The correct answer is Connectors . Microsoft documents that Microsoft 365 Copilot connectors are used to bring external, line-of-business data into Microsoft 365 Copilot so users can search, reason over, and act on content from non-Microsoft systems. Microsoft also states that admins must enable and configure Copilot connectors in the Microsoft 365 admin center , and once configured, those connectors can be selected as knowledge sources for custom agents. This directly matches the requirement to let users use an external system as a knowledge source for custom Microsoft 365 Copilot agents.
This is why the hotspot in the Copilot area should be set to Connectors , not Overview, Agents, Search, Billing & usage, or Settings. Overview provides status information, Agents is for agent management, Search is for Microsoft Search experiences, and Billing & usage is for metering and consumption tracking. The specific admin feature that enables external enterprise data sources for agent grounding is Connectors .
Microsoft further explains that configured connectors can expose external knowledge securely and respect source-level permissions when used in agent scenarios.

Sensitivity labels with encryption protect documents at the file level by encrypting the content and restricting access to specified users or groups. Even if a labelled file is shared outside the organisation, only authorised users can decrypt and open it.

* You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources.
The answer: Yes
* You can use a Microsoft Entra security group to assign Microsoft 365 licenses. answer: Yes
* You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes.
The answer: No

The correct answer is D. single sign-on (SSO). Microsoft Entra single sign-on lets users sign in once with one set of credentials and then access assigned applications without signing in again. In this scenario, users authenticate to App1 automatically by using Microsoft Entra credentials, so the app is relying on the tenant identity provider rather than requiring separate app credentials. Multifactor authentication is an additional verification step, not the automatic reuse of an authenticated session.
Password synchronization synchronizes password hashes between identity stores, and pass-through authentication validates credentials against on-premises Active Directory. Neither describes the user experience shown here. The key wording is "without manually entering their credentials," which maps directly to SSO.