Microsoft 365 Copilot Integration

Connect Microsoft 365 Copilot directly to TATER via Model Context Protocol (MCP). Combine Copilot's native Microsoft Graph context (Entra ID users, Conditional Access, Defender, Intune, Outlook, Teams, SharePoint) with TATER's compliance posture, risk register, change pipeline, and configuration documentation — all from one chat.

Why Copilot + TATER together

Copilot already has access to your tenant's live state through Microsoft Graph. TATER has the compliance posture: which controls are passing, which are accepted as risk, which are pending change-control approval, and your living configuration documentation. Connecting them lets Copilot answer questions neither tool can answer alone:

• "Our MFA control is failing — show me which 47 users haven't registered MFA, and draft an Outlook email to them."
• "Cross-check our Conditional Access policies against TATER's expected SCuBA baseline and surface any drift."
• "I just changed the spam filter aggressiveness level. Document it as a versioned config doc in TATER, and post a summary to the security Teams channel."
• "Generate the SOC 2 quarterly readiness summary, save it to SharePoint, and post the executive summary to Teams."

Prerequisites

Path A: Copilot Studio (recommended)

Copilot Studio gives you a custom Copilot agent without writing any manifest files. You'll connect it to TATER's MCP HTTP endpoint via Copilot Studio's connector UI, drop in our agent instructions, and publish the agent for your users.

1. Open copilotstudio.microsoft.com and sign in. Click Create → Agent.
2. Name the agent TATER Compliance Analyst. For the description, paste: "Continuous compliance, risk register, and configuration documentation for our M365 tenant. Inspect control status, remediate findings, capture evidence, and maintain living network documentation."
3. For the agent's Instructions, copy the full contents of instructions.md and paste them in.
4. Click Tools in the left rail, then Add a tool → Custom connector → New custom connector → Import an OpenAPI file. Upload copilot-studio-connector.yaml — this is the Swagger 2.0 variant required by Copilot Studio's import wizard. (We also publish the OpenAPI 3.0 spec as openapi.yaml for Postman / generic SDK use, but Copilot Studio rejects 3.0 specs.)
5. In the connector wizard, fill in the OAuth fields. Most are universal TATER values — identical for every customer because TATER is a multi-tenant Entra app. Only Client Secret and Redirect URL are tenant-specific:

   Field	Value	Source
   Host	api.tatersecurity.com	TATER's public API
   Authentication type	OAuth 2.0	Standard
   Identity provider	Azure Active Directory (or "Microsoft Entra ID" in newer UI)	Standard
   Client ID	45afb90d-c5de-439d-8b09-8fbfed28b321	TATER app — same for every customer; do not change.
   Client secret	Leave blank if your tenant accepts public-client OAuth. Otherwise see Confidential-client below.	Your tenant (only if confidential-client)
   Authorization URL	https://login.microsoftonline.com/common/oauth2/v2.0/authorize	Standard. /common works because TATER is multi-tenant. You can substitute your tenant ID for stricter scoping.
   Token URL	https://login.microsoftonline.com/common/oauth2/v2.0/token	Standard, same caveat as above.
   Resource URL (if shown — v1.0 wizards only)	api://45afb90d-c5de-439d-8b09-8fbfed28b321	TATER app — the token's audience. Same prefix as Scope, just without /access. v2.0 wizards auto-derive this from Scope and don't show the field.
   Scope	api://45afb90d-c5de-439d-8b09-8fbfed28b321/access	TATER scope — the permission inside the resource. Same for every customer.
   Redirect URL	Power Platform's centralized OAuth proxy: https://global.consent.azure-apim.net/redirect — same for all non-sovereign customers. Copilot Studio confirms it after you save (regional variants like us.consent.azure-apim.net/redirect may apply to government/sovereign tenants).	Standard (Power Platform endpoint)

6. Save and test the connector. Copilot Studio will surface a "Sign in" link — click it, complete the OAuth dance with your TATER-member account, and you should see "Connected".
7. Back in the agent, click Test in the upper-right and try: "What's the current TATER organization context?" — the agent should call get_org_context and report your org.
8. Click Publish. Choose the channels you want (M365 Copilot Chat, Teams, web). Approve any tenant-admin consent prompts.

