7.2 Microsoft Graph Capabilities

Microsoft Graph is Microsoft's documented gateway to data and intelligence in Microsoft cloud services such as Microsoft Entra and Microsoft 365. In platform terms, it is the API and data fabric sitting under the apps employees already use. Copilot does not magically know the company. It reaches work content through Graph, subject to the same identity and permissions that protect that content when a person opens Outlook or SharePoint.

Exam AB-731 asks you to understand capabilities of Microsoft Graph—not to call REST APIs in a lab. The leadership claim is simple: Copilot cannot see what the user cannot see.

The Graph fabric

Microsoft describes three components that enable data access and flow in the Microsoft 365 platform:

1. Microsoft Graph API — One endpoint, https://graph.microsoft.com, for people-centric data and insights across Microsoft 365, Windows, and Enterprise Mobility + Security. Apps and experiences use REST APIs or software development kits. Graph also includes services that help manage identity, access, compliance, and security and help protect organizations from data leakage.
2. Microsoft 365 Copilot connectors (formerly Microsoft Graph connectors) — Incoming: they deliver data external to the Microsoft cloud into Graph services and applications, enhancing experiences such as Microsoft Search. Microsoft documents connectors for sources such as Box, Google Drive, Jira, and Salesforce.
3. Microsoft Graph Data Connect — Tools to deliver Graph data securely and at scale into Azure data stores so organizations can build analytics and intelligent applications on a cache, with administrator consent over users, groups, and properties.

Together, the API, connectors, and Data Connect power the Microsoft 365 platform. Copilot's daily "summarize this thread" or "draft from my files" path is the API plus the user's token. Connectors and Data Connect are how you extend or analyze that fabric.

Graph exposes data from Microsoft 365 core services (including Bookings, Calendar, Excel, Microsoft Purview eDiscovery, Microsoft Search, OneDrive, OneNote, Outlook/Exchange, People, Planner, SharePoint, Teams, To Do, and Viva Insights), Enterprise Mobility + Security (including Microsoft Entra and Intune), Windows, Dynamics 365 Business Central, and Partner Center. For Copilot grounding, the surfaces leaders name most often are:

• Mail — Outlook and Exchange messages
• Files — OneDrive and SharePoint
• Calendar — meetings and events
• Chats and teamwork — Microsoft Teams
• Users and groups — Microsoft Entra ID identities and Microsoft 365 groups
• Related context — contacts, notes, plans, trending documents, and org relationships such as manager or group membership

Microsoft's own examples are leader-friendly: look up meeting attendees, fetch their profiles and managers, see trending files, suggest meeting times, or read a workbook in OneDrive. That is Graph relationship navigation, not a dump of every file in the tenant.

How Copilot uses Graph for work grounding

Microsoft Copilot coordinates large language models (LLMs), content in Microsoft Graph, and Microsoft 365 apps. Copilot accesses content and context through Graph and can generate responses anchored in organizational data such as documents, emails, calendar, chats, meetings, and contacts. It combines that content with working context—the meeting happening now, last week's chats, the email thread on a topic.

Microsoft 365 Copilot (the licensed work experience Microsoft currently describes with Graph, Work IQ, Copilot Search, and semantic indexing) grounds responses in organizational data the user is allowed to see. Work IQ is the intelligence layer Microsoft documents for reasoning over organizational data, content, and tools; administrators can turn Work IQ on or off. When it is off, users can still get responses, but those responses are not enriched with work-specific Graph context. Copilot Chat experiences that are web-grounded do not automatically search the tenant; the user must attach or open content, or use a work-data agent, unless they have the work-grounded license Microsoft documents.

Semantic Index honors the user identity-based access boundary so grounding only accesses content the current user is authorized to access. Microsoft states Copilot only surfaces organizational data to which individual users have at least view permissions. Permission models in SharePoint, Teams shared channels, and other Microsoft 365 services therefore are Copilot's permission model. Oversharing a Finance site to a broad "everyone" audience is not a Copilot product defect; it is a Graph-visible overshare.

If content is encrypted with Microsoft Purview Information Protection, Copilot honors usage rights. When a sensitivity label applies encryption, users need EXTRACT as well as VIEW for AI apps to return the data. S/MIME-protected emails are not returned; password-protected documents are available only as data in use if already open. This is why legal and security partners belong in Copilot rollout: labels and sharing reviews clean the Graph that Copilot will search.

Graph is secured; only authorized callers access data. Apps use the Microsoft identity platform. Delegated access acts on behalf of a signed-in user: the app's delegated permissions (scopes) and the user's own permissions both apply. App-only access uses application permissions for daemons and automation without a user. Copilot's work grounding for an employee is the delegated, signed-in-user pattern. Least privilege applies to any custom app that calls Graph; that design work is the next chapter's extensibility story, not a reason to grant organization-wide directory read to a departmental chatbot.

Why Graph matters to a transformation leader

A consumer chatbot does not receive the chief financial officer's mailbox because someone typed the company name. Tenant Copilot does not receive that mailbox because someone bought a license. It receives what Graph will return for that user. If HR cannot open Legal's site, Copilot for that HR user cannot ground on Legal's site. If a contractor is in a Teams shared channel, Graph—and therefore Copilot—can surface channel content they can already see.

That is both the safety story and the quality story. Copilot answers are only as trustworthy as the files in Graph and the permissions around them. Microsoft's Copilot documentation points to SharePoint Advanced Management and restricted content discovery because clutter and oversharing degrade grounding. Fix sharing; do not ask Copilot to be more careful than Graph.

Operations example: A plant manager asks Copilot for last quarter's quality report. If the report lives in a locked engineering library, Copilot will not invent access. If the report sits on a wide-open intranet page, Copilot may summarize it for anyone who can view that page. The leader's control is identity, sharing, and labels—not a prompt that says "ignore confidential files."

Legal example: Counsel worries Copilot will "read the whole file share." The accurate briefing is that Copilot reads what the signed-in attorney can already view through Graph. The residual risk is oversharing and weak labels, which is a records and access-control program, not a reason to skip tenant Copilot in favor of pasting exhibits into a consumer bot.

Connectors and extensibility (teaser)

When work data lives in ServiceNow, Salesforce, Jira, or a custom catalog, Copilot connectors index it into Graph (honoring source access control lists) so Search and Copilot can cite it. Power Platform connectors (previous section) are the live-API counterpart. Agents can call tools so Copilot sends a query on the user's behalf; administrators control which agents are allowed in the Microsoft 365 admin center. Microsoft Graph Data Connect is the bulk path: many users or groups, a recurrent schedule, a cache in Azure, Azure Data Factory—not real-time "me" queries.

Microsoft's comparison for leaders:

Build versus buy versus extend—including the Microsoft 365 Copilot extensibility framework—is the next chapter. Here, remember Graph as the fabric Copilot already uses, connectors as the way external knowledge joins that fabric, and Data Connect as analytics-scale movement, all still inside administrator and identity control.