> For the complete documentation index, see [llms.txt](https://docs.datasentinel.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.datasentinel.io/manual/ai-connector/connect-a-desktop-app/configure-microsoft-copilot-app.md). # Configure the Microsoft Copilot app Use Datasentinel from the Microsoft Copilot app: Copilot Cowork, Copilot Studio agents, and the other paths. This page shows the ways to reach your Datasentinel platform from the **Microsoft Copilot app**, on Windows, on macOS or in the browser. Since August 2026, Microsoft has been rolling out an updated **Microsoft Copilot** app that replaces both the consumer Copilot app and the Microsoft 365 Copilot app. It accepts a personal account, a work account, or both, and keeps the two apart. What you can do with Datasentinel depends on the account. See Microsoft's [Copilot app updates for personal, work, and school accounts](https://support.microsoft.com/en-us/microsoft-365-copilot/learning/changes-microsoft-copilot-app). {% hint style="info" %} **Microsoft's announcement of 25 September 2026.** Microsoft announced a new Copilot experience built around **Home** (Chat and Cowork in one place), **Code** and **Autopilot**, with a unified plugin registry for Microsoft, partner and custom plugins. The rollout is phased, starting with the Frontier program and previews, so navigation and plugin distribution may differ from the steps below. The announcement changes nothing in the network and sign-in requirements of this page. See Microsoft's [Introducing the new Copilot with Home, Code and Autopilot](https://blogs.microsoft.com/blog/2026/09/25/introducing-the-new-copilot-with-home-code-and-autopilot/). {% endhint %} {% hint style="warning" %} **Network requirements.** Every path below calls the Datasentinel MCP server from Microsoft's cloud, never from your workstation. Access from your workstation or its VPN is not sufficient. Microsoft's services must reach the MCP endpoint, `https:///mcp`, and the sign-in endpoints on the same host, with a publicly trusted certificate. The sign-in has two legs. Your browser opens the Datasentinel login page, then Microsoft's servers exchange the result for your token at `/token`, and renew it there about once an hour. A browser that reaches the platform over the private network does not cover the second leg. Only Copilot Studio has a documented private-network option, Power Platform virtual network support, and Microsoft states that OAuth and token requests do not go through it. A private platform therefore needs a gateway that publishes the MCP host, whichever path you choose. Private networking never moves the assistant's AI processing to your own servers. See [MCP servers on a private network](/manual/ai-connector/troubleshooting/private-network-mcp-servers.md). {% endhint %} ## Choose a path | Path | Who sets it up | Datasentinel Skill | Microsoft status | | ------------------------------------------------------------- | --------------------------------------------------------- | ------------------------- | ----------------------------------- | | [Copilot Cowork](#copilot-cowork) | Each user, or an administrator for the whole organization | Yes, uploaded by the user | Generally available, work accounts | | [A Copilot Studio agent](#a-copilot-studio-agent) | An agent maker | Yes | Generally available | | [A declarative agent](#a-declarative-agent) | A developer, with Microsoft 365 Agents Toolkit | Preview only | Generally available for MCP | | [A custom federated connector](#a-custom-federated-connector) | An administrator | No | Needs a pre-registered OAuth client | | Personal account | | | No documented way | The last column is Microsoft's feature availability. With a **personal account**, the connectors Microsoft documents are a fixed list (OneDrive, Outlook.com, Google Drive, Gmail, Google Calendar and Contacts). Microsoft documents no way to add an MCP server or a custom Skill there. Cowork is reaching personal accounts as a preview, but Microsoft documents custom plugins and Skills for work accounts only. This page therefore covers work accounts. See Microsoft's [Connecting Microsoft Copilot to other services](https://support.microsoft.com/en-us/microsoft-copilot/connecting-microsoft-copilot-to-other-services). **Copilot Cowork** is the shortest path: a user adds the Datasentinel Skill and the MCP server, with no agent to build. Choose a **Copilot Studio agent** when you want one managed agent, published to every user. ## Copilot Cowork Copilot Cowork is the agent mode of the Microsoft Copilot app. It runs in the browser at [copilot.cloud.microsoft](https://copilot.cloud.microsoft), in the desktop app for Windows and macOS, and in Outlook and Teams. To open it, select **Cowork** next to **Chat** at the top of the app. It is generally available since June 2026. Cowork loads Agent Skills in the same `SKILL.md` format as the other assistants, and it connects to remote MCP servers through **plugins**. Both are managed on its **Customize** page. {% hint style="info" %} The steps below follow Microsoft's documentation, last checked on 1 October 2026. Microsoft changes the Copilot app often. {% endhint %} ### Before you start * A work account. * Cowork turned on for your account. It is off by default: a Microsoft 365 administrator enables it and chooses who gets access. See Microsoft's [Determine access controls for Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-access). * The right to upload custom plugins and Skills. Microsoft 365 admin controls apply (allow and block lists, admin-managed deployments), and Microsoft Purview Information Barriers are not supported for plugin and Skill uploads. Check with your administrator if **Upload plugin** is missing or fails. * A Datasentinel platform in release 2026.10 or later, the first release with the OAuth sign-in, reachable as described in the network requirements above. See [MCP Server Setup](/manual/ai-connector/server-setup/mcp-server-setup.md). * A Datasentinel account for each user: the same login and password as for the web interface. {% stepper %} {% step %} #### Upload the Datasentinel Skill Download [datasentinel-skill.zip](https://app.datasentinel.io/ds-api/download/datasentinel-skill.zip), the same archive as for the other assistants. In Cowork, open **Customize** from the left navigation, then the **Skills** tab. Select the arrow next to **Add**, then **Upload skill**, and choose the archive. Cowork validates it and saves the Skill to your OneDrive. It appears in **Your skills** after it syncs. Microsoft gives two limits for a Skill. [Upload a skill](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-customize#upload-a-skill) accepts an archive of up to 100 files, 10 MB compressed and 50 MB uncompressed. [Use Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/use-cowork#cowork-skills) caps a custom Skill at 20 companion files, and the Datasentinel Skill has more. If Cowork rejects the archive, or the Skill loads without its supporting files, see Microsoft's [Customize Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-customize) for the current limits. {% endstep %} {% step %} #### Build the connector package Cowork reaches an MCP server through a plugin package. To see a working example first, download [datasentinel-connector-sandbox.zip](https://app.datasentinel.io/ds-api/download/datasentinel-connector-sandbox.zip). It is a ready-made connector package for the Datasentinel [sandbox platform](/manual/ai-connector/test-with-the-sandbox-platform.md): upload it as it is in the next step, and sign in with the sandbox credentials. For your own platform, create a folder with two small files: ``` datasentinel-connector/ ├── .claude-plugin/ │ └── plugin.json └── .mcp.json ``` `.claude-plugin/plugin.json`: ```json { "name": "datasentinel-connector", "description": "Datasentinel PostgreSQL monitoring platform", "version": "1.0.0" } ``` `.mcp.json`, with your platform's URL: ```json { "mcpServers": { "datasentinel-production": { "type": "http", "url": "https:///mcp" } } } ``` `"type": "http"` selects the streamable-HTTP transport, which is what the Datasentinel MCP server serves; do not use `sse`. Name the server with the `datasentinel-` prefix: the Skill finds its servers by that prefix. Then zip the **content** of the folder, so that `.mcp.json` sits at the root of the archive. The package carries no Skill and no credentials. The Skill is uploaded separately in the previous step: a plugin package allows at most 20 companion files per Skill, and the Datasentinel Skill has more. {% endstep %} {% step %} #### Upload the connector package On the **Customize** page, open the **Plugins** tab and select **Upload plugin** (Microsoft's admin page calls this button **Add plugin**). Choose the archive. Cowork converts a Claude plugin package into its own format, including the connectors it contains. The **Share** dialog then opens. Choose **Only you**, or **Specific users in your organization** to share the plugin with colleagues, then select **Apply**. The plugin carries the connector only: the Skill is shared separately, see [Good to know](#good-to-know). See Microsoft's [Upload a plugin package](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-customize#upload-a-plugin-package). {% endstep %} {% step %} #### Sign in The package declares no authentication. Microsoft documents that Cowork then registers itself with the MCP server through dynamic client registration, which the Datasentinel server supports. Microsoft does not document what the upload conversion writes for authentication, so check the result on your first call. The first time Cowork needs a Datasentinel tool, it prompts you to connect. Select **Connect**: the Datasentinel