Appendix B: Cloud Availability Matrix

One row per control, one column per cloud. A cell is a documented claim until a tenant check turns it into an observation; the basis says which, and when. The rows render from src/data/copilot/controls.ts, the same source as each chapter's "In GCC High" table, so the two cannot drift.

Control	Commercial	GCC	GCC High	DoD
Chapter 7: The three DLP gates
DLP policy location for Microsoft 365 Copilot and Copilot Chat	Available	Available	Available	Available
Chapter 8: Web grounding
Web grounding	Available	Different	Different	Different
Chapter 10: Agents users build
Agent Builder (New agent in Copilot Chat)	Available	Available	Different	Not available
Sharing an agent with other users	Available	Not checked	Not available	Not available
Publishing an agent to the organization (administrator approval)	Available	Available	Available	Not checked
Embedded files as agent knowledge	Available	Not available	Undocumented	Not checked
Code interpreter in Agent Builder agents	Available	Not checked	Different	Not checked
Image generator in Agent Builder agents	Available	Not checked	Not available	Not checked
SharePoint agents	Available	Available	Not available	Available
Copilot connectors as agent knowledge	Available	Different	Different	Different
Chapter 11: Agents developers build
Copilot Studio	Available	Available	Different	Not checked
Copilot Studio: Teams and Microsoft 365 Copilot channel	Available	Available	Not available	Not checked
Copilot Studio: event triggers and autonomous agents	Available	Not available	Not available	Not checked
Copilot Studio: code interpreter	Different	Not available	Not available	Not available
Copilot Studio audit logging in Purview	Available	Undocumented	Undocumented	Undocumented
Copilot Studio: Control maker credential options	Available	Undocumented	Undocumented	Undocumented
Pro-code declarative agents (Microsoft 365 Agents Toolkit)	Available	Different	Different	Different
Custom engine agent in Teams (Azure Bot Service)	Available	Not checked	Different	Not checked
Foundry Agent Service	Available	Not checked	Different	Different
Chapter 12: The agent control plane
Agent 365 (Microsoft 365 E7 or G7, or the stand-alone subscription)	Available	Different	Not available	Not available
Conditional Access and identity protection for agent identities	Available	Available	Not checked	Not checked
Defender real-time protection for agents	Different	Not available	Not available	Not checked
Chapter 13: Prompt injection and runtime defenses
Defender for Office 365 Plan 2: prompt injection protection at mail flow	Available	Undocumented	Undocumented	Undocumented
Microsoft-operated runtime mitigations (block list, Unicode sanitization, spam exclusion, tool chain analysis)	Available	Undocumented	Undocumented	Undocumented
Chapter 16: Insider risk and Adaptive Protection
Insider Risk Management: Risky AI usage for Copilot	Available	Not checked	Different	Not checked