Microsoft AB-620: Integrate and extend agents in Copilot Studio Practice Questions

Correct answer (B): The A2A protocol, as supported in Copilot Studio, is based on the open A2A specification developed by Google and adopted by Microsoft. A central concept of A2A is the Agent Card — a well-known JSON document (typically hosted at a discoverable URL) that advertises the sub-agent's name, description, skills/capabilities, and the endpoint to which task messages should be sent. The orchestrator reads the Agent Card to understand what the sub-agent can do and how to invoke it, enabling dynamic, loosely-coupled delegation at runtime.

Why A is wrong: Embedding a Power Automate flow ID and having the flow instantiate the sub-agent is a workaround pattern, not the A2A protocol. It tightly couples the orchestrator to flow infrastructure and does not align with the Agent Card-based discovery mechanism that defines A2A.

Why C is wrong: The A2A protocol does not work by posting raw HTTP requests with an agent name and tenant ID in the body. Sub-agents are not discoverable or invocable this way in Copilot Studio — there is no such documented direct-invocation endpoint. The Agent Card is required for proper capability discovery and invocation.

Why D is wrong: Microsoft Fabric pipelines are data orchestration tools for analytics workloads (ETL/ELT). They have no role in routing conversational utterances between Copilot Studio agents and are entirely the wrong service layer for A2A agent delegation.

Option B is correct. 'Computer Use' is a Copilot Studio capability that enables agents to interact with desktop and web UIs in a virtual machine environment — including navigating menus, clicking buttons, and reading screen content from legacy applications that lack APIs. This is precisely the scenario described. Option A is incorrect because Generative Answers with a URL knowledge source is for surfacing information from web content or documents — it cannot interact with or extract data from a running desktop application. Option C is incorrect because the Windows Registry stores application configuration, not live transactional UI state; furthermore, a custom connector calling the Registry API would not provide the UI navigation and field extraction described. Option D is partially correct as a viable alternative — Power Automate Desktop (PAD) flows can perform UI automation — but the question asks for the Copilot Studio capability designed for this scenario. 'Computer Use' is the native Copilot Studio feature that handles this directly without requiring a separate PAD flow, making Option B the better answer in this context.

Option B is correct because Adaptive Cards are the native, supported mechanism in Copilot Studio for rendering rich, interactive UI elements — including images, text fields, and action buttons — directly within a Teams conversation. Option A is incorrect because Power Automate email flows do not render interactive cards inside a Teams chat; they would deliver a separate email, not an in-conversation card. Option C is incorrect because Teams agent conversations do not support iframe embeds for security reasons, and SharePoint web parts cannot be injected into agent message payloads. Option D is incorrect because the legacy MessageCard schema is deprecated by Microsoft and is not the recommended approach; Adaptive Cards are the current standard and are natively supported in Copilot Studio.

Options A and B are correct. Structured Outputs (Option A) is the primary mechanism for enforcing JSON schema compliance on a generative AI node's output — by providing a schema, the model is constrained to produce only valid, schema-conformant JSON, eliminating missing or extra fields. Option B provides a runtime safety net: even with Structured Outputs, a defensive Condition node in the orchestrator that validates field presence and re-prompts on failure is a best-practice error-handling pattern for multi-agent reliability. Option E is incorrect because SharePoint list columns have no connection to JSON output schema enforcement; they are a knowledge source feature, not an output formatting mechanism. Option C is incorrect because plain text with regex parsing is fragile, unmaintainable, and the direct opposite of using structured outputs — it introduces parsing errors and defeats the purpose of reliable agent-to-agent communication. Option F is partially viable but sub-optimal: using a Power Automate flow solely to serialize output adds unnecessary latency and complexity when Structured Outputs already handles this within the agent node itself. Option D is incorrect because 'strict mode' in this context (as described) is not an actual Copilot Studio setting; Azure OpenAI's 'strict' mode for function calling is configured at the API level, not as a Copilot Studio agent connection toggle.

Correct answer (B): Copilot Studio explicitly supports 'No authentication' as an authentication mode for connector actions and HTTP request actions. When an external API is publicly accessible and requires no credentials, selecting 'No authentication' is the correct and intended configuration. This tells the agent to make the request without attaching any authorization headers or tokens.

Why A is wrong: Microsoft Entra ID (Azure AD) SSO passes the calling user's identity token to the target system. A third-party public weather API does not accept or validate Microsoft identity tokens — applying this setting would likely result in an authentication error or the token being ignored, and it is unnecessary overhead for a no-auth API.

Why C is wrong: Configuring API Key authentication with an empty key is not equivalent to 'No authentication.' Depending on implementation, this could result in an empty Authorization or API key header being sent, which may cause the API to return a 400 or 401 error. It is also a misconfiguration that obscures the developer's intent and could cause confusion during future maintenance.

Why D is wrong: Custom OAuth 2.0 with Client Credentials requires a valid token endpoint, client ID, client secret, and scope — none of which exist for a public, no-auth API. Copilot Studio does not require OAuth to be configured for public APIs; 'No authentication' is a legitimate first-class option, not a workaround.