> For the complete documentation index, see [llms.txt](https://docs.datasentinel.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.datasentinel.io/manual/ai-connector/connect-a-desktop-app/configure-copilot-studio.md). # Configure Microsoft Copilot Studio Connect a Microsoft Copilot Studio agent to your Datasentinel MCP server with OAuth sign-in, install the Datasentinel Skill, and reach a private platform from Microsoft's cloud. This page shows how to wire a **Microsoft Copilot Studio** agent to your Datasentinel platform: add the **MCP server** with its OAuth sign-in, then install the **Datasentinel Skill** that tells the agent how to use the tools. Because Copilot Studio runs in Microsoft's cloud, the page ends with what that means for a platform on a private network. {% hint style="info" %} Build an agent here when you want one managed Datasentinel agent for your users. [Publish it](#publish-the-agent) to **Microsoft 365 Copilot** and **Teams**, and your users chat with it from the Microsoft Copilot app. Users can also add Datasentinel themselves, in **Copilot Cowork**. See [Configure the Microsoft Copilot app](/manual/ai-connector/connect-a-desktop-app/configure-microsoft-copilot-app.md) to compare the paths. {% endhint %} Copilot Studio is a web maker portal, so every step below happens in the browser rather than in a desktop app. {% hint style="info" %} The steps below follow Microsoft's documentation, last checked on 6 October 2026. Microsoft changes Copilot Studio often. {% endhint %} ## What you build on The steps below use the **GitHub Copilot harness**, the runtime behind the **Build** tab of Copilot Studio. It loads the Datasentinel Skill natively: you upload `datasentinel-skill.zip` as it is, and `SKILL.md` and its supporting files load on demand. If your agent has no **Build** tab, turn on the **New experience** toggle on the Copilot Studio home page, and create the agent there. Microsoft's own pages also call this toggle **Use new experience** and **Use GitHub Copilot harness**, so the label may differ in your portal. Microsoft also has the **Copilot chat harness**, which extends Microsoft 365 Copilot Chat. This page does not cover it. See Microsoft's [Agents powered by the GitHub Copilot harness overview](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/overview). ## Before you start * You have a Copilot Studio agent built on the **Build** tab, and permission to edit it. To create one, see Microsoft's [Create a new agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/build-new-agent). * Your Datasentinel MCP server is reachable from the public internet at `https:///mcp` with a publicly trusted TLS certificate, and so are its sign-in endpoints on the same host. See [MCP Server Setup](/manual/ai-connector/server-setup/mcp-server-setup.md) if it is not yet running, and [Cloud service and private platforms](#cloud-service-and-private-platforms) below if the platform is not on the internet. * You have the Datasentinel Skill archive, `datasentinel-skill.zip`, downloadable from . {% hint style="warning" %} **Name MCP servers with a `datasentinel-` prefix.** Name the server starting with `datasentinel-`, for example `datasentinel-production`. The Datasentinel Skill discovers servers by this prefix, so a server named otherwise will not be picked up. {% endhint %} ## Add the Datasentinel MCP server {% hint style="info" %} Microsoft [announced](https://www.microsoft.com/en-us/copilot/blog/copilot-studio/new-and-improved-github-copilot-harness-agent-skills-and-richer-context/) MCP servers as generally available on the GitHub Copilot harness in September 2026, but its how-to page is still marked **preview**, so the labels can shift. Check [Add an MCP server to your agent as a tool](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/tools-add-mcp-server) if the portal does not match. {% endhint %} {% stepper %} {% step %} #### Open the tool picker Sign in to [Copilot Studio](https://copilotstudio.com/) and open your agent. In the agent navigation bar, select the **Build** tab. In the components panel on the right, select **Tools**. {% endstep %} {% step %} #### Start a custom MCP server In the **Add a tool** dialog, select **Add** next to the search bar, then **Model Context Protocol (MCP)**. {% endstep %} {% step %} #### Describe the server On the **Add MCP server** page, fill in: * **Name**: `datasentinel-production`. This is the name the agent sees, so keep it short and descriptive. * **Description**: one or two sentences on what your platform does and when the agent should reach for it. * **Server URL**: `https:///mcp` * **Authentication**: **OAuth 2.0**, in the mode where Copilot Studio registers itself with the server (called *dynamic discovery* or *dynamic client registration*, depending on the portal build). Enter no client id and no secret: the Datasentinel server issues them to Copilot Studio during registration. Microsoft's page only says to choose the authentication method the server requires. If your portal offers only a manual OAuth mode that requires a client id and secret, see Microsoft's [Add an MCP server to your agent as a tool](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/tools-add-mcp-server) before going further. Select **Add** to connect. Copilot Studio contacts the server, registers