login page opens, and you sign in with your platform login and password. You sign in once per connector. Each user signs in with their own account, so the platform applies that user's access rights. If Cowork asks for an OAuth registration ID instead, or never shows the login page, the conversion added an authentication setting. Microsoft's command-line importer does so by default for an external HTTPS URL. Build the Microsoft 365 package yourself and remove that setting, as described under **For the whole organization** in [Good to know](#good-to-know). If the problem persists, see Microsoft's [Dynamic client registration](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication-dynamic-client-registration). {% endstep %} {% step %} #### Test Start a new conversation in Cowork. In the **Sources** picker (Microsoft also calls it the **Sources & Skills** panel), check that the Datasentinel plugin and Skill are on. Then ask: | Ask Cowork for… | Expected result | | --------------------- | -------------------------------------------------------------------------------- | | `datasentinel status` | The platform you expect, reported healthy. This confirms the MCP server answers. | | `datasentinel whoami` | Your own Datasentinel login, your privilege and the session expiry. | If you shared the plugin, ask a colleague to run `datasentinel whoami` too: it must show their login, not yours. {% endstep %} {% endstepper %} ### Good to know * **Tool calls must answer within 30 seconds.** A long analysis window or a PDF report can take longer. Shorten the time window if a call fails. * **Confirmation prompts.** Cowork asks for confirmation before a tool that is not marked read-only, and it treats a tool without annotations as destructive. Microsoft is rolling this out progressively for third-party servers. All Datasentinel tools are read-only, so approving such a prompt is safe. * **Share both items.** The plugin and the Skill are shared separately. Share the plugin in its **Share** dialog, and the Skill from its detail page (**Customize** › **Skills** › the Skill › **Share**). After an update, select **Re-share** on each one. Every colleague still signs in to Datasentinel with their own account. * **Updating the Skill.** Uploading a Skill whose name already exists keeps both copies, the new one with a number added to its name. Delete the old Skill before you upload a new version. * **Cowork only.** A connector without an authentication setting uses dynamic client registration in Cowork only. Microsoft does not support it in Copilot Chat. For a package that must work beyond Cowork, Microsoft documents explicit authorization types in [Register MCP servers as agent connectors](https://learn.microsoft.com/en-us/microsoftteams/platform/m365-apps/agent-connectors), among them `DynamicClientRegistration` with a configuration registered in the Teams Developer Portal. Datasentinel has not tested them. * **Cowork in your server logs.** Cowork sends the `User-Agent` header `copilot-cowork/1.0` on every request to the MCP server. Microsoft advises matching on the `copilot-cowork` prefix, because the version can change. If your reverse proxy logs the user agent, that tells you whether a call reached your server. * **For the whole organization.** The simplest route starts from the plugin you uploaded: Microsoft's admin page says a user can request that it be published to the whole organization, and that the plugin goes live only after a tenant administrator approves the request. The user-facing page lists only **Only you** and **Specific users in your organization** in the **Share** dialog, so the option may not show in your tenant. Otherwise, an administrator can deploy the package from the Microsoft 365 admin center (**Manage apps** › **Upload custom app**, then **…** › **Add agent**). The plugin then appears in the **Discover** section of the **Plugins** tab. This requires a package in the Microsoft 365 app format, which the Microsoft 365 Agents Toolkit CLI (version 1.1.12 or later) builds from the Claude package: `atk import openplugin`, with the `--privacy-url` and `--terms-url` options the Microsoft 365 manifest requires, then `atk package`. For an external HTTPS URL, the importer writes an `authorization` object of type `OAuthPluginVault` with a placeholder ID. Delete that object from `appPackage/manifest.json` before packaging, so Cowork uses dynamic client registration. The deployed plugin still carries no Skill, and an administrator cannot sign in for the users: each one uploads or receives the Skill, and signs in to Datasentinel. See Microsoft's [Build plugins for Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-plugin-development) and [Manage plugins for Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-manage-plugins). ## A Copilot Studio agent An agent maker builds a Datasentinel agent in Copilot