The solution requires using only Dataverse data while respecting existing record-level security, all within the current Dynamics 365 application. Copilot Studio allows you to ground a copilot directly on Dataverse. This approach uses the existing data source without exporting it, inherently respects the user's security context and permissions within Dataverse, and can be embedded directly into the Dynamics 365 model-driven app. This meets all constraints, including improving adoption within the existing experience and forbidding new connectors or data stores.

B. Azure AI Foundry agent for sales: This is a more complex, custom solution that typically involves external Azure services, violating the "no new connectors or data export" rule.

C. Power BI semantic model summaries: Power BI is for analytics and reporting, not for generating conversational summaries and follow-up actions within the primary application interface.

D. External vector store with Copilot Studio grounding tier: This explicitly violates the requirement to forbid exporting data to a separate store.

1. Microsoft Learn. "Use Dataverse as a data source for generative AI." Copilot Studio Documentation, section "Prerequisites" and "Connect to Dataverse." This document confirms that Copilot Studio can connect directly to Dataverse, respecting user permissions.

2. Microsoft Learn. "Configure security in Microsoft Dataverse." Power Platform Documentation, section "Security concepts in Microsoft Dataverse." This explains how Dataverse's role-based security model ensures users can only access data they are permitted to see, which is inherited by the copilot.

3. Microsoft Learn. "Add a copilot to a model-driven app in Power Apps." Power Platform Documentation. This shows how a copilot can be embedded into the existing Dynamics 365 experience, meeting the adoption requirement.