Connecting Microsoft 365 Copilot

Microsoft 365 Copilot can query your Conduit tools directly through a federated connector. Copilot calls Conduit live, as the signed-in user, whenever a prompt needs your data — nothing is copied into Microsoft 365 and nothing is indexed.

One connector covers your whole stack. Conduit’s unified endpoint exposes every vendor your organization has connected behind a single URL, so you set this up once rather than building a separate connector per system.

New in Conduit

Federated connector support shipped recently. The Conduit side is built and tested; the Microsoft side follows Microsoft’s documented setup. If anything in the Microsoft UI differs from what you see below, contact support — Microsoft moves these screens periodically and we’ll update this page.

How this differs from other Copilot integrations

Microsoft has several things called “Copilot”, and they connect differently:

You want	Use
Copilot Chat / Researcher to answer from your vendor data	This guide — a federated connector
A Copilot Studio agent that calls your tools	Connecting Microsoft Copilot Studio
Claude, Cursor, VS Code and other MCP-native clients	Connecting an AI client

Federated connectors are read-only by design. Copilot can look things up — tickets, devices, invoices, customer records — but cannot create or change anything. That is Microsoft’s rule for this connector type, and Conduit enforces it on our side too (see What Copilot can and cannot do).

Before you start

You need:

• An active Conduit subscription and the org-admin role, to create the connector client.
• Microsoft 365 Copilot licenses for the people who will use it. The free Copilot Chat tier does not show custom connectors — the Sources list only lists Microsoft’s own gallery connectors there.
• Global Administrator or AI Administrator in the Microsoft 365 admin center.
• Access to the Teams Developer Portal — this is where Microsoft issues the registration ID the admin center asks for.
• Your Conduit MCP endpoint — https://conduit.wyre.ai/v1/mcp.

Which endpoint?

Use https://conduit.wyre.ai/v1/mcp for new setups. Existing integrations pointed at https://mcp.wyre.ai/v1/mcp keep working — same gateway, same auth, no migration needed.

Step 1 — Create the connector client in Conduit

Sign in to Conduit and open Org settings → Service clients. Click Create and give it a recognizable name, for example Microsoft 365 Copilot.

Tick Use with a Microsoft 365 Copilot connector. This registers Microsoft’s sign-in address against the client, which is what lets your users complete the connection from Copilot. Without it the client is a machine-to-machine credential only, and Copilot sign-in will fail.

Click Create. Conduit shows the client ID (svc_…) and the client secret exactly once.

Copy the secret now

The secret is hashed at rest and cannot be retrieved later. If you lose it, revoke the client and create a new one. Treat it like a password — anyone holding it can start a sign-in against your organization.

The connector client is a broker, not a user

Copilot signs each person in with their own Conduit account. The client you just created only identifies Copilot to Conduit — it never becomes the identity that calls your vendors. Two consequences:

• Which vendors and tools Copilot can use for a person is decided by that person’s Conduit access (their teams, member overrides and the all-members default under Org settings → Access), exactly as in any other AI client.
• Credentials attached to the connector client (the client’s own vendor connections on the Service clients page) are not used by Copilot. Connect vendors at the organization or team level instead, so the people signing in from Copilot can reach them.

Step 2 — Register the client in the Teams Developer Portal

Open the Teams Developer Portal and go to Tools → OAuth client registration → Register client. Make sure the portal is signed in to the same Microsoft 365 tenant your Copilot users are in — registrations are per tenant.

Fill in:

Field	Value
Registration name	Conduit
Base URL	https://conduit.wyre.ai/v1/mcp — include the full /v1/mcp path
Restrict usage by org	My organization only
Restrict usage by app	Any Teams app
Client ID	The svc_… client ID from Step 1
Client secret	The secret from Step 1
Authorization endpoint	https://conduit.wyre.ai/oauth/authorize
Token endpoint	https://conduit.wyre.ai/oauth/token
Refresh endpoint	https://conduit.wyre.ai/oauth/token
Scope	mcp
Client password authentication method	Either option works — Conduit accepts the secret in the request body and as HTTP Basic

Turn on PKCE

Enable Proof Key for Code Exchange (PKCE). Conduit requires it on every sign-in. If this is left off, users get an error when they try to connect and the message will not say why.