itself, opens the Datasentinel login page for you to sign in with your **platform login and password**, then negotiates the protocol handshake and lists the tools it exposes. {% endstep %} {% step %} #### Review the tools, then save Check the name and description of each Datasentinel tool that appears. A tool with a weak description gets invoked less reliably, so this is worth a read rather than a glance. Select **Save** to finish. The server now appears in the agent's **Tools** list on the **Build** tab. {% endstep %} {% step %} #### Check whose credentials the agent uses Microsoft's pages describe no setting to choose between the user's credentials and the maker's. Its [sharing page](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/authoring-share-agent) states that connections to external services are tied to the identity of each agent user, and lists having users authenticate individually as the approach when the service requires OAuth. So plan for each user to sign in with their own Datasentinel account, the same login and password as for the web interface. The platform then applies that user's privilege and instance visibility, and its audit trail names the right person. Confirm it before you roll the agent out: have a second user run `datasentinel whoami`, and check that it shows their account, not yours. Sessions renew on their own. A user is asked to sign in again only after ten days without using the agent, or when a Datasentinel administrator ends the session. {% endstep %} {% step %} #### Narrow or refresh the tool list (optional) On the **Build** tab, select the server in the components panel, below the **Tools** button, to see the tools it exposes. Use the toggles on the individual tools to turn off the ones the agent should not use. After a Datasentinel upgrade that adds or changes tools, edit the server entry in the same dialog to refresh the connection and re-read the tool list. That dialog is also where you update the server's authentication credentials if they have expired. See Microsoft's [Manage and delete tools in an agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/tools-manage). {% endstep %} {% endstepper %} {% hint style="warning" %} Keep the number of MCP servers on a single agent small. The number of MCP server instances that can run concurrently in one conversation is capped, and once you pass it the extra servers are skipped for that turn, with their tools simply unavailable rather than reported as an error. Microsoft does not publish the cap. Each MCP server also counts against the total number of tools the agent can host. {% endhint %} {% hint style="info" %} Connectivity flows through Power Platform connectors, so your environment's [**data policies (DLP)**](https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-data-loss-prevention#configure-a-data-policy-in-the-power-platform-admin-center) also govern access to the MCP server. Blocking Power Platform connectors blocks the tools in a connected MCP server along with them. A publicly trusted TLS certificate is required: Copilot Studio connects from Microsoft's cloud, and Power Platform [does not accept](https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview) a certificate from an unknown root CA, nor let you add your own. It also requires the endpoint to present the complete certificate chain, so serve the intermediate certificates along with your own. The OAuth sign-in also adds the users' browsers to the list of clients that must trust the certificate. If your platform uses a self-signed one, connect through a tool that runs closer to it, such as [Visual Studio Code](/manual/ai-connector/connect-an-ide/configure-vscode.md). What Microsoft's cloud must reach, and how to get there from a private platform, is in [Cloud service and private platforms](#cloud-service-and-private-platforms) below. {% endhint %} {% hint style="info" %} **An alternative registration path.** Tenants using Microsoft Agent 365 can register an existing MCP server centrally, through the Agent 365 CLI and the Microsoft 365 admin center, instead of adding it agent by agent. The feature is in preview and needs a publicly reachable endpoint. An AI administrator or Global administrator approves the request under **Agents › Tools › Requests**, and the server then becomes available to pick in Copilot Studio. In the same **Agents › Tools** area, administrators can block an MCP server for every client surface. Two limits matter for Datasentinel. The authentication type for a sign-in outside Microsoft Entra ID, `ExternalOAuth`, takes a client ID and secret registered in advance, where the sign-in described above needs none: read Microsoft's page below before you choose this path. The tools are declared at registration, and Microsoft states that a server cannot be republished during the preview, so tools added by a later Datasentinel upgrade may not be picked up. See Microsoft's [Bring your own (BYO) MCP server](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-byo-mcp-server). {% endhint %} ## Install the Datasentinel Skill The Datasentinel Skill is made of several files (a `SKILL.md` entrypoint plus supporting files) and ships as a single archive, `datasentinel-skill.zip`. Download it from . This is the same archive the other assistants use, and Copilot