The correct selections are The Microsoft 365 admin center and A billing policy . Microsoft documents that Microsoft 365 Copilot pay-as-you-go is administered in the Microsoft 365 admin center , specifically under Copilot > Billing & usage , where admins create and manage billing policies . Microsoft explains that a billing policy defines the billing infrastructure for pay-as-you-go, including the Azure subscription and the set of users covered by that policy. That user scoping is what allows organizations to separate usage and spending by groups such as departments.
Microsoft also documents that billing policies support budgets , spending views , and monitoring current expenses for services linked to the policy. This supports the requirement for greater visibility into Copilot usage costs and forecasting departmental spending. By assigning different departments to different billing policies, the organization can track Copilot costs by department. The other listed features do not fit: auto- claim policy is unrelated to cost tracking, and Copilot connector is for external data grounding, not billing segmentation.

The correct answer is A . Microsoft Learn defines Zero Trust as a security strategy built on the principles verify explicitly , use least privilege access , and assume breach . Microsoft also summarizes Zero Trust as a model that assumes breach and verifies every request , rather than trusting users, devices, or traffic simply because they originate from inside the corporate network. This is the key reason option A is correct.
Under Zero Trust, every access request should be evaluated continuously using available signals such as identity, device state, location, service, and risk.
Option B is incorrect because improving user experience is not the defining principle of Zero Trust. Option C is incorrect because Zero Trust requires ongoing review and adjustment of permissions, especially through least privilege and risk-based access. Option D is incorrect because Zero Trust explicitly rejects implicit trust based on network location. Microsoft states that organizations should reduce reliance on the traditional idea that anything on the internal network is automatically safe or trustworthy.

Explanation:

The correct answer is Microsoft 365 Copilot . Microsoft Learn states that Restricted SharePoint Search (RSS) gives organizations time to review and correct permissions on SharePoint sites, and then add only those reviewed sites to an allowed list that Copilot can access . That means RSS is specifically about restricting Copilot's access to SharePoint content, not blocking administrators, guest users, or Microsoft Purview eDiscovery from those sites.
This distinction is important. Microsoft explains that users can still access SharePoint content based on their normal permissions, while RSS limits what Microsoft 365 Copilot can use as grounding data until site permissions are reviewed and approved. So the feature helps reduce oversharing risk in Copilot without removing a user's direct ability to find or open content they already have permission to access in SharePoint.
In other words, the restriction is placed on Copilot's searchable grounding scope , not on the user's own SharePoint permissions. That is why the sentence is correctly completed with Microsoft 365 Copilot .