic text. This is how you generate a document from an existing document rather than from scratch, and how you reuse or transform content (turn last year's report into this year's outline). The same request grounded on different files produces different drafts, so choosing the source is part of writing the prompt.

Trap Drafting from a blank prompt when a relevant file exists; the ungrounded draft misses your specific terms, figures, and KPIs that the referenced file would have supplied.

When you draft from existing files in Word, you can reference up to 20 items, and the accepted file types are Word, PowerPoint, PDF, and TXT. Pick them by typing "/" and the file name, or by selecting Files in the pane that opens. Knowing the cap and the supported types matters because an unsupported format or a 21st file simply will not be available as a source.

Copilot can ground a draft only on files you already have permission to access in your organization's OneDrive or SharePoint, so it never exposes content you could not otherwise open. This keeps existing access controls intact: referencing a file through Copilot is not a way around permissions. If a colleague's file does not appear when you type "/", you most likely lack access to it.

Trap Assuming Copilot can pull from any file in the tenant; it is limited to files you personally have permission to open, so it respects existing OneDrive and SharePoint access.

Ask Copilot to summarize when the goal is to shorten an existing document to what matters, and to draft when the goal is to create content. A summary is a focused subset of one source, so it stays grounded in that document, whereas drafting new content may pull from other sources you reference. In Word, a summary distills the document to its key points and takeaways and offers follow-up questions you can click to go deeper.

Trap Asking Copilot to "draft a summary" of a report and expecting a faithful condensation; framing it as drafting invites new or reframed content, while asking it to summarize keeps the output anchored to the source.

A management or executive summary is a steered summary, not a separate feature: ask for the key decisions, the budget or risk impact, and the action items with owners rather than a neutral recap. A prompt like "Summarize this report for an executive: three key decisions, budget impact, and action items" produces something a leader reads in a minute. Specifying the audience and the elements you want is what turns a generic summary into a management one.

The automatic summary that appears at the top of a Word document on its own requires the document to have at least 200 words, a Microsoft 365 Copilot (work) license, and the file saved in OneDrive or SharePoint. If you do not see one, those unmet conditions are usually why. You can still ask Copilot for a summary in Chat regardless, so a missing automatic summary does not mean summarization is unavailable.

From OneDrive you can select up to 5 files and choose Summarize this file to get a combined summary; the accepted types are Word, PowerPoint, PDF, and Excel. This is the multi-file path when one summary needs to span several documents, distinct from the single-document summary inside Word. You can steer it by naming a topic or focus area so the summary is organized the way you need.

To turn a finished Word document into a deck, open a blank presentation, select Copilot, type "Create presentation from file," and pick the document; Copilot drafts slides with speaker notes and pulls in any images it finds in the source. This carries content across apps instead of rebuilding it slide by slide. It is the standard move when a written brief or report needs to become a presentation.

Trap Copy-pasting a Word document into slides by hand when "Create presentation from file" would draft the deck, including speaker notes and images, directly from the source.

When building a presentation from a Word document, Copilot in PowerPoint works best when the file is under 24 MB. For a very large source, trim or split it before asking Copilot to create the deck, otherwise the result may be incomplete. The size guidance is about the source document you reference, not the deck Copilot produces.

Copilot in Excel returns insights as charts, PivotTables, summaries, trends, or outliers from your data; you reach it through the Copilot icon in the lower-right corner. To move those numbers into a document or email, reference the workbook with "/" in Copilot Chat or Word so the figures and the narrative stay consistent. This keeps a single grounded source flowing from analysis to write-up instead of retyping numbers.

In Copilot Chat you can draft a full email, then select Edit in Outlook to push the draft into your mailbox and keep editing before you send. This moves a drafted message from chat into the app where you actually send mail, without copy-pasting. It is the cross-app path for turning a Chat-drafted message into a real Outlook email.

Copilot moves content across Microsoft 365 apps by grounding each new task on a file you reference, so one piece of content flows from document to deck to email without being rebuilt by hand. A Word brief feeds a PowerPoint deck, an Excel analysis feeds a Word summary or an email, and a Chat draft lands in Outlook. Thinking in terms of "which source feeds this" is faster and more consistent than copying text between apps.

Using Copilot to draft documents, build presentations, and write email requires an eligible Microsoft 365 subscription or a Microsoft 365 Copilot license. The work (licensed) tier is also what enables grounding on your organization's files, emails, and meetings. Without it, the file-referencing and automatic-summary capabilities that make drafts grounded are unavailable.

Match the Copilot app to the deliverable, not the source: use Copilot in PowerPoint when the output is a slide deck delivered live to an audience (pitch, onboarding session, town hall), and Copilot in Word when the output is multi-page narrative meant to be read at the reader's own pace. Copilot in PowerPoint can build a deck straight from a short topic prompt even when no source file exists yet.

Trap Reaching for Word to produce a deck for a live presentation, or for PowerPoint to produce long-form written analysis.

Choose the summarizing tool by where the discussion actually happened: Copilot in Outlook for an email thread, Copilot in Teams for a group chat or a meeting, and Copilot in Word/PowerPoint for an open document or deck. When decisions span two places, run the recap in whichever app holds the deciding content, then carry it into Outlook to draft the message.

Trap Forwarding a Teams chat or meeting into Outlook to summarize it there instead of recapping it in Teams where it occurred.

When Copilot summarizes or answers a question about a document or deck, it attaches references (citations) pointing to the specific slides in PowerPoint or sections in Word it drew from. Selecting a reference navigates to that source so you can verify each claim before sharing — this is the built-in feature for tracing summarized statistics and decisions back to the original.

Trap Assuming you must re-read the whole document to check the summary, when the References list already links each point to its source.

Copilot generates plausible content that can omit details, misstate figures, or surface confidential information, so you must review it against the original file and edit before sending — especially for leadership, clients, external partners, or policy and financial content. Human review of the facts is the required responsible-AI step; Copilot output is a draft, not a finished deliverable.

Trap Sending a Copilot-generated draft or summary straight to executives or external partners without checking it against the source.

Microsoft frames a strong prompt as four parts: the goal (what you want), context (background and audience), expectations (format, tone, length, structure), and source (files or data to reference). Detailed prompts that name the audience, scope, sections, and tone produce more targeted first drafts than vague one-liners.

Trap Giving a bare topic instruction with no audience, scope, tone, or source file and expecting a tailored draft.

Copilot in PowerPoint relies on built-in Word Styles such as Heading 1 and Heading 2 to read a document's hierarchy and decide how to break it into slides. Format the source with real Styles (not just bold text) first, and Copilot produces better-structured, more logically organized slides and tries to carry over images found in the document.

Trap Using bold or larger font for section titles instead of built-in Heading Styles, leaving Copilot without the structure it needs.

To produce one document or email that combines several sources — for example a Teams chat plus a SharePoint file — use Microsoft 365 Copilot Chat in Work mode (or Draft with Copilot) and reference each item directly with the forward-slash (/) or Add content button. Copilot then retrieves and synthesizes the referenced sources into a single grounded output.

Trap Copying and pasting content from each source into the prompt instead of referencing them with / so Copilot retrieves them itself.