Studio needs no dedicated build of it. Copilot Studio's Skill format matches the one Datasentinel ships: YAML front matter carrying a name and description, Markdown instructions, and optional supporting files. So `datasentinel-skill.zip` uploads as-is, with nothing to copy by hand and nothing to trim. {% stepper %} {% step %} #### Open the Skills panel Open your agent in Copilot Studio and select the **Build** tab. In the components panel, select **Skills**. {% endstep %} {% step %} #### Upload the archive The **Add skill** dialog offers three routes in: upload a skill, create one from blank, or generate one with AI. The Datasentinel Skill already exists as a package, so uploading is the right route. In **Add skill**, select **Upload a skill**. Microsoft documents two accepted formats: a Markdown file, or a ZIP file that includes a `SKILL.md` file and, optionally, supporting files. The Datasentinel archive is the second kind. Drag `datasentinel-skill.zip` onto the upload box, or select the box and browse to it. Copilot Studio validates the file and adds the Skill to your agent. {% endstep %} {% step %} #### Confirm it landed The Skill appears in the components panel. Select it to review the name and description that the orchestration runtime matches against when it decides whether to activate the Skill. {% endstep %} {% endstepper %} **Updating the Skill.** When a new Datasentinel Skill is released, do not upload it a second time. Select the existing Skill, choose the three dots (**…**), then **Replace**, and pick the new file. Deleting a Skill (the **X** icon next to it) removes it permanently from the agent. The three dots also offer **Download**, but Microsoft documents that download as a single Markdown file (name, description and instructions), so do not count on it to bring back the supporting files. Keep the archive, or download it again from Datasentinel. **Several agents.** Microsoft documents that a skill can be added to several agents. Add the Datasentinel Skill to each agent that needs it, and replace it on each one when a new version is released. {% hint style="warning" %} A Skill is instructions the agent will follow, so only upload packages from sources you trust. Review any third-party or AI-generated Skill archive for prompt injection and tool misuse before adding it; for `datasentinel-skill.zip`, downloading it from Datasentinel's official download endpoint is the trust check. {% endhint %} See Microsoft's [Add an existing Skill to an agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/skills-add-existing), [Skills overview](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/skills-overview), and [Manage and delete Skills](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/skills-manage). For the design thinking behind Agent Skills (why they exist, how the runtime routes to them, when a Skill beats plain instructions), read the Copilot Studio team's deep dive, [Agent Skills in Microsoft Copilot Studio](https://microsoft.github.io/mcscatblog/posts/modern-mcs-agent-skills/). ## How the Skill loads The Skill loads on demand. The agent keeps only its name and description in context. When a request is about Datasentinel (PostgreSQL performance, instances, sessions, the platform itself), the orchestrator activates the full instructions. This keeps the context small and makes tool use more accurate. One Skill serves every platform: it finds all the `datasentinel-*` MCP servers connected to the agent, so a second platform needs no Skill change. The orchestrator still decides which tool to run; the activity trace during testing shows whether the Skill activated and why. If the agent answers generically instead (no Datasentinel tool calls), load the Skill manually: * Name it in the request: `Use the datasentinel skill to check the platform status.` * Or make it permanent: mention the Skill by name in the agent's instructions, so Datasentinel questions always go to it. ## Test the server and the Skill Open the agent's **Preview** tab and ask it, in plain language, to run the Datasentinel checks. | Ask the agent for… | What it does | | ------------------------ | --------------------------------------------------------------------------- | | `datasentinel help` | Lists the available commands, which confirms the Skill loaded. | | `datasentinel platforms` | Lists every MCP server (platform) discovered by the `datasentinel-` prefix. | | `datasentinel status` | Checks the platform status, confirming the MCP server answers. | | `datasentinel whoami` | Shows who you are signed in as, your privilege and the session expiry. | These four are the setup checks. The full command list, with what each one needs, is in the [Skill commands reference](/manual/ai-connector/use-the-assistant/skill-commands.md). Start with `datasentinel help`: it is the check that the uploaded Skill activates. Then run `datasentinel platforms` to verify your server is discovered, and `datasentinel status` to confirm the platform is reachable and the MCP tools return live data. Finally, `datasentinel whoami` shows which platform user the agent acts as: you on the **Preview** tab, and it should show each user's own account once the agent is published. If a run does not behave as you expect, open the [activity