Azure Copilot
Your business context, one useful assistant.
ColdAI builds assistants on Azure that answer from an organization's own documents and records and can start approved actions, while respecting who may see what. Work starts with a knowledge map and an access model; the conversation and the actions are then designed for one audience and one workflow, using Azure AI Search for retrieval and Azure OpenAI models deployed through Microsoft Foundry.
The opportunity
Start with a decision
worth improving.
An employee asks a policy question and then needs to start the correct internal request. The assistant must respect document permissions and hand over to the right process.
From possibility to a working system
Follow the flow.
Three connected decisions. One considered architecture.
Conceptual flow, not a live system or measured result.
Find the trusted knowledge
Identify the content an assistant should use and who may see it. Resolve conflicting documents and define source ownership before connecting a conversational interface.
Shape the experience
Design the questions, actions and handoffs for a specific team. Test how the assistant handles ambiguity and missing information instead of assuming every conversation has a clean answer.
Connect approved actions
Integrate the selected Microsoft tools and business systems within the agreed permission model. Review sensitive actions and measure whether the workflow helps users complete their task.
The work, made concrete
What we can build
with your team.
We agree scope, dependencies and acceptance criteria before delivery. Your project can start with an assessment, a pilot or an integration into an existing system.
Assistant scope and knowledge map
Clarify the system boundary, the responsible owners and the decisions the architecture needs to support.
Permission-aware conversational flows
Turn the agreed design into reviewable work, evaluated against representative inputs and explicit success criteria.
Integration and user acceptance checks
Make the next step operable: document responsibilities, known limitations and the path from pilot to ongoing use.
In depth
Go deeper into Azure assistant engineering
Two questions decide whether an Azure assistant can reach production: whether retrieval respects document permissions, and where prompts are processed.
- 01ArchitecturePermission-aware RAG with Azure AI SearchHow to make an Azure OpenAI assistant answer only from documents each user may open: permissions in the index, query-time trimming, sync and persona tests.
- 02Regulation explainerAzure OpenAI data residency: Global, Data Zone or regionalWhere Azure OpenAI processes prompts and stores data under Global, Data Zone and regional deployments, and how that maps to GDPR, DORA and the EU Data Boundary.
Building your own assistant on Azure, not configuring Microsoft's Azure Copilot
The name causes confusion. Microsoft's own Azure Copilot is an assistant inside the Azure portal that helps administrators design, operate and troubleshoot their cloud resources, acting only with the permissions each administrator already has2. This page is about something else: an assistant your organization builds from Azure services, for employees or customers, that answers from your policies, manuals and records and hands work to your systems.
It also differs from extending Microsoft 365 Copilot, which our Microsoft Copilot Development page covers5. When the audience already works in Teams and Outlook and the content lives in a well-governed SharePoint estate, that route often needs less engineering. An assistant built on Azure earns its extra work when you need control over retrieval, the model deployment, where data is processed or the interface itself, or when the people using it are customers and frontline staff rather than office license holders.
Six layers of an Azure-hosted assistant and what each one decides
Each layer has its own owner and its own failure modes. Naming them early stops the model from being blamed for problems that sit in the index, the identity setup or an action.
- Channel
Where people ask: a web app, a Teams app or a customer portal, each with its own sign-in and accessibility needs.
- Orchestrator
Application code or a Foundry agent that decides whether to retrieve, ask a clarifying question or act, and assembles the prompt.
- Azure AI Search index
Chunks of approved content with keyword and vector fields, plus permission fields that trim results for each user3.
- Azure OpenAI deployment
A model deployed in Microsoft Foundry under a deployment type chosen for processing location, throughput and cost4.
- Approved actions
Functions, Logic Apps or line-of-business APIs the assistant may call, each validated on the server and confirmed by the user when it changes something.
- Identity and telemetry
Microsoft Entra ID for user and service identities, and logs recording which sources were used and which actions ran.
Mapping the trusted knowledge before anything is indexed
A knowledge map lists every source the assistant may use, who owns it, how it reaches the index and how its permissions travel with it. Gaps in this table turn into wrong answers, or leaked ones, after launch.
| Source | Typical route to the assistant | How permissions travel | Question for the source owner |
|---|---|---|---|
| SharePoint document libraries | A SharePoint indexer into Azure AI Search, or a remote knowledge source that queries SharePoint when the question is asked6 | Ingested access lists (preview), or SharePoint's own trimming when queried remotely | Which sites are authoritative, and which hold drafts or superseded versions? |
| Files in Blob Storage or Data Lake Storage Gen2 | A blob or data lake indexer, or a push from your own pipeline | Access list and role-based metadata (preview), or a group field you populate | Do folder permissions mirror who should actually see the content? |
| Records in CRM, ERP or HR systems | Usually queried live through an action instead of being copied into the index | The calling user's own entitlements in the source system | Is a live answer required, or would a nightly copy be acceptable? |
| Policies published as intranet pages | Exported or crawled, then pushed with owner and version fields | A group field you maintain, because the page platform may not expose access lists | Which version is current, and who retires the old pages? |
| Ticket and case history | Summarized and pushed, with personal data reduced to what answers need | Team or region groups, never the whole organization by default | Does your privacy notice allow past cases to be reused this way? |
Status labels reflect Microsoft Learn documentation reviewed for this page; preview features can change before general availability3.
When an Azure-built assistant is the right home, and when it is not
- If
People want help with Azure subscriptions, costs or resource health.
