DataMosaicDocs · Connecting to data
Microsoft Copilot
Let a workflow search Microsoft 365 or ask Copilot through Microsoft Graph, and let an agent in Copilot Studio ask Mosaic.
Copilot in two directions: a workflow that searches your Microsoft 365 content or asks Copilot a question, and an agent in Copilot Studio that answers questions about Mosaic.
Both are under Integrations, in the group Microsoft Copilot. They are separate, and you can set up one without the other.
| Integration | Who asks whom | What it needs |
|---|---|---|
| Microsoft 365 Copilot | A workflow asks Microsoft, through Microsoft Graph | An app registration in Microsoft Entra ID, and one person's sign-in |
| Copilot Studio | An agent in Copilot asks Mosaic | A Mosaic API key, and a Mosaic address Microsoft can reach |
Neither one is a model for a Check's chat or for Ask Mosaic. Microsoft 365 Copilot has no interface that would let it be one. Where Microsoft is the licence you hold, the model to connect is Azure OpenAI.
#Microsoft 365 Copilot
Two workflow nodes use it: Search Microsoft 365 and Ask Copilot.
Microsoft offers these two interfaces to a signed-in person only. An application cannot call them by itself, so a client secret is not enough: somebody signs in once, and every later call is made as that person. A workflow can read what that account may read in Microsoft 365, and nothing more. A service account with access to the right SharePoint sites is the usual choice.
#1. Register an app
In Microsoft Entra ID, register an application and give it:
- a Web redirect URI. The integration's panel shows the address to use, with a Copy button. It ends in
/api/integrations/microsoft/callback. - delegated Microsoft Graph permissions, with admin consent. Application permissions do nothing here.
- a client secret.
Which permissions depends on what you want workflows to do:
| To | Delegated permissions |
|---|---|
| Search SharePoint and OneDrive | Files.Read.All, Sites.Read.All |
| Search Copilot connectors as well | ExternalItem.Read.All |
| Ask Copilot | Sites.Read.All, Mail.Read, People.Read.All, OnlineMeetingTranscript.Read.All, Chat.Read, ChannelMessage.Read.All, ExternalItem.Read.All — all seven |
Asking Copilot also needs a Microsoft 365 Copilot licence for the account that signs in.
Grant only what you mean to use. Mosaic asks Microsoft for whatever the app was granted and keeps no list of its own, so an app with the two search permissions can search and cannot ask.
#2. Connect
Type the Directory (tenant) ID, the Application (client) ID and the Client secret. The secret is encrypted with the same key file as a data source password.
#3. Sign in
Press Sign in with Microsoft. Anything typed and not yet saved is saved first. Your browser goes to Microsoft, asks which account, and comes back to the Integrations page.
After that the panel says who is signed in, and offers:
- Check access — asks Microsoft for a token now and lists what the sign-in may do: search SharePoint and OneDrive, search Copilot connectors, ask Copilot.
- Sign in as someone else — replaces the account.
- Sign out — forgets the sign-in. Workflows stop being able to use it at once.
Each sign-in is written to the audit log, with who started it and which account signed in.
A sign-in that goes unused for about ninety days lapses on Microsoft's side. The node that hits it says to sign in again.
#What leaves Mosaic
Only what a node's author wrote into it: the question a search asks, and the prompt, the context and the file addresses an Ask sends. Nothing is sent by having the integration installed.
Ask Copilot is a model, so it obeys the workspace's AI switch and is part of Pro and above. Search is not a model and does not.
#Copilot Studio
An agent you build in Microsoft Copilot Studio can take Mosaic as a tool, through the address any assistant of your own connects to. People then ask the agent how to do something in Mosaic, from Copilot or Teams, and it answers from Mosaic's manual.
What the agent can reach is the manual and the catalogue of workflow nodes this installation has. It reads nothing of a workspace's checks, runs or data, and it changes nothing.
Copilot Studio runs in Microsoft's cloud, so it has to reach your Mosaic over the internet at an HTTPS address. Mosaic Cloud is. A Mosaic on your own server is only if you publish it; the panel says when its address is not one Microsoft could call.
#1. Make an API key
Under Settings → Keys, create a key. Run and read is enough. Copy it when it is shown.
#2. Add Mosaic to your agent
In Copilot Studio, open the agent's Tools page and choose Add a tool → New tool → Model Context Protocol. The panel in Mosaic has each value with a Copy button:
| Field | Value |
|---|---|
| Server name | Mosaic |
| Server description | What Mosaic answers. The agent reads it to decide when to call |
| Server URL | https://<your Mosaic>/api/mcp |
| Authentication | API key, Header, named Authorization |
#3. Connect with the key
When Copilot Studio asks for the connection's API key, type the word Bearer, a space, and then the key:
Bearer <your key>Then Add to agent.
#Importing a connector instead
Where the wizard cannot be used, Download connector file gives a file Power Apps imports as a custom connector to the same address. In Copilot Studio: Add a tool → New tool → Custom connector → New custom connector → Import OpenAPI file.