trace](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/authoring-activity-trace) to see which tool the orchestrator actually chose. The activity trace shows in the maker view only, so keep the **End user preview** toggle off on the **Preview** tab. {% hint style="success" %} If `datasentinel status` reports a healthy platform, the MCP server and the Skill are wired together correctly. You can now ask the agent about your instances in plain language. Next, publish it so your users can reach it from the Copilot app. {% endhint %} ## Cloud service and private platforms Copilot Studio runs in Microsoft's cloud, and Microsoft makes MCP servers available to it through its [connector infrastructure](https://devblogs.microsoft.com/powerplatform/microsoft-copilot-studio-mcp/). Every MCP call and every token exchange therefore comes from Microsoft's cloud, never from the user's workstation. So the platform must offer, on a public hostname with a publicly trusted certificate, the MCP endpoint `https:///mcp` and the sign-in endpoints on the same host, listed in [MCP Server Setup](/manual/ai-connector/server-setup/mcp-server-setup.md). A browser on the private network is not enough: it only opens the login page, and Microsoft's servers call the token endpoint themselves. An internal-only hostname, a private IP address or a VPN-only platform cannot be added as-is. | Your situation | What to do | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The platform must stay private | Publish only the MCP host through a reverse proxy or API gateway in the DMZ, with public DNS and a public certificate. Forward the sign-in locations unchanged, so the sign-in still ends on the Datasentinel login page. With Azure, [API Management](https://learn.microsoft.com/en-us/azure/api-management/expose-existing-mcp-server) can play this role, with a VPN or ExpressRoute to the platform. | | You have a Power Platform virtual network | [Virtual network support](https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview) can carry the calls to `/mcp` only: Microsoft states that [OAuth and token requests do not transit the virtual network](https://learn.microsoft.com/en-us/connectors/custom-connectors/#virtual-network-support). The sign-in endpoints still need the gateway. Microsoft names virtual network integration among the controls MCP servers inherit from connectors, but Datasentinel has not validated this design. | | No inbound exposure is allowed | Copilot Studio is not the right runtime. Use an assistant that runs on the workstation, such as [Visual Studio Code](/manual/ai-connector/connect-an-ide/configure-vscode.md), the [ChatGPT desktop app](/manual/ai-connector/connect-a-desktop-app/configure-chatgpt-desktop-app.md) or the [Claude desktop app](/manual/ai-connector/connect-a-desktop-app/configure-claude-desktop-windows.md). | To restrict the public host to Microsoft's calls, allow the regional **AzureConnectors** and **PowerPlatformPlex** service tags, which Microsoft publishes in [Outbound IP addresses](https://learn.microsoft.com/en-us/connectors/common/outbound-ip-addresses). That page does not name MCP, so validate it on your tenant. Microsoft documents no on-premises data gateway route for MCP servers. For the full design, see [MCP servers on a private network](/manual/ai-connector/troubleshooting/private-network-mcp-servers.md). ## Publish the agent Once the agent works in testing, publish it so your users reach it from the tools they already use, including the **Microsoft 365 Copilot** app and **Teams**. This is how customers who work in the desktop Copilot app consume the Datasentinel agent you configured here. Keep the agent's own authentication on **Authenticate with Microsoft** (agent settings, **Safety & access** tab). Microsoft documents that the Teams and Microsoft 365 Copilot channels support no other option, and sharing the agent requires it. See Microsoft's [Configure settings for GitHub Copilot agents](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/settings-overview) and [Configure user authentication](https://learn.microsoft.com/en-us/microsoft-copilot-studio/configuration-end-user-authentication). {% stepper %} {% step %} #### Publish and pick the channels With the agent open, select the chevron next to **Publish**. In the **Publish agent** dialog, review the agent details, then select and configure the **Microsoft 365 Copilot** and **Microsoft Teams** channels. The agent needs a name, a description and instructions: if one is missing, the dialog shows what to complete. Select **Publish** and wait for the confirmation. {% endstep %} {% step %} #### Share it The confirmation offers to share the agent or to add it to the organization catalog. You can also share later, with the **Share** icon next to **Publish**: enter users or security groups, or, under **Organization**, select **End user access** to let anyone in your organization find and use the agent. Microsoft lists the prerequisites in [Share agents with other users and makers](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/authoring-share-agent), among them an agent published to Teams and Microsoft 365 with **Make agent available in Microsoft 365 Copilot** turned on. {% endstep %} {% step %} #### Publish again after each change Changes stay in draft until you publish again. After you replace the Skill