Studio, with the MCP server and the Skill, then publishes it to the **Microsoft 365 Copilot** and **Microsoft Teams** channels. Users open the Microsoft Copilot app, type `@`, and pick the agent. It carries the maker's configuration, and each user signs in to Datasentinel with their own account. {% content-ref url="/pages/K7AtUyNFutZCkF3ACAGm" %} [Configure Microsoft Copilot Studio](/manual/ai-connector/connect-a-desktop-app/configure-copilot-studio.md) {% endcontent-ref %} ## A declarative agent Developers can build a declarative agent for Microsoft 365 Copilot with Microsoft 365 Agents Toolkit (version 6.12.0 or later) in Visual Studio Code, and add the Datasentinel MCP server as a plugin. Choose **OAuth (with dynamic registration)**: Microsoft requires the authorization server to issue a client secret during registration, which the Datasentinel server does. Custom Skills in declarative agents are in preview, for organizations in the Microsoft Frontier program. See Microsoft's [Build plugins from an MCP server](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/build-mcp-plugins) and [Dynamic client registration](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication-dynamic-client-registration). ## A custom federated connector A Global Administrator or AI Administrator can add an MCP server as a **custom federated connector** in the Microsoft 365 admin center (**Copilot** › **Connectors**). Copilot Chat, Cowork, Researcher and Copilot in Word, Excel, PowerPoint and Outlook can then use its tools. Microsoft asks for an MCP server that exposes read-only tools, which is the case of Datasentinel. The connector brings the tools only, not the Skill. With OAuth 2.0, this path needs a client ID and secret registered in advance, and entered in the Teams Developer Portal. It does not use dynamic client registration. To set it up, follow Microsoft's [Set up custom federated connectors](https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/set-up-custom-federated-connectors). ## Microsoft documentation Microsoft changes these products often. Check its current documentation: | Topic | Official documentation | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | The updated app | [Copilot app updates for personal, work, and school accounts](https://support.microsoft.com/en-us/microsoft-365-copilot/learning/changes-microsoft-copilot-app) | | The new Copilot | [Introducing the new Copilot with Home, Code and Autopilot](https://blogs.microsoft.com/blog/2026/09/25/introducing-the-new-copilot-with-home-code-and-autopilot/) | | Cowork | [Get started with Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/get-started), [Use Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/use-cowork), [Use plugins with Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-plugins), [Customize Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-customize), [Build plugins for Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-plugin-development), [What's new in Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/whats-new) | | Cowork for personal accounts | [Get started with Microsoft Copilot Cowork for personal accounts (Preview)](https://support.microsoft.com/en-us/microsoft-365-copilot/get-started-with-cowork) | | Cowork administration | [Manage Copilot Cowork for your organization](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-admin-governance), [Determine access controls for Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-access), [Manage plugins for Copilot Cowork](https://learn.microsoft.com/en-us/microsoft-365/copilot/cowork/cowork-manage-plugins) | | Private networking | [Virtual Network support for Power Platform](https://learn.microsoft.com/en-us/power-platform/admin/vnet-support-overview), [Custom connectors: Virtual Network support](https://learn.microsoft.com/en-us/connectors/custom-connectors/#virtual-network-support) | | Declarative agents | [Build plugins from an MCP server](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/build-mcp-plugins), [Authentication for MCP and API plugins](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/plugin-authentication) | | Federated connectors | [Federated connectors overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/federated-connectors-overview), [Set up custom federated connectors](https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/set-up-custom-federated-connectors) | | Copilot Studio | [Publish an agent](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/publication-publish-agent), [Available channels for agents](https://learn.microsoft.com/en-us/microsoft-copilot-studio/agents-experience/publication-channels-overview) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.datasentinel.io/manual/ai-connector/connect-a-desktop-app/configure-microsoft-copilot-app.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.