Copilot shows what a user is allowed to see, so hiding starts with access. The options that exist (RAC, RCD, sensitivity labels, DLP, search exclusion, connectors, agents, web search, Teams), how to set each one in the portal and PowerShell, and what each one does not do.
The setup for both tenants, host and partner: cross-tenant access settings in Entra, MFA trust, Teams policies and external access, with PowerShell, a check afterwards, common errors and how to undo it.
Retention labels with PowerShell: New-ComplianceTag, publish policy, auto-apply. Not New-Label. Microsoft 365 (M365).
Tenant policy with Set-CsTeamsChannelsPolicy and per channel via Graph layoutType (chat or post).
Every File Plan column, daisy-chain (last label first), Power Automate flow and disposition review.
Connect-IPPSSession, Get-ReviewItems, paging, export, and what you can and cannot approve in bulk.