Study guide
7.2 Microsoft Graph Capabilities
Microsoft Certified: AI Transformation Leader Exam AB-731
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
0.1 Current AB-731 Exam Facts 0.2 Audience Profile and the July 22, 2026 Blueprint 0.3 Independent Study Path for AB-731
2 Generative AI Foundations
1.1 Generative AI Versus Other Types of AI 1.2 Select a Generative AI Solution for a Business Need 1.3 Pretrained Versus Fine-Tuned Models
3 Cost, Risks, and Business Value
2.1 Tokens and ROI Cost Drivers 2.2 Fabrications, Reliability, and Bias 2.3 Scalability, Automation, and When Generative AI Adds Value
4 Prompt Engineering
3.1 Impact of Prompt Engineering 3.2 Prompt Engineering Techniques
5 Grounding, RAG, and Data
4.1 Business Requirements for Grounding Solutions 4.2 Retrieval-Augmented Generation (RAG) 4.3 Data Type, Quality, and Representative Datasets
6 Secure AI and Machine Learning
5.1 Importance of Secure AI 5.2 Application, Data, and Authentication Security for AI 5.3 When Machine Learning Adds Value 5.4 Lifecycle of a Machine Learning Solution
7 Microsoft 365 Copilot and Microsoft Copilot
6.1 Map Business Processes and Use Cases to Copilot 6.2 Differences in Capabilities Between Versions of Copilot 6.3 Microsoft 365 Copilot Chat on Web and Mobile 6.4 Copilot in Microsoft 365 Apps
8 Copilot Studio, Microsoft Graph, and Integrated AI
7.1 Microsoft Copilot Studio Capabilities 7.2 Microsoft Graph Capabilities 7.3 Integrated Microsoft AI, Risk Mitigation, and Safety
9 Agents, Extensibility, and Stack Mapping
8.1 Map Processes to Microsoft AI Apps and Services 8.2 When to Use Researcher or Analyst in Copilot 8.3 Build, Buy, or Extend Copilot
10 Microsoft Foundry and Foundry Tools
9.1 Map Business Processes to Foundry Tools 9.2 Azure Vision, Azure AI Search, and Microsoft Foundry 9.3 Match an AI Model to a Business Need 9.4 Scalability and Security Benefits of Foundry
11 Responsible AI and Governance
10.1 Importance of Responsible AI 10.2 Governance Principles for AI Use 10.3 Establish an AI Council 10.4 Microsoft Responsible AI Standards
12 Adoption Teams, Barriers, and Champions
11.1 Establish an Adoption Team 11.2 Common Barriers to AI Adoption 11.3 Establish an AI Champions Program
13 Impacts, Copilot Licensing, and Foundry Cost Models
12.1 Impacts to Data, Security, Privacy, and Cost 12.2 Copilot License Types 12.3 Foundry Tools Subscription Models
7.2 Microsoft Graph Capabilities
Key Takeaways Explain This Topic AI
Microsoft Graph is the API and data fabric for Microsoft cloud services: a single endpoint ( https://graph.microsoft.com ) over mail, files, calendar, Teams, users, groups, and related Microsoft 365, Microsoft Entra, and Enterprise Mobility + Security data.
Microsoft 365 Copilot grounds work answers in Graph content—documents, email, calendar, chats, meetings, and contacts—plus the user's working context, and only surfaces data the signed-in user has permission to view.
Copilot cannot see what the user cannot see. The same SharePoint, Teams, and label or encryption controls that apply to a human apply to Graph-grounded Copilot and to Studio knowledge that uses Graph search.
Copilot connectors bring external systems into Graph for search and grounding; Microsoft Graph Data Connect ships Graph data at scale to Azure on a schedule. Full build, buy, or extend decisions are the next chapter.
Last updated: September 2026
Microsoft Graph is Microsoft's documented gateway to data and intelligence in Microsoft cloud services such as Microsoft Entra and Microsoft 365 . In platform terms, it is the API and data fabric sitting under the apps employees already use. Copilot does not magically know the company. It reaches work content through Graph, subject to the same identity and permissions that protect that content when a person opens Outlook or SharePoint.
Exam AB-731 asks you to understand capabilities of Microsoft Graph —not to call REST APIs in a lab. The leadership claim is simple: Copilot cannot see what the user cannot see.
The Graph fabric
Microsoft describes three components that enable data access and flow in the Microsoft 365 platform:
Microsoft Graph API — One endpoint, https://graph.microsoft.com , for people-centric data and insights across Microsoft 365, Windows, and Enterprise Mobility + Security. Apps and experiences use REST APIs or software development kits. Graph also includes services that help manage identity, access, compliance, and security and help protect organizations from data leakage.
Microsoft 365 Copilot connectors (formerly Microsoft Graph connectors ) — Incoming: they deliver data external to the Microsoft cloud into Graph services and applications, enhancing experiences such as Microsoft Search. Microsoft documents connectors for sources such as Box, Google Drive, Jira, and Salesforce.
Microsoft Graph Data Connect — Tools to deliver Graph data securely and at scale into Azure data stores so organizations can build analytics and intelligent applications on a cache, with administrator consent over users, groups, and properties.
Together, the API, connectors, and Data Connect power the Microsoft 365 platform. Copilot's daily "summarize this thread" or "draft from my files" path is the API plus the user's token. Connectors and Data Connect are how you extend or analyze that fabric.
