> ## Documentation Index
> Fetch the complete documentation index at: https://neuraltrust-92b43583-develop.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Copilot Studio
> Screen every tool a Copilot Studio agent is about to run with TrustGuard threat detection, and govern its MCP tool access with TrustGate
Microsoft Copilot Studio is a low-code Power Platform service used to build
conversational agents. Makers define instructions, add knowledge sources and
tools, and publish agents to Teams, websites, or Microsoft 365.
Microsoft hosts model execution, so nothing of ours sits in the data path. There
are two integration points, and they solve different problems:
## NeuralTrust controls
| Product | What it does for Copilot Studio | What you can enforce |
| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| **[TrustGuard](/trustguard/overview)** threat detection | Copilot Studio calls TrustGuard for a verdict **before every tool the agent is about to run**, including what earlier tools returned. | Monitor · Block |
| **[TrustGate](/trustgate/overview)** MCP | Publishes the assigned MCP servers through one OAuth endpoint and limits the catalog to the consumer's registries and toolkit. | Tool access and rate limits |
| **[TrustGuard](/trustguard/overview)** on MCP traffic *(optional)* | Evaluates MCP `tools/call` requests and `CallToolResult` responses routed through TrustGate. | Monitor · Block · Transform |
**Threat detection cannot redact.** Copilot Studio's contract accepts a single
boolean decision, so there is no field in which to return rewritten content. A
**Transform** rule produces no masking on this path — use **Block** when content
must not reach the tool. Redaction is available only on the TrustGate MCP path,
where TrustGuard owns the payload.
## Scope
Threat detection covers Copilot Studio agents that use **generative
orchestration**. It does **not** cover Microsoft 365 Copilot in Word, Teams or
Outlook, which exposes no hook to third parties.
## Deployment options
| Goal | Configuration | Location |
| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------- | -------------------------------------------- |
| Screen every tool call an agent makes | **Threat detection**: a Copilot Studio collector plus a federated credential in your Entra app | Power Platform admin center, per environment |
| Centrally manage which MCP tools the agent can reach | **TrustGate MCP** with OAuth and dynamic client registration | The agent's MCP tool connection |
| Inspect MCP tool payloads as well as access | A TrustGuard policy attached to the TrustGate consumer | On the TrustGate consumer |
The two paths are independent. Threat detection screens every tool the agent
runs, whatever its source; TrustGate MCP governs only the tools it publishes.
## Set up threat detection (TrustGuard)
Microsoft calls TrustGuard, so nothing is deployed and nothing is proxied.
Authentication uses an Entra **federated identity credential** — there is no
shared secret and no API key on this path.
Setup spans three places: the collector's **Connection** tab, your Entra app
registration, and Power Platform admin center. The Connection tab produces every
value the other two ask for.
### Before you start
| Requirement | Notes |
| --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| A **Copilot Studio** collector | **Agent Runtime → Collectors → Catalog → Agent platforms → Copilot Studio**. |
| A TrustGuard instance with a **public address** | Microsoft calls in from the internet. The Connection tab says so plainly if your instance has no public address yet — ask your operator before configuring the environment. |
| Permission to register an application in **Microsoft Entra ID** | You create a single-tenant app and add a credential to it. |
| **Power Platform admin center** access for the environment | Threat detection is configured per environment, not per agent. |
| An agent using **generative orchestration** | See [Scope](#scope). |
### 1. Copy the threat detection endpoint
Open the collector and read the **Connection** tab. The **Threat detection
endpoint** is unique to this collector:
```text theme={null}
{TRUSTGUARD_BASE_URL}/v1/evaluate/copilot-studio/{collector_id}
```
One endpoint per collector, never shared. The federated credential binds this
exact URL, so if the endpoint changes the credential stops matching.
### 2. Register an application in Microsoft Entra ID
In **Microsoft Entra ID → App registrations**, create a **single-tenant**
application. Copy two values:
| Value | Where |
| --------------------------- | ------------------------------------- |
| **Directory (tenant) ID** | Microsoft Entra ID → Overview |
| **Application (client) ID** | The app registration you just created |
### 3. Store the tenant and application IDs on the collector
Back on the **Connection** tab, paste both values and press **Save**. Separate
several Application IDs with commas if more than one application will call.
