Microsoft 365 Copilot
Build a small Copilot Studio agent that calls Covenant MCP, then publish it to Microsoft 365 Copilot.
Shortcut: click Copy Markdown above, paste this page into your AI assistant, and ask it to connect Covenant for you. An assistant that can edit its own settings does the setup; any other walks you through the steps.
Microsoft 365 Copilot does not take a server URL directly. A maker builds a small agent in Copilot Studio, adds Covenant to it as a Model Context Protocol tool, and publishes the agent to your tenant. People then use the agent in Copilot and Teams, and each signs in with their own Covenant login.
https://covenant.co/api/mcphttps://<your Covenant domain>/api/mcp instead. Transport is streamable HTTP; sign-in is OAuth with your Covenant login.Prerequisites
- Copilot Studio access for the maker who builds the agent, and a Microsoft 365 Copilot license for each person who uses it.
- Generative orchestration turned on for the agent; Copilot Studio needs it to call MCP tools.
- A Microsoft 365 admin to approve and publish the agent to the tenant.
- A Power Platform data policy that allows the tool. Copilot Studio reaches MCP servers through Power Platform connectors, so a policy that blocks custom connectors blocks Covenant too.
- A Covenant account for each person who uses the agent.
Who does what
| Step | Who |
|---|---|
| Build the agent and add Covenant as a tool | A maker with Copilot Studio access |
| Approve and publish the agent to the tenant | A Microsoft 365 admin |
| Sign in to Covenant the first time the agent calls it | Each person |
Add Covenant
Create the agent
In Copilot Studio, create an agent named Covenant. Turn on generative orchestration in the agent's settings; MCP tools need it.
Add Covenant as a tool
Open the agent's Tools page, click Add a tool, then New tool, then Model Context Protocol.
Fill in the wizard:
- Server name:
Covenant - Server description:
Covenant's answers about the user's fund terms, side letters and amendments. Use it for any question about a fund, a term or an amendment. - Server URL:
https://covenant.co/api/mcp
Under Authentication, choose OAuth 2.0, then type Dynamic discovery. Click Create. Copilot Studio finds Covenant's sign-in and registers itself.
On Add tool, choose Create a new connection, sign in with your Covenant login, then click Add to agent.
If dynamic discovery does not work: manual OAuth
Use this only if the wizard reports an error with Dynamic discovery.
Email support@covenant.co for Covenant MCP's client ID and client secret for your Covenant domain. Covenant sends them by a secure channel.
Choose OAuth 2.0, type Manual, and fill in:
- Client ID and Client secret: from Covenant
- Authorization URL:
https://signin.covenant.co/oauth2/authorize - Token URL template:
https://signin.covenant.co/oauth2/token - Refresh URL:
https://signin.covenant.co/oauth2/token - Scopes:
openid profile email offline_access
If your firm signs in to Covenant on its own domain, Covenant gives you that domain's sign-in address instead.
Click Create. Copy the callback URL the wizard shows and send it to support@covenant.co. Covenant adds it to the allowed list, then you continue with Create a new connection and Add to agent.
Publish to Microsoft 365 Copilot
In the agent, open Channels and add Teams and Microsoft 365 Copilot. Click Publish.
A Microsoft 365 admin approves the agent in the Microsoft 365 admin center under Agents, and makes it available to the people who should have it.
If your tenant has Power Platform data policies, they apply to the Covenant tool too, because Copilot Studio reaches MCP servers through Power Platform connectors. Your admin may need to allow it.
Check it worked
In Microsoft 365 Copilot, open the Covenant agent and ask:
- "Run the whoami tool." The first time, Copilot asks you to sign in to Covenant. It then returns your email, your organization, your role and your data scope.
- "List my investments."
- One question about a fund.
If it fails
| What you see | Where to look |
|---|---|
| The wizard fails on Create with dynamic discovery | Use manual OAuth above, then contact Covenant if it still fails |
| Sign-in fails with a redirect error after manual OAuth | Redirect URL not allowed |
Everything else is on the troubleshooting page.