Copilot Studio and Microsoft 365
Connect a Copilot Studio agent to Quilr using the MCP onboarding wizard, then publish that agent to the approved Microsoft 365 or Teams channel. Start a pilot with OAuth 2.0 > Dynamic discovery for OneMCP. The gateway's discovery and public-client behavior must work with your Microsoft environment before production approval.
Documentation checked: October 15, 2026. The configuration below is based on gateway behavior and official Microsoft documentation. It has not been validated through a live customer Copilot Studio connection.
Choose the Microsoft integration
For the declarative-plugin route, Microsoft's authentication troubleshooting describes a Teams developer portal authentication configuration, matching runtime reference_id, and a matching MCP base URL. Validate that integration separately with Quilr engineering, especially if it expects a confidential client or refresh tokens. Microsoft 365 plugin authentication.
Administrator prerequisites
Record the Power Platform environment, agent owner, target audience, intended channel, approved tool list, and gateway administrator. Confirm the maker can create and edit the agent and connections in that environment, and that the users have the required Microsoft product access. Microsoft plans and entitlements can differ; check the tenant's available features rather than assuming every Microsoft 365 subscription includes the same authoring rights.
Prepare the following Quilr settings:
Use authentication for exact discovery endpoints and deployment checks. Keep the same assigned hostname throughout MCP discovery, authorization, registration, and token exchange unless the gateway's metadata intentionally specifies another host.
Power Platform policy and user identity
Before adding the tool, have the Power Platform administrator review the environment's data policies. A connector may be blocked or placed in a data group incompatible with other connectors. Policy violations can disable features and prevent publishing. Resolve the specific policy finding through your organization's change process. Microsoft data policies.
For user-specific business data, choose User authentication or the equivalent end-user credential setting in your version of the tool editor. Microsoft distinguishes user credentials from agent-author credentials, and may prompt a user to create a connection during a conversation. Check that the intended channel supports the required user authentication. Tool authentication.
An administrator can restrict maker-provided credentials under Power Platform admin center > Manage > Environments (or Environment groups) > Settings > Product > Features > Copilot Studio agents > Control maker credential options. This affects existing agents in the selected scope. End-user-only enforcement can prevent background/autonomous runs that need a live user sign-in. Plan such a policy change separately from the connector pilot. Credential controls.
For Quilr, confirm the final runtime identity in gateway audit records. An agent that works for its author may still use the author's connection when shared. Test with a second ordinary user before granting broader access.
Add the OneMCP tool
- Open the intended agent and its Tools page.
- Choose Add a tool > New tool > Model Context Protocol.
- Enter a recognizable server name, a task-specific description, and the assigned MCP URL.
- Select OAuth 2.0, then Dynamic discovery.
- Create the server, continue, and create a new connection.
- Complete the company sign-in and add the connected server to the agent.
Copilot Studio supports Streamable HTTP; legacy SSE is unsupported. The wizard discovers registration and OAuth endpoints when Dynamic discovery succeeds. Microsoft MCP onboarding.
Example administrator-provided values:
Server name: Quilr OneMCP
Description: Read approved business information through Quilr-managed MCP tools.
Server URL: https://mcpgateway.quilr.ai/quilrone/<quilr-tenant-id>/mcp
Authentication: OAuth 2.0
OAuth type: Dynamic discovery
Adapt the description to the actual approved tools. A read-only description is not an authorization rule; enforce tool permissions in Quilr and upstream services.
If Microsoft asks for individual OAuth fields
Let G be the exact HTTPS gateway base and T the Quilr tenant ID. The following values describe the current tenant-qualified OneMCP implementation, not every direct backend:
Microsoft also offers Dynamic and Manual modes. Manual configuration includes a client secret and refresh URL; the present OneMCP public-client, code-only flow does not supply these. Do not invent values or reuse upstream credentials to satisfy required fields. Treat a client that requires them as a compatibility issue requiring engineering review. Microsoft authentication modes.
The gateway advertises PKCE metadata, but this alone is not evidence of full OAuth 2.1 enforcement or certification. See the implementation caveats in authentication when your security review requires those guarantees.
API-key alternative for one backend
A Quilr API token can be used only on an eligible direct backend, with both Authorization: Bearer <token> and mcpuser: <allowed-user-email>. It is not a OneMCP credential. New tokens are bound to a selected agent; the actual Microsoft runtime User-Agent must match that binding. The simple Studio API-key field may not express the additional identity header your backend requires; if necessary, an administrator must design and validate a custom connector that sends both headers. Do not document a successful configuration until request logs confirm the complete headers and intended identity. Shared automation credentials need an explicit owner and access scope.
Publish to Microsoft 365 or Teams
After the pilot succeeds, publish the agent. Open Channels > Teams and Microsoft Copilot, enable Make agent available in Microsoft Copilot when needed, and add the channel. Share with a small pilot audience or submit for organization approval through the channel's availability options. Organization-wide distribution can require Teams/Microsoft 365 admin approval. Microsoft channel setup.
Re-test the published channel, not only Studio's test pane. Use a fresh conversation and a non-maker account. Channel sign-in and the MCP tool's Quilr connection are separate: a user being signed into Teams does not demonstrate the correct Quilr connection is in use. Confirm gateway audit identity and upstream access for that user.
Acceptance checklist
Record deployment host, Quilr tenant, Microsoft environment/agent/channel, credential mode, pilot users, test time, tool names, and evidence. Do not capture access tokens or authorization codes in a support document.
Troubleshooting
For a Microsoft 365 declarative-plugin integration, separately inspect authentication configuration IDs, matching base URLs, and the callback prescribed for that route. Those values should not be copied into Studio blindly. Plugin authentication diagnostics.
When retiring the integration, remove or disable the agent tool, review published-channel access, and revoke the associated gateway credentials or connections as appropriate. Removing an agent from a store does not by itself prove gateway access has been revoked. See shared troubleshooting and client overview.