The status changes from *Waiting for your tenant and application* to *Ready*.
**Deliveries are refused until both values are stored.** TrustGuard checks the
caller's application against this allowlist on every request, so an unsaved
collector rejects Microsoft's calls with `401`.
### 4. Add the federated identity credential
The Connection tab now shows a **Federated credential subject identifier**. Copy
it.
In your Entra app registration, open **Certificates & secrets → Federated
credentials → Add credential** and fill the form:
| Field | Value |
| --------------------------------- | --------------------------------------------------------- |
| **Federated credential scenario** | Other issuer |
| **Issuer** | `https://login.microsoftonline.com/{your-tenant-id}/v2.0` |
| **Type** | Explicit subject identifier |
| **Value** | The subject identifier copied from the Connection tab |
| **Audience** | `api://AzureADTokenExchange` |
**Never build the subject identifier by hand.** It encodes your tenant *and*
the exact endpoint URL, and the tenant GUID is not written as a GUID — it is
re-ordered into .NET byte order and base64url-encoded. A subject assembled by
hand from the tenant ID looks entirely reasonable, **Entra accepts it without
complaint**, and it never matches an incoming token. Always copy the value the
Connection tab computes, and copy it again if you change the endpoint.
### 5. Turn on threat detection in Power Platform admin center
Open the environment → **Security** → **Threat detection**, then enter the
endpoint from step 1 and the Application (client) ID from step 2.
Power Platform admin center also asks what should happen when TrustGuard cannot
answer in time.
**Microsoft's default is to let the agent respond.** If a missed verdict should
stop the tool rather than wave it through, choose to block the query instead.
TrustGuard answers within a 700 ms budget because Copilot Studio waits 1000 ms
and treats a slower answer as no answer.
Pressing **Save** makes Power Platform call the collector's readiness probe. A
healthy collector answers `{"isSuccessful": true, "status": "OK"}`.
### 6. Assign a policy
On the collector's **Policies** tab, assign a default policy. Start it in
**Observe** so findings are recorded without stopping any tool, check
**Agent Runtime → Activity**, then switch to **Enforce**.
A collector with no matching policy is **unguarded**: TrustGuard allows every
tool and inspects nothing.
## Set up governed tool access (TrustGate)
### Before you start
| Requirement | Notes |
| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| An [MCP consumer](/trustgate/mcp/overview) with **OAuth2** authentication | Create it under **Agent Gateway** → **Consumers**. Copilot Studio uses OAuth2. |
| [Registries](/trustgate/concepts/registries) and a toolkit assigned to the consumer | The consumer's routing determines what the agent can call. An empty toolkit on a bound registry grants the entire server. |
| The endpoint from the consumer's **Connect** tab | Always ends `/{consumer_slug}/mcp`. |
| Egress from the TrustGate data plane to each registry `url` | SaaS cannot call private VPC endpoints. Use [Hybrid](/neuraltrust/deployment/hybrid) for internal MCP servers. |
| An IdP app *(only if you use your own IdP)* | Follow the [Okta](/trustgate/concepts/authorization/okta) or [Entra ID](/trustgate/concepts/authorization/entra-id) setup for the app registration and redirect URI. |
| Browser pop-ups allowed for the maker | Consent runs in a pop-up window. A blocked pop-up leaves the connection unfinished. |
| A TrustGate collector and TrustGuard runtime policy *(optional)* | Required only for inspecting tool calls and results. Include Input and Output rules if you need both directions. |
**Do not configure client credentials manually.** TrustGate publishes OAuth
metadata and supports Dynamic Client Registration, so Copilot Studio registers
itself. If Copilot Studio asks for a **Client ID** or **Client secret**, confirm
that authentication is set to **Dynamic discovery** and that the server URL is
the endpoint copied from **Connect**.
