Grounding Strategy

What it does

Decides how an agent or Copilot actually reaches the data it answers from. There are four mechanisms with overlapping names, and picking the wrong one gets you either stale answers, an oversharing incident, or a connector bill you didn't scope.

Key facts

Semantic index — the index M365 Copilot builds over Microsoft Graph (mail, files, chats, SharePoint). It's automatic for licensed users and is what makes "grounded on your work" possible. You don't configure it per-agent; it's the substrate.
Microsoft 365 Copilot connectors (Graph connectors) — pull external systems (ServiceNow, Confluence, a SQL store, file shares) into the Graph so the semantic index can see them. Right when the data must show up across all of Copilot, not just one agent.
Copilot Studio knowledge sources — per-agent grounding: SharePoint, public websites, uploaded files, Dataverse, and connectors, scoped to that agent. Right when only one agent needs the data.
Dataverse — the structured, row-level store behind Power Platform and Dynamics. Grounding here gives an agent live, permission-trimmed business records, not documents.

When to use / skip

If the data already lives in the Graph — SharePoint, OneDrive, Exchange — you don't ground anything; the semantic index has it for licensed users. Just make sure permissions are right, because Copilot honours them and also exposes whatever's overshared.

If the data lives outside the Graph and you want it everywhere in M365 Copilot for everyone, use a Graph connector. If instead only one agent needs that external or public data, put it in as a Copilot Studio knowledge source and skip the connector cost and indexing. When the answer is a structured record — an order status, a case, an account balance — ground on Dataverse, not on exported documents; documents go stale and lose row-level security.

Drop to public-website knowledge only when the content genuinely is public and you don't mind the agent scraping it live.

Configuration decisions

Is the data already in the Graph, or external? In-Graph needs no grounding; external needs a connector or a knowledge source.
Does it need to surface across all of Copilot, or just one agent? Tenant-wide points to a Graph connector; single-agent to a Copilot Studio knowledge source.
Documents or structured records? Records mean Dataverse and its row-level permissions.
Who should see it? Grounding inherits source permissions — get access right at the source before you index.
How fresh must answers be? Connectors and indexes refresh on a schedule; Dataverse and live connectors are current.

Gotchas

The semantic index magnifies oversharing. If a SharePoint site is open to "everyone", Copilot will happily surface it. Fix permissions before rollout, not after the first leak.
Graph connectors carry index item limits and licensing considerations, and reindexing large sources takes time — don't promise same-day.
Copilot Studio knowledge sources and Graph connectors overlap but bill and behave differently. People add a connector for a single agent's need and pay tenant-wide for it.
Grounding on exported Dataverse data as files throws away row-level security and freshness. Ground on Dataverse directly.
Public-website grounding depends on the site staying scrapeable and stable. It breaks quietly when the site changes.
Grounding is per surface: the same data may need a Graph connector for per-user Copilot and a knowledge source for a standalone agent. Don't assume one setup covers both.

Consultant notes

Do the oversharing review as a paid discovery step, not a footnote. It's the single most common thing that derails a Copilot go-live.
Default to "is it already in the Graph?" before proposing any connector. Half the connector asks disappear once you check.
For anything transactional, insist on Dataverse grounding. Consultants who ground CRM answers on exported spreadsheets get blamed when the numbers are wrong.
Cost the connector strategy at tenant scale, not at pilot scale — index volume is where it bites.

Every grounding decision is also a permissions decision — re-check the source access before you call it done.