{
  "isFallbackPublicClient": false,
  "web": {
    "redirectUris": [
      "https://global.consent.azure-apim.net/redirect"
    ]
  }
  // Note: requestedAccessTokenVersion lives on the *resource* app
  // (TATER, already set to 2), not on your connector. Leave it null here.
}

Path B: Declarative agent (advanced, code-based)

For teams that want full custom branding, source-controlled manifests, or to bundle multiple agents in one Teams app package. Requires VS Code, the Microsoft 365 Agents Toolkit (formerly "Teams Toolkit"), and Integrated Apps permission to upload custom apps.

Step B-1: Download the manifest files

• declarative-agent.json — the M365 Copilot Custom Engine Agent manifest
• api-plugin.json — the API plugin descriptor with OAuth config
• openapi.yaml — the OpenAPI 3.0 spec for the MCP HTTP endpoint
• instructions.md — the agent persona / system prompt

Step B-2: Package as a Teams app

1. Install Microsoft 365 Agents Toolkit in VS Code (formerly "Teams Toolkit" — the marketplace listing was renamed in early 2026; same extension ID).
2. Run Teams: Create new app → Custom Engine Agent → Declarative Agent → Start with manifest.
3. Point the toolkit at declarative-agent.json. It scaffolds a Teams app project.
4. Drop api-plugin.json, openapi.yaml, and instructions.md into the project's appPackage/ directory.
5. Run Teams: Provision & Package to produce a .zip.

Step B-3: Configure the OAuth connection

Same OAuth values as Path A's connector wizard, but configured via M365 admin center → Settings → Integrated apps → Connections. After save, copy the verification token and paste it into api-plugin.json under auth.verification_tokens.openai, then re-package.

Step B-4: Upload to your tenant

1. M365 admin center → Integrated apps → Upload custom apps.
2. Approve any tenant-wide permission consent.
3. Assign to a pilot security group before tenant-wide rollout.
4. Wait 2–4 hours. The agent appears in the Copilot agent picker.

Auth nuance — admin actions through Copilot

Test the integration

Open Microsoft 365 Copilot (Office.com or Teams) or Copilot Studio, select the TATER Compliance Analyst agent, and try:

• "What's the current TATER organization context?" — should call get_org_context and report the org you're a member of.
• "Show the most critical failing controls." — should call get_failing_controls with severity=Critical.
• "Document the Conditional Access policy that blocks legacy auth." — should call Graph to read the policy, then call upsert_config_doc to persist a structured doc in TATER.

If the agent says it can't reach TATER or returns 401, double-check the OAuth connection: scope must be exactly api://45afb90d-c5de-439d-8b09-8fbfed28b321/access and the admin-consent URL must have been completed for your tenant.

Audit attribution

Every TATER tool invoked through Copilot is recorded in the TATER audit log with:

• The signed-in Copilot user's userEmail and userId
• via: 'copilot' — so SuperAdmins can filter for Copilot-driven activity in Activity Log
• The full tool name and arguments (sanitized for length, capped per CLAUDE.md audit-size limits)

This means every override, change request, remediation trigger, evidence comment, or config doc created through Copilot is fully attributable to a real human identity — same as actions taken in the TATER web app or via Claude Desktop. Copilot is treated as just another channel.

Safety guardrails

The shipped instructions.md requires Copilot to describe write actions and ask for confirmation before invoking any TATER tool that mutates compliance state. Destructive Microsoft Graph actions (deleting users, modifying tenant-wide settings) are explicitly forbidden — the agent is instructed to use TATER's create_change_request instead, so the change is registered in the change pipeline before being executed manually.

You can tighten or relax these guardrails by editing instructions.md and re-packaging the agent. We recommend keeping confirmation-before-write enabled in production tenants.

What's next

1. Review the agent's daily activity in Activity Log filtered by via=copilot for the first 1–2 weeks — it surfaces patterns where the agent's tool selection or instruction handling could be improved.
2. Customize instructions.md with your org-specific policies (preferred frameworks, escalation rules, naming conventions, etc.) and re-package.
3. Add additional conversation_starters to the manifest for common workflows your team runs (quarterly reviews, audit prep, client onboarding).
4. If you build a Copilot Studio agent for a different audience (e.g., a customer-facing agent that sees only public Trust Center data), reach out — we have a separate manifest for that.

Related documentation

• Claude / MCP setup — the original MCP integration guide for Claude Desktop and claude.ai
• In-app AI Analyst — TATER's built-in agentic AI accessible from the sidebar
• Settings reference — including API key generation