Package Microsoft Copilot as an Entra SSO channel so employees use the same governed Enterprise MCP tools (including Role Assistants) that the portal uses.
Users state a business goal in Copilot. AI Fabrix Role Assistants return a governed result, question, or completed outcome. Copilot does not execute enterprise work or grant authority. See Conversation-first work.
You run channel add twice. The first run prints the Teams Entra SSO form values. You create the registration in Teams. The second run embeds that registration id and generates the ZIP.
Prerequisites
- Deliver assistant channels hub read
aifabrix loginand developer workstation ready- Entra SSO tenant onboarding completed (creates the Runtime MCP enterprise app, Trust audience/scopes, Teams/M365 pre-authorized clients, and Teams OAuth consent redirect)
- People with the Microsoft access listed under Access you need (below)
Access you need
Customers need Microsoft directory and Teams roles for this channel. Builder login alone is not enough.
| Work | Microsoft access | Where |
|---|---|---|
| Register Entra SSO and import the app package | Access to Teams Developer Portal for your tenant | Tools → Microsoft Entra SSO client ID registration, then Apps import |
| Publish / allow the custom app for the organisation | At least Teams Administrator | Teams admin center → Manage apps |
| First-time org consent in Microsoft 365 Copilot (when prompted) | A user who can grant consent, or an admin who can grant admin consent | Microsoft 365 Copilot / Entra enterprise applications |
Confirm roles against Microsoft’s current docs: Manage apps in Teams, Teams administrator roles, and Grant tenant-wide admin consent when org-wide consent is required. Role names can change; use least privilege your tenant allows.
Where it lives
| Artifact | Location |
|---|---|
| First-run output | Terminal values for the Teams Entra SSO form (Base URL, Client ID, Scope) |
| Channel package | Builder output under dist/channels/microsoft-copilot/ after the second channel add (ZIP + INSTALL guide) |
| Secrets | Teams Entra SSO registration id only — no Fabrix OAuth client secret in the package |
Copilot exposes the same governed Enterprise MCP tools as other surfaces — not a parallel agent runtime.
How to set
1. Print Teams Entra SSO values
aifabrix channel add microsoft-copilot --name "Onni"
Do not pass a registration id yet. Builder stops and prints the values to paste into Teams:
| Teams form field | What Builder prints |
|---|---|
| Registration name | The channel display name (for example Onni (dev)) |
| Base URL | Remote MCP URL |
| Client (application) ID | Entra SSO enterprise app (client) id from onboarding |
| Scope | Runtime MCP delegated scope (for example api://<client-id>/invoke) |
This first run does not produce an importable ZIP. The registration id does not exist until you save the Teams form.
2. Create the SSO registration in Teams
- Open Teams Developer Portal → Microsoft Entra SSO client ID registration.
- Register a client ID (or open the existing registration for this channel).
- Paste Base URL, Client (application) ID, and Scope from the first
channel add. Bind the registration to this channel’s Teams app / manifest ID — not “Any Teams app”. - Save. Copy the Microsoft Entra SSO registration ID (auth-config id).
That id is not the Entra Client (application) ID and not a client secret.
3. Generate the package
aifabrix channel add microsoft-copilot --name "Onni" \
--oauth-plugin-vault-reference-id "<Teams-Entra-SSO-registration-id>"
This second run writes the ZIP and INSTALL guide with the registration id in the package.
Then:
- Import only the ZIP in Developer Portal (Import an app). Preserve the generated Teams app id.
- Publish to your organisation. Teams Administrator allows the app in Manage apps when required.
- Open the app in Microsoft 365 Copilot, consent if prompted, then retry Role Assistant discovery (for example “Show my role assistants”).
Copilot uses the same governed tools as the portal — see External AI and Enterprise MCP.
Defaults and examples
| Setting | Typical value |
|---|---|
| Target key | microsoft-copilot |
First channel add |
--name only — prints Teams form values |
Second channel add |
Same --name plus --oauth-plugin-vault-reference-id — generates ZIP |
| Auth mode | Microsoft Entra SSO (OAuthPluginVault) |
| Product law | One Copilot channel install per environment; many Role Assistants |
The ZIP uses Microsoft Entra SSO (OAuthPluginVault) for the Copilot plugin — not a Fabrix client secret in authentication. Builder stores channel branding and the Teams registration id; do not paste connector JSON into this how-to.
Validate
aifabrix channel add microsoft-copilot --name "Onni" \
--oauth-plugin-vault-reference-id "<Teams-Entra-SSO-registration-id>" --probe
Confirm INSTALL shows a filled Client ID and Scope, package readiness is true, and Copilot can list Role Assistants after consent. Admin completes Connect assistant channels.
Common mistakes
| Mistake | Fix |
|---|---|
Passing --oauth-plugin-vault-reference-id before Teams Save |
Run the first channel add without that flag, fill Teams, then run the second command |
| Empty Client ID or Scope on the Teams form | Use the values from the first channel add |
| Importing ZIP from the first run | There is no package until the second channel add |
| Expecting client-credentials OAuth in the package | This channel uses Entra SSO, not Fabrix oauth2 secrets |
| Skipping Teams admin publish | Teams Administrator publishes/allows the app in Manage apps |
Limits
Not every Enterprise MCP tool may be exposed to Copilot in every tenant policy. The Entra SSO registration form is completed in Teams Developer Portal; Builder cannot create that registration for you. Authorized Microsoft 365 / Teams clients and the Teams OAuth consent redirect are set by Entra SSO onboarding — not by a manual Graph/az step on a clean install.