# Connect Microsoft 365 Copilot

**What this is:** use Bill & Ben from Microsoft 365 Copilot.
**Who it is for:** companies on Microsoft 365 whose IT team can build and publish a Copilot agent.

## Who can use it
Microsoft 365 Copilot cannot take a server address directly. Your IT team makes an agent that uses Bill & Ben as a tool, and publishes it. There are two ways:

- **Copilot Studio:** the maker adds Bill & Ben as a tool of an agent. Makers need a Copilot Studio licence. Microsoft says people who only chat with an agent need no special licence. Whether they need a Microsoft 365 Copilot licence is not stated on the pages we read.
- **Declarative agent in the Microsoft 365 Agents Toolkit (VS Code):** a developer builds the agent. Toolkit version 6.12.0 or later.

## What an admin must do
- **Copilot Studio:** check that your data policies allow a custom MCP connector. Microsoft's data policies can block it.
- **Microsoft 365 admin center:** under Agents, then Tools, approve the new server when it appears in Requests. Approving needs the AI Administrator or Global Administrator role. It can take up to 30 minutes to show up in Copilot Studio. Under Agents, then Settings, **Agent and plugin access** controls who may use agents and plugins.
- **Test install:** for a declarative agent, "Custom App Upload Enabled" and "Copilot Access Enabled" must be on for the testers.
- Give the people who will use it the Bill & Ben permission `gateway.connect` ([permissions](../platform/permissions.md)).

## Steps in Copilot Studio (maker)
1. Open your agent. Go to **Tools**, then **Add a tool**, then **New tool**, then **Model Context Protocol**.
2. Enter a name, a short description and the server address `https://ai.<brand>/mcp`.
3. For authentication choose OAuth 2.0. Pick the dynamic option if Copilot Studio offers it.
4. If Copilot Studio asks for a client ID and key, ask your Bill and Ben contact to register a client with a password for you. Copilot Studio shows a redirect address; it should be `https://global.consent.azure-apim.net/redirect`. If it is different, tell the operator before you continue (see "Known gap").
5. Create the connection, sign in with your company account and choose **Allow**.
6. Add the tools you want the agent to use, then publish the agent to Microsoft 365 Copilot.

## Steps for a user
1. Open Microsoft 365 Copilot at `m365.cloud.microsoft/chat`.
2. Choose **Agents** and pick the agent.
3. Choose **Sign in to** the agent name, sign in and choose **Allow**.

## What you can do
All the tools on the [overview](../connect-your-ai.md#what-you-can-do-once-connected) that the maker added to the agent. A maker can leave some out.

## Known gap
- Microsoft's shared return addresses (Copilot Studio and the Teams plugin address) are accepted only for a client that has a password. Anonymous sign-ups cannot use them. The client must be registered with a password by your IT admin (Microsoft's own dynamic registration path requires one).
- Some Copilot Studio connections show a return address with an extra id at the end (`.../redirect/<id>`). Bill & Ben does not accept those yet. Not proven with Microsoft.

## If it goes wrong

| You see | What to do |
|---|---|
| "This plugin is blocked by your organization's policy." | An admin must allow it under Agents, Settings, Agent and plugin access. |
| Sign-in fails right after you choose to sign in | The return address is not on Bill & Ben's list, or the client has no password. Ask your Bill and Ben contact. |
| Sign-in page says **Not on your organisation's list** | Your Bill & Ben admin must add you. |
| The server never shows in Copilot Studio | Wait up to 30 minutes after admin approval. |

## Disconnect
- **User:** open Microsoft 365 Copilot Chat settings, then Agents, and sign out of the agent. This clears the stored token on Microsoft's side.
- **Maker or admin:** remove the tool from the agent, or block it under Agents, Tools in the admin center.

Microsoft does not say whether signing out also ends the token on our side. To cut access at once, ask your Bill & Ben admin to remove your `gateway.connect` permission.