Connect the Agility MCP Server to Microsoft 365 Copilot

Microsoft 365 Copilot cannot connect to a remote MCP server on its own. To use the Agility CMS MCP Server inside Copilot, you create an agent in Microsoft Copilot Studio, add the Agility MCP Server to that agent as a tool, and publish the agent to the Microsoft 365 Copilot channel.

This is different from every other MCP client. In Claude, Cursor, VS Code or the Gemini CLI you paste a server URL into settings and sign in. In the Microsoft stack the MCP server is attached to an agent, and the agent is the unit that is licensed, governed and distributed.

Agent Builder does not support MCP. The lightweight "New agent" experience inside Microsoft 365 Copilot chat supports knowledge sources only (SharePoint, public websites, prebuilt Copilot connectors). It has no support for MCP servers or external tools. Use Copilot Studio.

Authorize as the end user, not as the agent maker. Copilot Studio lets a maker choose whether each person authenticates for themselves or shares the maker's connection. Leave the tool's Authentication setting on End user so every call runs under the identity of the person asking, inside that person's Agility permissions. See Step 3.

Server reference

Setting	Value
Server URL	`https://mcp.agilitycms.com/api/mcp`
Transport	Streamable HTTP
Authentication	OAuth 2.0 with dynamic client registration
Discovery metadata	`https://mcp.agilitycms.com/.well-known/oauth-protected-resource`
Tools	27 (discovery, models, content, pages and sitemaps, media)
Status	Generally available, v2.0.0

Copilot Studio supports the Streamable HTTP transport only. Server-sent events were deprecated for Copilot Studio in August 2025. The Agility MCP Server has used Streamable HTTP since launch, so no change is required.

Prerequisites

Agility CMS

An Agility CMS user account with access to the instance you want to work with. Agility permissions apply per user, so the agent can only do what the signed in user is allowed to do. Microsoft

Requirement	Who needs it
Copilot Studio license in the tenant, plus a Copilot Studio User License	The person building the agent
Microsoft 365 Copilot license (alternative to the above, and required for end users)	Anyone using the agent inside Microsoft 365 Copilot chat
Copilot Credits (pay as you go, prepurchase plan, or prepaid capacity packs)	The environment the agent runs in
Teams administrator	Only if publishing the agent to the whole organization

A Copilot Studio trial license lets you build and test an agent but not publish it.

Power Platform

MCP access in Copilot Studio is delivered over Power Platform connectors. If your tenant has data loss prevention (DLP) policies on connectors, those policies also apply to the MCP server. New custom connectors land in the Non-business data group by default, which many tenants block. Confirm with your Power Platform administrator before you start.

Step 1: Create the agent

Go to copilotstudio.microsoft.com.
Create a new agent and give it a name your users will recognize when they type it into Copilot, for example Agility Content.

In the instructions, describe the agent's job and any guardrails. For example:

You help the marketing team read and update content in Agility CMS.
Always confirm which Agility instance the user means before writing anything.
Never delete content without explicit confirmation.
Prefer reading and summarizing before proposing a change.

Instructions materially affect whether the orchestrator selects the Agility tools. If nothing in the instructions references Agility, content or the CMS, the agent may never call the server.

Step 2: Add the Agility MCP Server as a tool

Open the Tools page for your agent.
Select Add a tool, then New tool, then Model Context Protocol.
In the MCP onboarding wizard, enter:
Field Value
Server name Agility CMS
Server description Read and manage content, pages, models and media in Agility CMS
Server URL https://mcp.agilitycms.com/api/mcp
For Authentication type, select OAuth 2.0, then Dynamic discovery. Leave client ID and client secret empty. The Agility MCP Server publishes OAuth protected resource metadata and supports dynamic client registration, so Copilot Studio discovers the authorization and token endpoints and registers itself. No app registration is required on either side.
Select Create.
On the Add tool dialog, select Create a new connection, sign in with your Agility CMS account, and grant consent.
Select Add to agent.

Field	Value
Server name	`Agility CMS`
Server description	`Read and manage content, pages, models and media in Agility CMS`
Server URL	`https://mcp.agilitycms.com/api/mcp`

If you have to configure OAuth manually

Use these values only if Dynamic discovery is unavailable in your environment. The client ID and secret come from a dynamic registration call against the Agility registration endpoint; Agility does not issue static credentials from the CMS UI.

Field	Value
Authorization URL	`https://mcp.agilitycms.com/api/auth/authorize`
Token URL template	`https://mcp.agilitycms.com/api/auth/token`
Refresh URL	`https://mcp.agilitycms.com/api/auth/token`
Scopes	`offline_access`

Step 3: Confirm the tool authenticates as the end user

This is the most important configuration step and the easiest one to skip.

When you add the tool you sign in to create the connection, so that connection is bound to your Agility account. Copilot Studio then decides at runtime whose identity a tool call uses.

Open the Agility CMS tool in your agent.
Expand Additional details.
Set Authentication to End user. | Setting | Behaviour | Use for Agility | | --- | --- | --- | | End user (default) | Each person signs in to Agility on first use and gets their own connection. Every call runs under their identity and their Agility permissions. | Yes | | Maker-provided | All calls run under the agent maker's Agility account. Users are never prompted to sign in. | No |

Why maker-provided credentials are the wrong choice here

Agility CMS evaluates permissions per user on every Management API call. That check is only meaningful if the token belongs to the person asking. With maker-provided credentials:

Every Copilot user in the organization inherits the maker's Agility permissions. A contributor who cannot publish in Agility can publish through the agent.
Instance scoping collapses. Users reach every instance the maker can reach.
The Agility audit trail attributes every change to the maker, so per-user accountability is lost.

