Microsoft Copilot integration¶

Connect Datahub to Microsoft 365 Copilot over MCP so people can ask your governance knowledge — glossary, catalog, metrics, contracts, products, flows, tasks, and insights — in natural language, from inside Teams, Word, or the Copilot sidebar.

Audience: Administrators setting up the Copilot connection, and end users who interact with Datahub through Copilot.

Endpoint/mcp · Bearer

Meta-tools9 · ask_*

AuthOAuth 2.1 · runs as the user

Tool policycopilot.standard

When to reach for this¶

Ask governance questions inside Copilot

Query the glossary, catalog, metrics, and contracts from Teams, Word, or the Copilot sidebar — without switching to the Datahub UI.
Route through one smart tool

Copilot calls a single ask_* meta-tool instead of choosing from dozens of raw tools; Datahub's agent pipeline handles selection and formatting.
Keep answers inside the user's roles

The OAuth flow runs under the consenting user's Datahub identity, so Copilot only ever sees data that user is allowed to see.
Govern and audit the connection

One tool policy scopes what Copilot can reach, and every call is recorded in MCP governance.

When this isn't the surface you want

A full-page, multi-turn conversation with memory → use Datahub's own AI chat / HERC — the same agent pipeline, without Copilot's synchronous, stateless tool calls.
Raw MCP tool access for a custom client (Cursor, Claude Desktop) → register it under MCP governance with a broader policy.
Sending Datahub notifications into Teams or Outlook → that's the Microsoft 365 integration, a separate surface.

How it works¶

Datahub exposes an MCP server at /mcp with agent meta-tools — a small set of high-level tools that route your questions through Datahub's AI specialist agents. Instead of choosing from dozens of low-level tools, Copilot calls a single meta-tool (e.g. ask_glossary) and Datahub's agent pipeline handles tool selection, multi-step orchestration, and response formatting internally. The answer is then rendered back inside Copilot.

flowchart LR
    USER["User in M365 Copilot<br/>Teams · Word · sidebar"] --> MCP["/mcp endpoint<br/>Bearer token"]
    MCP --> GATE{"Tool-policy gate<br/>copilot.standard"}
    GATE -->|allowed| META["Meta-tool<br/>ask_glossary · ask_catalog · …"]
    META --> AGENT(["Datahub agent pipeline<br/>routes to a specialist"])
    AGENT <--> DATA[("Governance data<br/>glossary · catalog · metrics · contracts · …")]
    AGENT -->|formatted answer| USER
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class AGENT accent

Figure 1 — A question from Copilot reaches the Bearer-only /mcp endpoint, clears the copilot.standard tool-policy gate, and lands on one ask_* meta-tool. Datahub's agent pipeline picks a specialist, reads governance data, and hands a formatted answer back into Copilot.

Why route through meta-tools

Copilot calls one high-level ask_* tool instead of choosing among dozens of raw tools. Datahub's agent pipeline handles tool selection, multi-step orchestration, and response formatting — so Copilot gets a clean, formatted answer and you keep a single, governable surface.

Meta-tool	What it covers
`ask_datahub`	Any question — Datahub auto-routes to the best specialist
`ask_glossary`	Business glossary terms, definitions, domains, relationships
`ask_catalog`	Data catalog assets, schemas, records, tags
`ask_metrics`	Business metrics, KPIs, metric definitions
`ask_contracts`	Data contracts, SLAs, quality expectations
`ask_products`	Data products, bundles, marketplace
`ask_flows`	Business process flows, automation, execution logs
`ask_tasks`	Tasks, assignments, review queues
`ask_insights`	Dashboards, insight cards, analytics

Every call is governed and audited

The /mcp endpoint sits behind the same Tool Policy gate as any other MCP client. copilot.standard admits only the nine public ask_* meta-tools, and every allow/deny decision is written to the MCP governance audit log. See MCP governance.

Prerequisites¶

Prerequisite	Why
Datahub reachable over HTTPS (public URL or VPN).	Copilot must reach `/mcp` and the OAuth endpoints.
Admin access to MCP Governance in Datahub.	To create the OAuth client and assign the tool policy.
A Microsoft 365 Copilot license, plus the Microsoft 365 Agents Toolkit in VS Code or access to Copilot Studio.	To build the declarative agent that calls the MCP server.