or change the tools, select **Publish** in the upper-right corner, review the changes in the **Publish your changes** dialog, then select **Publish**. {% endstep %} {% endstepper %} Microsoft currently lists Microsoft 365 Copilot, Teams, the demo website and a web app as the available channels. See [Publish an agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/publication-publish-agent) and [Available channels for agents](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/publication-channels-overview). Users then open the **Microsoft 365 Copilot** app, type `@`, and pick the Datasentinel agent, which carries the MCP server and Skill you configured here. Check the Datasentinel sign-in as a user in Teams, not on the demo website: Microsoft's [channel table for tool sign-in](https://learn.microsoft.com/en-us/microsoft-copilot-studio/configure-enduser-authentication#supported-channels) lists Teams as supported and the demo website as not supported. ## Troubleshooting ### The Skill | Symptom | Cause and fix | | ------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | There is no **Build** tab, or no **Skills** panel on it | The agent was not created in the new experience. Turn on the **New experience** toggle on the Copilot Studio home page, and create the agent again there. | | The upload is rejected | The file is not the Datasentinel archive as downloaded (download `datasentinel-skill.zip` again and upload it without unzipping or re-zipping it), the front matter is missing a name or description, or the name uses characters outside lowercase letters, numbers, and hyphens, or starts or ends with a hyphen. | | The Skill uploaded but is missing from the components panel, or the agent behaves as if it were not installed | The Skill failed a load-time check and was skipped, while the rest of the agent loaded. Microsoft lists the causes: invalid YAML front matter, a missing name or description, a description that is too long, a name already used by another Skill in the agent, a `SKILL.md` that is not UTF-8, or supporting files that could not be written. Download the archive again from Datasentinel and upload it once more. See [Troubleshoot skills that don't load](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/skills-manage#troubleshoot-skills-that-dont-load). | | `datasentinel help` returns nothing useful | The Skill uploaded but its description is too vague for the runtime to activate it. Sharpen the description, or name the Skill explicitly in the agent's instructions. | | The agent answers from an old version of the Skill | A second copy was uploaded instead of replacing the first. Microsoft documents that when two Skills in the same agent share a name, one of them is skipped, so the new copy may never load. Delete both copies, upload the new archive once, and use the three dots (**…**) **› Replace** for future updates. | ### The MCP server Start with the activity trace on the **Preview** tab: it shows which tool the agent chose, what it passed, and any authentication or timeout error the tool returned. | Symptom | Cause and fix | | ----------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The server cannot be added: **Add** fails, or the Datasentinel login page never opens | Copilot Studio could not read the platform's discovery documents from Microsoft's cloud. Check that `https:///.well-known/oauth-protected-resource/mcp` answers from the internet with a trusted certificate, and that no gateway in front rewrites or blocks the sign-in locations. | | A Datasentinel tool call fails with an authentication error, or the agent asks to sign in again | The user's session ended (ten idle days, or an administrator ended it) and has to be renewed: sign in again on the Datasentinel login page. As the maker, select the server on the **Build** tab and update its authentication credentials. | | The agent ignores the server entirely | The server's name or description is too vague for the orchestrator to match on. Sharpen them, or name the server in the agent's instructions. | | The Datasentinel tools are unavailable on some turns, on an agent with several MCP servers | The cap on MCP servers running concurrently in one conversation was reached: when the agent tries to use more servers than the cap in the same turn, the extra ones are skipped for that turn. Remove servers the agent no longer needs. | | Publishing is blocked, or the tools return an error | A data policy is blocking the underlying Power Platform connector. A blocked tool shows as disabled in the **Add a tool** dialog, and hovering over the cross icon next to it gives the reason. Check with your admin, and see [Configure data policies for agents](https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-data-loss-prevention). | For the error codes an agent can return, see Microsoft's [Error codes reference for agents](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/troubleshooting-error-codes). For failures on the Datasentinel side rather than the Copilot Studio side, see [TLS hostname mismatch on API calls](/manual/ai-connector/troubleshooting/tls-hostname-mismatch.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.datasentinel.io/manual/ai-connector/connect-a-desktop-app/configure-copilot-studio.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.