### 1. Create the MCP consumer
In **Agent Gateway** → **Consumers**, create a consumer with protocol **MCP** and
auth **OAuth2**, bind the [registries](/trustgate/concepts/registries) and
toolkit you want the agent to have, then copy the URL from the **Connect** tab:
```text theme={null}
https://{mcpHost}/{consumer_slug}/mcp
```
**Authentication options.** The Copilot Studio configuration is the same for
both options; only the consumer configuration changes.
| Option | Consumer setup |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **NeuralTrust** (no external IdP) | Leave the OAuth **Client** blank, or select **Use NeuralTrust**. |
| **Your IdP** (Okta, Entra ID, etc.) | Attach an OAuth2 auth from [Identity](/trustgate/concepts/auth). Follow [Okta](/trustgate/concepts/authorization/okta) or [Entra ID](/trustgate/concepts/authorization/entra-id) for the IdP app and redirect URI. |
Use an Identity-based consumer when different people should see different tools. The
caller's identity selects the [roles](/trustgate/concepts/roles), which determine
the registries and toolkit available to that caller.
### 2. Add the MCP tool in Copilot Studio
1. Create a tool → **MCP**.
2. Set Authentication → **OAuth** → **Dynamic discovery**.
3. Paste the consumer URL from [step 1](#1-create-the-mcp-consumer) as the server
URL. Leave the defaults. If Power Automate opens, no changes are needed there.
### 3. Build the agent and activate the connection
1. Create an agent and add the MCP Server tool from step 2.
2. On the first run, activate every connection when prompted, including the MCP
Server itself.
3. Complete the NeuralTrust or IdP login if prompted. If an upstream registry
uses **OAuth (forwarded)** and the user has not connected it, the first tool
call returns a connection link. After authorization, TrustGate stores and
refreshes the credential.
### 4. Verify
1. Submit a request that invokes a tool from a bound registry.
2. Confirm the agent lists only the tools granted by the consumer's toolkit.
3. Confirm the call in TrustGate telemetry. See
[Metrics](/trustgate/observability/metrics).
### Optional: inspect tool calls and results
The preceding steps configure an access-only connection. To evaluate the content
of MCP traffic with TrustGuard:
1. Follow the [TrustGate integration](/integrations/trustgate) to create a
TrustGate collector and assign a TrustGuard runtime policy. Add Input rules for
tool calls and Output rules for tool results. Start in **Observe** mode.
2. In **Agent Gateway** → **Policies** → **Catalog**, add **TrustGuard**. Select
the collector, set direction to `request_response`, and target the Copilot
Studio consumer. Keep the guardrail in **Observe** while testing.
3. Invoke a tool and confirm the input and output decisions in TrustGuard
**Activity**.
4. After reviewing the decisions, switch the runtime policy and guardrail to
**Enforce**.
| MCP event | What TrustGuard evaluates | Behavior in Enforce mode |
| ---------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `tools/call` | The tool name and string values in its arguments | **Block** prevents the upstream tool from running and returns an MCP policy error. **Transform** rewrites argument values but does not change the tool name. |
| `CallToolResult` | Text content blocks and string values in `structuredContent` | **Block** discards the result and returns an MCP policy error; it cannot undo an action the tool already performed. **Transform** rewrites the inspected values before Copilot Studio receives the result. |
In **Observe** mode, findings are recorded without blocking or rewriting traffic.
If a transform cannot be applied safely in **Enforce** mode, TrustGate blocks
instead of forwarding unmasked content. Redaction applies to DLP outcomes only.
## Reference
### Coverage
Microsoft hosts model execution, so **neither path evaluates the agent's prompts
or model responses**. What each one sees:
| Surface | Threat detection | TrustGate MCP, access only | TrustGate MCP + TrustGuard policy |
| ------------------- | ---------------------------------------------- | -------------------------------------- | ------------------------------------- |
| Agent prompt | Not evaluated | Not evaluated | Not evaluated |
| Model response | Not evaluated | Not evaluated | Not evaluated |
| Tool about to run | **Evaluated, whatever its source** | Routed only if the consumer may use it | The `tools/call` request is evaluated |
| Earlier tool output | **Included in the request** | Not inspected | The `CallToolResult` is evaluated |
| Redaction | **Not possible** — the response is one boolean | — | Available |
### What threat detection covers
**Microsoft decides what any third party can see here, not us.** Copilot Studio
exposes exactly one hook to an external security provider: the call immediately
before a tool runs. Everything else — how the model is prompted, how
instructions shape behaviour, what the platform remembers between turns —
happens inside Microsoft's service, where no third party can observe or
intervene. That is a property of the platform, not a limit of TrustGuard, and
it applies identically to every vendor in this position.