Graph exposes data from Microsoft 365 core services (including Bookings, Calendar, Excel, Microsoft Purview eDiscovery, Microsoft Search, OneDrive, OneNote, Outlook/Exchange, People, Planner, SharePoint, Teams, To Do, and Viva Insights), Enterprise Mobility + Security (including Microsoft Entra and Intune), Windows, Dynamics 365 Business Central, and Partner Center. For Copilot grounding, the surfaces leaders name most often are:
- Mail — Outlook and Exchange messages
- Files — OneDrive and SharePoint
- Calendar — meetings and events
- Chats and teamwork — Microsoft Teams
- Users and groups — Microsoft Entra ID identities and Microsoft 365 groups
Related context — contacts, notes, plans, trending documents, and org relationships such as manager or group membership
Microsoft's own examples are leader-friendly: look up meeting attendees, fetch their profiles and managers, see trending files, suggest meeting times, or read a workbook in OneDrive. That is Graph relationship navigation, not a dump of every file in the tenant.
How Copilot uses Graph for work grounding
Microsoft Copilot coordinates large language models (LLMs) , content in Microsoft Graph , and Microsoft 365 apps . Copilot accesses content and context through Graph and can generate responses anchored in organizational data such as documents, emails, calendar, chats, meetings, and contacts. It combines that content with working context—the meeting happening now, last week's chats, the email thread on a topic.
Microsoft 365 Copilot (the licensed work experience Microsoft currently describes with Graph, Work IQ , Copilot Search, and semantic indexing ) grounds responses in organizational data the user is allowed to see. Work IQ is the intelligence layer Microsoft documents for reasoning over organizational data, content, and tools; administrators can turn Work IQ on or off. When it is off, users can still get responses, but those responses are not enriched with work-specific Graph context. Copilot Chat experiences that are web-grounded do not automatically search the tenant; the user must attach or open content, or use a work-data agent, unless they have the work-grounded license Microsoft documents.
Semantic Index honors the user identity-based access boundary so grounding only accesses content the current user is authorized to access. Microsoft states Copilot only surfaces organizational data to which individual users have at least view permissions . Permission models in SharePoint, Teams shared channels, and other Microsoft 365 services therefore are Copilot's permission model. Oversharing a Finance site to a broad "everyone" audience is not a Copilot product defect; it is a Graph-visible overshare.
If content is encrypted with Microsoft Purview Information Protection , Copilot honors usage rights . When a sensitivity label applies encryption, users need EXTRACT as well as VIEW for AI apps to return the data. S/MIME-protected emails are not returned; password-protected documents are available only as data in use if already open. This is why legal and security partners belong in Copilot rollout: labels and sharing reviews clean the Graph that Copilot will search.
Graph is secured; only authorized callers access data. Apps use the Microsoft identity platform . Delegated access acts on behalf of a signed-in user: the app's delegated permissions (scopes) and the user's own permissions both apply. App-only access uses application permissions for daemons and automation without a user. Copilot's work grounding for an employee is the delegated, signed-in-user pattern. Least privilege applies to any custom app that calls Graph; that design work is the next chapter's extensibility story, not a reason to grant organization-wide directory read to a departmental chatbot.
Why Graph matters to a transformation leader
A consumer chatbot does not receive the chief financial officer's mailbox because someone typed the company name. Tenant Copilot does not receive that mailbox because someone bought a license. It receives what Graph will return for that user . If HR cannot open Legal's site, Copilot for that HR user cannot ground on Legal's site. If a contractor is in a Teams shared channel, Graph—and therefore Copilot—can surface channel content they can already see.
That is both the safety story and the quality story. Copilot answers are only as trustworthy as the files in Graph and the permissions around them. Microsoft's Copilot documentation points to SharePoint Advanced Management and restricted content discovery because clutter and oversharing degrade grounding. Fix sharing; do not ask Copilot to be more careful than Graph.
Operations example: A plant manager asks Copilot for last quarter's quality report. If the report lives in a locked engineering library, Copilot will not invent access. If the report sits on a wide-open intranet page, Copilot may summarize it for anyone who can view that page. The leader's control is identity, sharing, and labels—not a prompt that says "ignore confidential files."
Legal example: Counsel worries Copilot will "read the whole file share." The accurate briefing is that Copilot reads what the signed-in attorney can already view through Graph. The residual risk is oversharing and weak labels, which is a records and access-control program, not a reason to skip tenant Copilot in favor of pasting exhibits into a consumer bot.
Connectors and extensibility (teaser)
When work data lives in ServiceNow, Salesforce, Jira, or a custom catalog, Copilot connectors index it into Graph (honoring source access control lists) so Search and Copilot can cite it. Power Platform connectors (previous section) are the live-API counterpart. Agents can call tools so Copilot sends a query on the user's behalf; administrators control which agents are allowed in the Microsoft 365 admin center. Microsoft Graph Data Connect is the bulk path: many users or groups, a recurrent schedule, a cache in Azure, Azure Data Factory—not real-time "me" queries.
Microsoft's comparison for leaders:
- Feature Microsoft Graph API Microsoft Graph Data Connect
- Access scope Single user or entire tenant Many users or groups
- Access pattern Real time Recurrent schedule
- Data operations Operates on source data Operates on a cache in Azure
- Data protection Protected in the source service Protection extended to the Azure cache
- Typical tools RESTful queries Azure Data Factory
Build versus buy versus extend—including the Microsoft 365 Copilot extensibility framework—is the next chapter . Here, remember Graph as the fabric Copilot already uses, connectors as the way external knowledge joins that fabric, and Data Connect as analytics-scale movement, all still inside administrator and identity control.