ThenUse Microsoft's Azure Copilot in the portal instead of building anything.
It already works across the resources and actions each administrator is permitted to use2.
- If
Employees live in Teams and Outlook, and the content sits in SharePoint with sound permissions.
ThenStart with Microsoft 365 Copilot extensibility through our Microsoft Copilot Development work5.
The tenant's interface and permission model come with it, so less has to be built and operated.
- If
The users are customers, partners or frontline staff without Microsoft productivity licenses.
ThenBuild on Azure with your own channel, Azure AI Search retrieval and an Azure OpenAI deployment.
You control sign-in, branding and running cost, and nobody needs a per-seat product to use it.
- If
Regulation or contracts constrain where prompts may be processed.
ThenBuild on Azure and pick the deployment type deliberately; see Azure OpenAI data residency.
Processing location follows the deployment type, so it can be designed and enforced instead of assumed4.
- If
Answers must combine document knowledge with live records and a follow-up action.
ThenBuild on Azure with an orchestrator that keeps retrieval, clarification and actions as separate steps.
That separation is what lets each action be validated, confirmed and logged on its own.
Conversation design decisions to settle before the first build
These choices shape the prompt, the interface and the evaluation set. Leaving them to the model produces an assistant whose behavior changes from week to week.
A hypothetical leave question that turns into a request
Five ways an Azure assistant goes wrong after launch
Retrieval runs with a service identity and returns everything
Early signalAnswers quote documents the asking user could not open in SharePoint.
MitigationCarry document permissions into the index and trim each query by the caller's identity; see permission-aware retrieval with Azure AI Search.
Stale or duplicated knowledge
Early signalTwo answers to the same question cite different versions of one policy.
MitigationGive each source an owner, remove superseded documents from the index and schedule re-indexing to match how often the content really changes.
Text inside documents steers the model
Early signalRetrieved passages contain sentences addressed to the assistant, or answers shift after an unrelated upload.
MitigationTreat retrieved content as data, keep decisions about actions in application code and use the deployment's guardrail settings as one layer of defense, not the only one.
Actions run without anyone seeing them
Early signalRequests appear in downstream systems that nobody remembers submitting.
MitigationRequire confirmation for anything that changes state, validate arguments on the server and log the user, the action and its result.
Model availability changes the plan late
Early signalThe preferred model is not offered in the required region or deployment type.
MitigationCheck availability by deployment type and region during design, before the data-location decision is presented as settled4.
Frequently asked questions
Is this the same as Microsoft's Azure Copilot?
No. Microsoft's Azure Copilot is an assistant in the Azure portal for managing cloud resources, such as answering questions about subscriptions or helping troubleshoot a service. The assistants described here are applications your organization builds on Azure services for its own employees or customers. They answer from your content, call your systems through approved actions and can sit in a web app, a Teams app or a customer portal.
Do our users need Copilot licenses to use an Azure-built assistant?
Not for the assistant itself. An assistant built on Azure is paid for through the Azure resources it consumes, mainly model usage or provisioned throughput, the search service and hosting4. Licenses only come into play if you also extend Microsoft's own Copilot products, and that depends on where your users work and which product terms apply. That is why the product choice follows scoping rather than preceding it.
Can the assistant answer from our data lake as well as SharePoint?
Yes, provided the content can be indexed together with its permissions. Files in Azure Data Lake Storage Gen2 can be indexed with their access lists through a preview capability, and other stores can be pushed into the index with a group field you populate3. Structured figures are often better served by a live query action than by indexed copies, because they change and the source system already enforces access.
Which models can an Azure assistant use?
Azure OpenAI models and other models sold by Azure through Microsoft Foundry, limited by what is offered in your region and deployment type4. The choice should come from testing candidates against your own question set, including questions that have no good answer, rather than from public benchmarks. New models usually reach Global deployment types first, which matters if your rules require a Data Zone or regional deployment.
How do you decide the assistant is ready to release?
An evaluation set is agreed before building: real questions from the target audience, the sources each should cite, questions the assistant must decline and actions that must ask for confirmation. Every release is scored against that set, then user acceptance checks run with the audience itself. Those acceptance checks sit alongside the knowledge map and permission-aware conversational flows in the deliverables for this work1.
Who keeps the assistant accurate after launch?
Named owners for each knowledge source, someone responsible for reviewing failed conversations, and a release process for prompt, model and index changes. Without those roles, answers drift as documents change. The knowledge map, evaluation set and runbooks are handed over so your own team can run the assistant, and managed services are an option if you would rather not operate it yourselves.
Sources
- Azure Copilot: knowledge map, permission-aware conversational flows and acceptance checks — ColdAI
- Azure Copilot overview — Microsoft Learn
- Document-level access control in Azure AI Search — Microsoft Learn
- Understanding deployment types in Microsoft Foundry Models — Microsoft Learn
- Microsoft Copilot Development: tenant-aware copilot experiences — ColdAI
- Use a SharePoint indexer to ingest permission metadata — Microsoft Learn
Connect the architecture
The next connection.
Explore the complementary capabilities that can turn an individual technology into a complete workflow.
Your next move
Bring us the
real problem.
A workflow that takes too long. A system that cannot connect. An idea that needs a technical path. Start there, and we can define what to investigate, build and measure.
- A defined employee or customer audience
- Maintained knowledge sources
- Tenant and security stakeholders