What that single hook gives you is broad: if the platform orchestrates something
as a tool execution, it reaches TrustGuard, whatever built it and wherever the
tool came from. Threat detection sees **what the agent does**, not what it says
or how it was built.
| Agent surface | Covered | Why |
| ------------------------------------------------------------------------- | :-----: | ------------------------------------------------------------------------------------- |
| **Tools** — connectors, Dataverse, custom actions, MCP tools on the agent | ✅ | Every execution, with its arguments. This is the hook. |
| **Knowledge** and **Connected agents** | ✅ | Whenever the platform runs them as a tool execution |
| Output of an earlier tool | ✅ | Carried in the next request, so a poisoned result is seen before the agent acts on it |
| **Model** — the prompt and the model response | ❌ | Microsoft hosts inference and exposes no hook for it, to anyone |
| **Skills** — instructions that shape behaviour | ❌ | Applied inside Microsoft's orchestrator. No hook is exposed for it. |
| **Memory** | ❌ | Held by the platform between turns. No hook is exposed for it. |
In short: **actions are covered; the conversation and the configuration stay
inside Microsoft's platform.**
**A prompt on its own is never evaluated on this path.** If someone types a
jailbreak into the chat, threat detection does not see it — it only sees that
text if it ends up in the arguments of a tool the agent then runs. To evaluate
prompts and model responses you need a collector that sits on the model call,
which Copilot Studio does not offer to third parties. Screening prompts on this
platform is not something a security vendor can choose to add — Microsoft would
have to expose the hook first.
Coverage follows the platform's own orchestration, not a list we maintain. To
confirm what a specific agent produces, run it in **Observe** and read
**Agent Runtime → Activity**: every tool execution that reached TrustGuard
appears there, so the findings are the authoritative answer for your agent.
### What Copilot Studio sends to threat detection
Each delivery carries the planner context (the user message, chat history, the
model's thought, and previous tool outputs), the definition of the tool about to
run with its input and output parameters, the input values being passed to it,
and conversation metadata — agent, user, trigger, conversation and message ids,
channel, and the incoming client IP.
Every field is treated as optional, so a Copilot Studio API version that adds or
drops one does not break evaluation.
### The verdict contract
Threat detection answers with a single decision:
```json theme={null}
{ "blockAction": false }
```
A block adds the reason Copilot Studio surfaces to the maker:
```json theme={null}
{
"blockAction": true,
"reasonCode": 1001,
"reason": "Blocked by TrustGuard",
"diagnostics": "{\"signals\":[…]}"
}
```
`blockAction` is the whole contract. That is why this path cannot redact:
there is no field in which to return rewritten content.
### Failure behavior
| Situation | What happens |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Verdict not ready within **700 ms** | TrustGuard stops waiting. Copilot Studio's own limit is 1000 ms and it treats a slower answer as no answer — the environment setting decides whether the tool runs. |
| Tenant or Application ID not saved | `401`. Deliveries are refused until both are stored. |
| Token from an application outside the allowlist | `401`. |
| Malformed delivery | `400`. |
| Audience not configured on the instance | `503`. The operator must set the threat-detection audience; TrustGuard refuses deliveries rather than accept a token minted for someone else. |
### MCP tool coverage in detail
| Surface | Default access-only setup | With a TrustGuard policy |
| ------------ | ------------------------------------------------ | ------------------------------------------------------------------- |
| Tool catalog | Limited by the consumer's registries and toolkit | Same registry and toolkit restrictions |
| Tool call | Routed only when the consumer may use the tool | The `tools/call` request is evaluated before execution |
| Tool result | Not inspected | The `CallToolResult` is evaluated before delivery to Copilot Studio |
**Limits.** TrustGuard inspects text tool content routed through TrustGate. It
does not inspect non-text image, audio, or resource content blocks. To limit call
frequency, attach the [Per-Tool Rate
Limiter](/trustgate/policies/tool-governance) policy. The Tool Injection policy
applies only to LLM traffic and does not affect MCP.