Setup — what an admin does once¶

The onboarding path is: register an OAuth client, scope it with the Copilot tool policy, connect Copilot to the MCP server over OAuth, then test.

flowchart LR
    OC["Create OAuth client<br/>Client ID + Secret"] --> POL["Assign tool policy<br/>copilot.standard"]
    POL --> CONN["Connect Copilot<br/>Agents Toolkit · Copilot Studio"]
    CONN --> CONSENT["OAuth consent<br/>runs as the user"]
    CONSENT --> TEST(["Test in Copilot"])
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class POL accent

Figure 2 — The admin onboarding flow. Binding copilot.standard is the governance step that scopes Copilot to the agent meta-tools; the OAuth consent that follows runs under the connecting user's own identity.

Step 1 — Create an OAuth client in Datahub¶

Go to Admin > MCP Governance > OAuth Clients.
Click Create Client.
Give it a name (e.g. "Microsoft Copilot") and a description.
Copy the Client ID and Client Secret — you will need these in the next step.

Step 2 — Assign the Copilot tool policy¶

On the same OAuth client detail page, set the Tool Policy to Copilot — agent meta-tools (copilot.standard).
This policy allows only the 9 agent meta-tools listed above, ensuring Copilot routes through Datahub's intelligence layer.

Step 3 — Connect Copilot to Datahub¶

M365 Agents Toolkit (Declarative Agent)Copilot Studio

Open VS Code with the Microsoft 365 Agents Toolkit extension installed.
Choose Create a new Declarative Agent.
Select Add Action > Start with an MCP server.
Enter your Datahub MCP URL: https://<your-datahub-domain>/mcp
Configure OAuth 2.0 authentication with the Client ID and Client Secret from Step 1.
The toolkit auto-discovers available tools. Select the ask_* meta-tools.
Click Provision and test in the Copilot sidebar.

Open Copilot Studio and create or edit an agent.
Choose Add an action > search for MCP.
Enter the Datahub MCP URL and configure OAuth credentials.
The available tools and their descriptions appear automatically.
Publish the agent to your organisation.

Step 4 — Test¶

Ask Copilot a question like "What is the definition of Customer Churn in our glossary?" and verify it routes through ask_glossary and returns a formatted answer from Datahub.

What users can ask¶

Users interact with Copilot naturally, and the meta-tools handle routing. ask_datahub auto-classifies a question and picks the best specialist; the domain-specific ask_* tools invoke a named agent directly.

flowchart LR
    Q["Natural-language question<br/>in Copilot"] --> PICK{"Which meta-tool?"}
    PICK -->|ask_datahub| AUTO["Auto-classify<br/>pick the best specialist"]
    PICK -->|ask_glossary · ask_catalog · …| DIRECT["Invoke the named agent<br/>bypass the classifier"]
    AUTO --> SPEC(["Specialist agent runs<br/>+ formats the answer"])
    DIRECT --> SPEC
    classDef accent fill:#ff8400,stroke:#e67700,color:#ffffff,font-weight:600;
    class SPEC accent

Figure 3 — Two routing paths converge on the same specialist. ask_datahub lets Datahub classify the question, while a domain-specific tool names the agent up front — either way, one specialist runs and formats the reply.

A user asks…	Routes to
"What glossary terms do we have in the Customer domain?"	`ask_glossary`
"Show me all data assets tagged with PII"	`ask_catalog`
"How is Monthly Active Users calculated?"	`ask_metrics`
"Are there any data contracts in violation?"	`ask_contracts`
"What tasks are assigned to me?"	`ask_tasks`
"Why did the daily ETL flow fail?"	`ask_flows`

Limitations¶

Limitation	What it means
No streaming.	Responses arrive as a single block (not token-by-token), since MCP tool calls are synchronous.
No conversation memory.	Each Copilot tool call is independent — the Datahub agent does not remember prior turns within a Copilot session.
Tool-policy scoping.	The OAuth client can only access tools allowed by its assigned policy; `copilot.standard` limits access to the agent meta-tools.
User identity.	The OAuth flow runs under the consenting user's Datahub identity and roles. Copilot can only access data the user has permission to see.

Troubleshooting¶

Symptom	Cause	Fix
"missing_bearer_token" error	OAuth not configured or token expired	Re-authenticate via the OAuth flow; check client credentials
"token_revoked" error	Admin revoked the OAuth client's tokens	Create new tokens or restore the client in MCP Governance
Tools return "No authentication token available"	JWT context not propagated	Verify the OAuth client is active and the user has the `aimodule.agent.run` role
Empty or generic responses	Tool policy too restrictive	Assign the `copilot.standard` policy to the OAuth client
Copilot doesn't discover tools	MCP URL incorrect or unreachable	Verify `https://<domain>/mcp` is accessible; check `/.well-known/oauth-authorization-server` returns valid JSON