Connection parameter sharing. On the connection itself, Copilot Studio offers Allow permission to share parameters for on-behalf-of scenarios. Leave this off for the Agility connection.
Environment-level enforcement. A Power Platform administrator can remove the choice entirely: Power Platform admin center > Manage > Environments (or Environment groups) **> Settings > Product > Features > Copilot Studio agents

Control maker credential options**. Options are end-user credentials only, maker-provided credentials only, or both. The default is both. Setting it to end-user credentials only takes effect immediately, including for existing agents in that environment.

Caveat for unattended agents. Restricting an environment to end-user credentials breaks autonomous and scheduled agents, because no user is present to sign in. Run unattended Agility automation in a separate environment against a dedicated Agility service account with scoped permissions rather than an individual's login.

Step 4: Test before publishing

Use the test pane in the Copilot Studio editor. Ask something that forces a tool call rather than something the model can answer from general knowledge:

Which Agility instances can I access?
List the content models in the marketing instance.
Show me the last ten blog posts and their workflow state. A returned instance list confirms the connection is live. An authorization error usually means the connection exists but consent has not been granted; the test pane shows a Connect card to complete it.

Step 5: Publish to Microsoft 365 Copilot

Select Publish, then confirm. Publishing takes a few minutes.
Select Channels, then the Teams and Microsoft 365 Copilot tile.
Confirm Make agent available in Microsoft 365 Copilot is selected.
Select Add channel. Then choose a distribution method under Availability options:

Method	Reach	Admin approval
Copy link	Specific people you send it to. Does not work in the Teams mobile app.	No
Show to my teammates and shared users	Appears under "Built with Power Platform" for users the agent is shared with	No
Show to everyone in my org	Appears under "Built for your org" in the Teams app store	Yes, via Submit for admin approval, approved in the Teams admin center

Republishing content changes does not require resubmission. Changing the agent icon or description on an admin-approved agent does.

Step 6: Using the agent

Users open Microsoft 365 Copilot, type @, select the agent, and ask their question.

With Authentication set to End user, the first time each person invokes an Agility tool they see a Connect card, sign in to Agility, and create their own connection. Connections are per user, so:

Nobody inherits the maker's credentials.
Each user sees only the content their Agility account can see.
A contributor cannot publish through the agent if they cannot publish in Agility.
Agility audit history records the actual person who made each change. If users are never prompted to connect, the tool is running on maker-provided credentials. Go back to Step 3.

Publish, unpublish and delete operations are confirmed by the Agility MCP Server before they run. That behaviour is enforced server side and applies to every MCP client, not just Copilot.

Example prompts

Find every blog post tagged Migration that is still in Staging and list the authors.
Create a case study for Northwind in English and French using the same structure as the last one.
Which pages on the marketing sitemap have no meta description?
Publish content item 10964.

Troubleshooting

Selecting "Model Context Protocol" opens documentation instead of a wizard

The MCP onboarding wizard is feature flagged per tenant and environment. If it is not enabled, there is no UI workaround. Open a Microsoft support ticket with your tenant ID, environment ID and region and ask for the MCP onboarding wizard to be enabled.

"A custom connector with this display name already exists"

A previous MCP onboarding attempt failed partway through and left an orphaned custom connector. Open Power Apps or Power Automate, go to Custom connectors, delete the orphaned connector, then retry the wizard.

Publish fails with `DlpViolationError` or `BlockedConnector`

A Power Platform data loss prevention policy is blocking the connector. Agents cannot be exempted from DLP. Ask your Power Platform administrator to move the connector into an allowed data group.

The tool is set to maker-provided credentials, so every call runs as the agent maker. Open the tool, expand Additional details, set Authentication to End user, and republish. Existing users will be prompted to connect on their next request.

A user can read or change more than their Agility role allows

Same cause as above. Confirm Authentication is End user on every tool in the agent, and confirm Allow permission to share parameters is off on the Agility connection. If the behaviour persists, verify the user's role assignments in Agility directly, since the agent cannot exceed what the signed in account is permitted to do.

The tool is connected but never called

Add explicit references to Agility CMS in the agent instructions, and name the kind of work the tools do (read content, update content, publish pages). Generic instructions leave the orchestrator with nothing to match on.

Users see a "Connect" card and cannot get past it

The user has not completed OAuth consent. Have them select the card and sign in with their Agility account. If consent fails, confirm the user has an active Agility user account with access to at least one instance.

Other Microsoft integration paths

These exist but do not replace the Copilot Studio path as of August 2026.

Agent 365 bring your own MCP server (preview)

A developer registers the server with the Agent 365 CLI, and an AI Admin or Global Admin approves it in the Microsoft 365 admin center under Agents > Tools > Requests. Approval is tenant wide, and invocations are visible in Microsoft Defender advanced hunting.

Registration example:

a365 develop-mcp register-external-mcp-server \
  --server-name "AgilityCMS" \
  --server-url "https://mcp.agilitycms.com/api/mcp" \
  --publisher "Agility CMS" \
  --description "Read and manage content in Agility CMS" \
  --auth-type ExternalOAuth

Approved servers are currently consumable in Copilot Studio, VS Code, Claude Code and the GitHub Copilot CLI. Microsoft 365 declarative agents are listed as not yet supported. This path centralizes governance; it does not remove the need for an agent.

Federated Copilot connectors

A federated Microsoft 365 Copilot connector is a remote MCP server that Microsoft certifies and publishes, after which it surfaces across Copilot Chat, Excel, Cowork and the Researcher agent without anyone building an agent. Submission runs through Partner Center for vendors, or the Microsoft 365 admin center for internal line of business connectors. Arbitrary MCP endpoints cannot be federated without review.