### Configuration
**MCP endpoint.** Each MCP consumer has a `streamable-http` endpoint. The agent
receives the merged catalog from the registries assigned to that consumer:
```text theme={null}
https://{mcpHost}/{consumer_slug}/mcp
```
The slug is the first path segment on the consumer's proxy URL, and the path must
end in `/mcp`. Copy the URL from the **Connect** tab instead of assembling it
manually.
**Agent authentication.** TrustGate acts as an OAuth2 authorization server for
connecting agents and supports **Dynamic discovery**:
| Endpoint | Purpose |
| ----------------------------------------- | --------------------------------------------------- |
| `/.well-known/oauth-protected-resource` | Protected-resource metadata. |
| `/.well-known/oauth-authorization-server` | Authorization-server metadata. |
| `/register` | Dynamic Client Registration. |
| `/authorize` · `/callback` · `/token` | Authorization-code flow with **PKCE**. |
| `/connect` · `/disconnect` | The consent flow used by `forwarded` upstream auth. |
The consumer configuration determines which IdP handles the login. See
[Auth](/trustgate/concepts/auth).
**Upstream authentication is separate.** Authenticating Copilot Studio to
TrustGate is not the same as authenticating TrustGate to the MCP servers behind
it. Configure the latter with `mcp_target.auth.mode` on the registry: `none`,
`static`, `client_credentials`, `passthrough`, `exchange` or `forwarded`.
`forwarded` requires the user to provide consent on first use.
**Tool names.** Unique names pass through unchanged; a collision is prefixed with
the registry name (`asana_create_task`). Use the name shown to the agent when
configuring tool restrictions.
**Fail mode.** `fail_mode` on the consumer decides what happens when an upstream
server is unavailable. `open` skips the failed server; `closed` fails the call.
For role-based consumers the effective mode is open **only** when every
contributing role declares it open.
### Troubleshooting
| Symptom | Cause |
| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Copilot asks for a Client ID or Client secret | Confirm authentication is set to **Dynamic discovery** and the URL ends in `/{consumer_slug}/mcp`. Manual client credentials are not required |
| Consent does not finish | Allow pop-ups in the maker's browser, then retry connection activation |
| Tools are missing, or an upstream call fails | The consumer has no bound registries, the toolkit excludes the tool, or the user has not completed the IdP or upstream OAuth flow |
| The agent sees no tools at all on first run | Not all connections, including the MCP Server itself, were activated on the first run |
| A tool the maker expected is silently absent | A bound registry is down and `fail_mode` is `open`, so it was skipped rather than erroring |
| Tool calls or results do not appear in TrustGuard **Activity** | The default setup is access-only, or the TrustGuard policy is not targeted to this consumer or direction |
| A tool-result block did not undo an external action | Output inspection runs after the tool executes. The result can be blocked or rewritten, but the tool action cannot be reversed |
## Related
* [MCP Gateway](/trustgate/mcp/overview): consumers, catalog merging, toolkits, and upstream authentication
* [TrustGate and TrustGuard](/integrations/trustgate): collector, policy, verdict, and failure behavior
* [TrustGate guardrails](/trustgate/policies/guardrails#trustguard): configure the optional policy
* [Consumers](/trustgate/concepts/consumers): slugs, routing modes, and the Connect tab
* [TrustGate authentication](/trustgate/concepts/auth): OAuth2 authentication for MCP consumers
* [Okta](/trustgate/concepts/authorization/okta) and [Entra ID](/trustgate/concepts/authorization/entra-id): IdP applications and redirect URIs
* [Roles](/trustgate/concepts/roles): identity-scoped toolkits
* [Microsoft Copilot Studio documentation](https://learn.microsoft.com/microsoft-copilot-studio/): Microsoft reference