An AI Company Brain makes approved organisational knowledge accessible through retrieval and generated answers. It is not all-knowing: quality and access depend on sources, retrieval, permissions and freshness.
The factual statements were reviewed on 8 September 2026. For residency, consult Microsoft's current pages for Copilot Studio, Microsoft 365 Copilot and Azure OpenAI.
Five layers
1. Knowledge sources
Sources may include SharePoint, OneDrive, approved business systems, databases, documents and APIs. Ownership, freshness, retention and the permitted audience must be defined before integration.
2. Retrieval and index
Content is typically prepared, split and made searchable. Vector search is one option, but not mandatory for every source: structured data may be retrieved through controlled functions or APIs. Chunk size and embedding model are evaluation choices, not universal rules.
3. Language model
The model formulates an answer from supplied context. Azure OpenAI and Microsoft Foundry models have region- and deployment-specific availability. A product name does not prove Swiss residency.
4. Orchestration and security
Orchestration selects sources and tools, executes steps and records the process. Access control must be enforced at each source and during retrieval. In supported scenarios, Copilot Studio can respect the signed-in user's identity and permissions for SharePoint knowledge. In a custom Azure AI Search solution, permission filtering must be explicitly designed and tested; universal automatic inheritance of every SharePoint ACL is not guaranteed.
5. Interface and audience
| Interface | Typical audience | Key check |
|---|---|---|
| Teams / Microsoft 365 | employees | identity, licence, permissions |
| SharePoint | internal intranet | supported publication and authentication |
| Custom web app | internal or external portal | own authentication, API and operations |
| Public channel | customers/B2C | privacy, abuse controls and usage costs |
An internal Microsoft 365 canvas is not automatically an external portal. Copilot Studio documents publishing channels separately. Anonymous or external audiences require their own identity, consent, data-release and licensing design.
Privacy and residency
Email, HR records, meeting transcripts and CRM data can contain sensitive or confidential information. “Present in the tenant” does not mean “permitted for the agent”. Use explicit source allowlists, role-based tests and proportionate logging.
The revised Swiss Data Protection Act has applied since September 2023. Overseas disclosure requires analysis under Articles 16 et seq., including adequacy or appropriate safeguards and applicable transparency duties. The FDPIC guidance explains this assessment.
- Copilot Studio: Microsoft lists Switzerland North and Switzerland West for the Swiss Azure geography and generally keeps customer data in the chosen geography, but documents exceptions for global, external and Microsoft 365-powered services.
- Microsoft 365 Copilot: commitments depend on the tenant, Product Terms and underlying Microsoft 365 workloads. Not every data type necessarily has one location.
- Azure OpenAI / Foundry: regional Standard deployments process within the chosen geography; Global and Data Zone deployments may route differently. Models and tools vary by region.
- Replit: according to Replit documentation, published apps run on Replit infrastructure. Hosting is primarily in the US; Enterprise customers may request EU hosting. This is not Swiss residency.
A solution architecture must therefore list concrete services, deployment types, connectors, logs and subprocessors. “Set the tenant to Switzerland North” is not a general Microsoft 365 configuration instruction.
Conclusion
Start with data and access rights, not the model. Select a platform only after audience, sources, identity, residency and quality criteria are defined. Savings claims require a measured baseline and comparison period.
Further reading: Platform comparison · Contact us