Click Save. The portal then shows an OAuth client registration ID. Copy it — that is what the admin center asks for in the next step.

Step 3 — Create the connector in the admin center

In the Microsoft 365 admin center, go to Copilot → Connectors → Gallery. Under Created by your org, find Create a new connector and click Add. On the Custom connector page, under Connect to MCP server, click Add.

The form asks for:

Field	Value
Display name	What your users will see in Copilot, for example Conduit
MCP endpoint URL	https://conduit.wyre.ai/v1/mcp — include the full path
Developer name	Your company name
Website URL	Any page about the integration, for example https://conduit.wyre.ai/docs/guides/microsoft-copilot/
Privacy policy URL	https://conduit.wyre.ai/privacy
Terms of use URL	https://conduit.wyre.ai/terms
Authentication type	OAuth 2.0
Reference ID	The OAuth client registration ID from Step 2

Include the /v1/mcp path

Both here and in the Teams Developer Portal, the MCP endpoint URL is the address of the MCP server itself — not your Conduit sign-in domain. Entering https://conduit.wyre.ai on its own points Copilot at our website instead of the tool endpoint, and the connector will never work. This is the easiest mistake to make in the whole setup.

After the Reference ID, click Authorize. This opens Conduit’s sign-in in a pop-up so the admin center can confirm the registration works — allow pop-ups for the admin center if your browser blocks it, then sign in with your Conduit account. Tick the Notice acknowledgement and click Create.

Other authentication types

The admin center also offers None, Entra SSO and OAuth 2.0 with Dynamic Client Registration. Use OAuth 2.0 with the Teams Developer Portal registration: Conduit’s dynamic registration endpoint does not issue the client secret Microsoft requires for the DCR option, and Entra SSO is not supported yet.

Step 4 — Roll it out

Your connector now appears under Your connections.

Start with Staged rollout and add a small group of test users before releasing to everyone. When you are satisfied, choose Deploy to all users.

Allow 15 minutes

Changes to a connector — creating, enabling, staging — take up to 15 minutes to reach users. If something you just changed has not appeared, wait before troubleshooting.

What your users do

Once the connector reaches them, each person connects it themselves and signs in with their own Conduit account:

1. Open Microsoft 365 Copilot Chat.
2. Select the … menu, then Chat settings.
3. Choose Sources in the left pane.
4. Find your connector and select Connect, then complete the sign-in.

Sign in with the Conduit account that belongs to your organization

The Conduit sign-in accepts email/password and Microsoft accounts. Signing in with a Microsoft account Conduit has not seen before creates a new, empty user that belongs to no organization — Copilot then connects successfully but finds no vendors. Each person should sign in with the same identity they use in the Conduit dashboard, or an admin should invite that identity to the organization first.

After that they can just ask. Copilot decides on its own when a question needs your data, and it does that far more reliably when the prompt names the system: “list the open Autotask tickets for Contoso” rather than “any open tickets?”.

Users can turn the source off at any time from the same screen, or from the Sources menu in the Researcher agent.

What Copilot sees

Copilot is not an ordinary MCP client, and Conduit does not hand it the same tool list it hands Claude or Cursor. Microsoft’s connector runtime keeps only tools that are explicitly marked read-only, and it stops selecting tools altogether once a list grows past roughly ten — a hundred-tool list does not degrade, it silently never gets used. So when the caller is a Copilot connector, Conduit serves a curated profile instead:

• At most 10 tools, spread across the vendors the signed-in person can reach — every connected system gets its most useful lookup before any system gets a second.
• Read tools only. Only tools Conduit classifies as read are eligible; write and admin tools are never sent to Copilot, whatever the person’s own tier is.
• Marked read-only and titled, with compact input schemas, so Copilot’s runtime accepts them.

The tools chosen per vendor are the everyday lookups — for example ticket search and ticket detail, company and contact search for a PSA; device list, device detail and active issues for an RMM; organization, configuration and document search for documentation platforms. Tool names are the same as everywhere else in Conduit, so a Copilot call appears in your audit trail exactly like any other client’s.

Want a different tool exposed to Copilot?

The per-vendor selection is a fixed list on the Conduit side. If a lookup you rely on is missing, tell support which vendor and tool — swapping one in is a small change and ships quickly.

