Create a Microsoft Copilot Studio agent that calls the same governed Runtime MCP tools as the portal — Role Assistants, work, and human response — using the MS Copilot OAuth2 profile.
Copilot Studio is another approved conversation surface. It must call governed Role Assistant tools. It does not become a parallel automation stack. See External AI and Enterprise MCP.
This is not the Microsoft 365 Copilot organisation package. For that path, use Install Microsoft Copilot channel.
Prerequisites
- Deliver assistant channels hub read
- External Access MS Copilot profile enabled (
miso-ms-copilot) - Copilot Studio access in your Microsoft environment
- A client secret you can paste once (Rotate Secret on the profile if you no longer have it)
Where it lives
| Artifact | Location |
|---|---|
| OAuth2 profile | Controller External Access → OAuth2 profiles → MS Copilot |
| Stable profile URL | /miso/external-access/oauth2-profiles/miso-ms-copilot (also accepts catalog key ms-copilot) |
| Runtime MCP | {dataplane}/mcp/v1/runtime-orchestration |
| Optional Knowledge MCP | {dataplane}/mcp/v1/{systemKey} from the Connected System in Dataplane |
Copy Authorization URL, Token URL, Client ID, and Issuer from the profile page. Do not invent Keycloak paths.
How to set
- Open Copilot Studio, go to Agents, then New agent.
- Set Name (for example
Elsa (Dev)). - Set Instructions to the same governed prompt used for Microsoft Copilot packaging:
Use governed enterprise work tools only. Resolve Role Assistants dynamically and keep business reasoning inside authorized Role Assistant boundaries.
That text is enough to keep the agent inside Role Assistant boundaries. Add conversation starters later if you want discovery phrases such as “Show my role assistants”.
- Open the left panel Tools → Add → Model Context Protocol (MCP).
- Fill Add MCP server:
| Field | Value |
|---|---|
| Server name | For example AI Fabrix DEV |
| Server description | Enterprise AI assistant for employees. Approved assistants, enterprise knowledge, workflows, and governed actions via AI Fabrix. |
| Server URL | Runtime MCP URL from the table above |
| Authentication | OAuth 2.0 |
| Configuration type | Manual |
- Open the MS Copilot profile (
/miso/external-access/oauth2-profiles/miso-ms-copilot). Confirm it is enabled. Rotate Secret if needed, then paste:
| Copilot Studio field | From the profile |
|---|---|
| Client ID | miso-ms-copilot |
| Client secret | The secret shown once after rotate (never store it in docs or chat) |
| Authorization URL | Profile Authorization URL |
| Token URL | Profile Token URL |
| Refresh token URL | Same as Token URL |
- Click Add and wait until Copilot Studio validates auth.
- Create new connection, name it (for example
Elsa (Dev)), then Create. - Sign in with your AI Fabrix account (or Entra SSO if that is how your tenant signs in).
- Finish with Add. Runtime MCP tools should appear so you can start building.
Hidden redirect URL
Copilot Studio does not show the OAuth redirect URL. It sends an Azure APIM callback such as https://global.consent.azure-apim.net/redirect/<connection-id>.
The MS Copilot profile already allows that Azure APIM pattern. If login still fails, copy redirect_uri from the Keycloak authorize URL in the browser and add it on the profile (Redirect URIs → Add URI), then retry Create.
Optional: Enterprise Knowledge MCP
To call a Connected System’s Enterprise Knowledge MCP instead of Runtime MCP, copy the MCP URL from Dataplane for that system (…/mcp/v1/{systemKey}) and repeat the same OAuth 2.0 fields. Validate the URL in Dataplane before pasting it into Copilot Studio.
Defaults and examples
| Setting | Typical value |
|---|---|
| Client ID | miso-ms-copilot |
| Catalog key | ms-copilot |
| Runtime system | runtime-orchestration |
| Refresh token URL | Same as Token URL |
| Instructions | The prompt block above |
Copy live Authorization URL, Token URL, Client ID, and Issuer from the MS Copilot profile. Never paste secrets into docs or chat.
Validate
- Copilot Studio shows the MCP server as connected after Add.
- Sign-in completes and returns to Copilot Studio (no Keycloak “invalid redirect” error).
- Tools from Runtime MCP are listed on the agent.
- A test prompt such as “List my available Role Assistants” stays inside governed tools.
Common mistakes
| Mistake | Fix |
|---|---|
| MS Copilot profile disabled | Enable MS Copilot at /miso/external-access/oauth2-profiles/miso-ms-copilot |
| Copilot Studio callback missing | On that profile, add the redirect_uri from the Keycloak authorize URL (Redirect URIs → Add URI). Seeded patterns include https://global.consent.azure-apim.net/redirect/* |
| Using the Microsoft 365 Copilot ZIP path | That is Entra SSO packaging — different how-to |
| Pasting a database id into Copilot Studio | Client ID is miso-ms-copilot |
| Skipping Rotate Secret | You only see the secret once |
| Expecting Copilot Studio to display the redirect URL | Capture redirect_uri from the authorize URL if needed |
| Pointing MCP at a Connected System without checking Dataplane | Copy the live MCP URL from the system page |
Limits
Copilot Studio labels and the Add MCP wizard can change with Microsoft updates. Redirect hostnames (global vs europe) vary by environment. Not every Runtime MCP tool is exposed in every deployment tier. Treat Copilot Studio as another channel into the same Operational Trust boundary — not a bypass around Role Assistants.