Question

A global manufacturer deploys a Copilot Studio agent in its EU environment to help procurement staff answer supplier questions. The agent uses a custom connector that calls a supplier analytics API hosted in a US data center. Compliance flags that supplier records classified under GDPR are being sent from EU to the US API during agent calls. The architect must recommend a design change that preserves the agent capability while ensuring data movement compliance. What should the architect recommend FIRST?

Accepted Answer

Replace the connector with one that calls a supplier analytics endpoint deployed in an EU region, or restrict the connector to send only de-identified, non-personal fields

Answer

Enable audit logging on the connector so all cross-region calls are recorded for later review

Answer

Apply a Data Loss Prevention (DLP) policy that blocks the custom connector entirely across all environments

Answer

Move the entire Copilot Studio agent to a US environment so the connector call stays within one region