What Copilot can and cannot do

Every user sees only their own data. Copilot calls Conduit as the signed-in person and their normal Conduit permissions apply — the same vendors they would get in any other AI client, no more. One person’s Copilot cannot reach anything they could not already reach themselves.

Read-only. Copilot only ever receives read tools (see What Copilot sees), and Conduit also refuses any write or admin tool call that arrives through a Copilot connector, so it can look up and report but cannot create, change or delete anything in your connected systems. This holds even for an org owner, whose other AI clients would see everything.

Nothing is copied into Microsoft 365. Answers are fetched live at the moment of the question. There is no index to build, refresh, or purge.

Every call is logged. Copilot’s tool calls appear in your Conduit audit trail like any other client, so you can see exactly what was asked for and by whom.

Troubleshooting

The connector does not appear for users. Check the tenant-wide gate first. In the admin center under Settings → Agent 365 → Allowed agent types, if both Microsoft-published and third-party-published are deselected, federated connectors are off by default and each must be enabled individually. This is configuration, not a fault — and it is the most common cause. Also confirm the 15-minute propagation window has passed, and that the user is inside your staged-rollout group.

Sign-in fails or returns an error. Almost always one of three things: PKCE was not enabled in the Teams Developer Portal (Step 2), the Use with a Microsoft 365 Copilot connector box was not ticked in Conduit (Step 1), or the client secret was mistyped. The secret cannot be read back, so if you are unsure, revoke the client and redo Steps 1 and 2.

Copilot connects but says it cannot find or discover a tool. Copilot is telling you that nothing in the tool list it received was usable, which has three common causes. First, the vendor is connected only to the connector client or only to a team the signed-in person is not in — check that person’s access under Org settings → Access (the conduit__my_access tool in any other AI client shows exactly what they can reach). Second, the person connected the source before this profile shipped (September 2026) and Copilot is still holding the old tool list — disconnect and reconnect the source once from Chat settings → Sources, which forces a fresh sign-in and a fresh list. Third, the vendor’s tools are not yet classified in Conduit, so none of them count as read-only; the audit trail will show tools/list calls from Copilot with no tool calls following them — contact support with the vendor name.

Copilot connects, but ignores the connector on some prompts. Expected behaviour, not a misconfiguration. Copilot’s orchestration layer decides per prompt whether a connector is relevant, and Microsoft has confirmed that tool discovery succeeding does not guarantee the connector is invoked. The practical lever is prompt specificity — name the system or record type you want (“look up the open Autotask tickets for Contoso”) rather than asking generally (“any open tickets?”). If a connector is consistently skipped where you would expect it, let us know; tool naming and descriptions are something we can tune on the Conduit side.

Copilot says it cannot perform an action. Expected — the connector is read-only. Use an MCP-native client or Copilot Studio for workflows that need to write.

Frequently asked questions

Does my data get copied into Microsoft 365?

No. Federated connectors fetch data live at query time. Nothing is indexed into Microsoft Graph, and there is no copy of your data inside Microsoft 365 to manage or delete.

Can Copilot change things in my PSA or RMM?

No. Copilot only ever receives Conduit’s read tools, and Conduit refuses any write or admin tool call made through a Copilot connector, whatever the signed-in person’s own permissions are — so it can look things up but cannot create, update or delete.

Do users see each other’s data?

No. Copilot calls Conduit as the signed-in user, and that person’s existing Conduit permissions apply unchanged. Each user signs in individually the first time they use the connector.

Do I need a separate connector for each vendor?

No. Conduit’s endpoint exposes every vendor your organization has connected behind one URL, so a single connector covers your whole stack. Vendors connected after you create the connector client need an explicit grant.

Which Copilot experiences does this work in?

Microsoft 365 Copilot Chat, Copilot in Excel, the Researcher agent, and Cowork.

Is this the same as Copilot Studio?

No. Copilot Studio agents connect through a Power Platform custom connector and use a different auth path — see Connecting Microsoft Copilot Studio. This guide is for Microsoft 365 Copilot itself.

Related

• Connecting Microsoft Copilot Studio
• Connecting an AI client
• Managing access
• Vendor connections
• Getting support