M365 Copilot Connectors

An M365 Copilot Connector is the bridge that connects Microsoft 365 Copilot with data sources outside the Microsoft world. SharePoint, OneDrive, Exchange and Teams are accessible to Copilot out of the box. Everything else (Jira, Confluence, Salesforce, ServiceNow, Notion, Dropbox, Google Drive, Snowflake and dozens more) is reachable for Copilot exclusively through Connectors. Without Connectors, Copilot remains an assisting AI layer on top of MS 365. With Connectors, it becomes a knowledge layer that knows the real operational systems of your company.

1.1 Background · from Graph Connector to Copilot Connector

If you have not heard the term yet, you may know its predecessor: Microsoft Graph Connectors. The concept has existed since 2019 and was originally meant to feed external data into the Microsoft Search index. Since 2025 Microsoft has renamed the term: "Graph Connectors" have become "Microsoft 365 Copilot Connectors", Copilot Connectors for short. The reason: Connectors have long stopped being just a search source. They are the anchor points through which Copilot Chats, Researcher Agent, Pages and (since May 2026) Cowork sessions access external knowledge.

Both terms still appear side by side in the Microsoft documentation. In practice for you: if you read "Graph Connector" in an older guide, it means exactly the same thing.

1.2 The central distinction · Synced vs. Federated

Since May 2026 there are two Connector architectures that you absolutely need to keep apart:

Synced Connectors

Data is indexed from the source system into the Microsoft Graph and kept there. One crawler regularly fetches content, a second one regularly fetches permission updates. When Copilot answers a question, it searches the Graph, not the source system. Synced Connectors are set up once by the tenant admin at org level, after which all authorized users benefit. They are suited for knowledge bases, documentation libraries, ticket histories and anything where volume and search performance matter more than up-to-the-second freshness.

Federated Connectors

Nothing is indexed here. Copilot runs the question against the source system at runtime, via the open Model Context Protocol (MCP). Authentication happens per user with their own identity (OAuth login in the source system), the answer is retrieved live and returned with citations. Federated Connectors are the right choice for CRM pipelines, dynamic roadmaps, sales data, anything that changes hourly or faster and where each person may only see what they can already see anyway.

Self-serve Sync Connectors (Preview)

Since August 2026 Microsoft has been listing a third model in the Connectors documentation, now officially called Self-serve sync connectors. In the Connectors overview they run as a separate configuration variant of the Synced Connectors: Synced connectors, Self-serve configuration, alongside Tenant configuration and the Federated Connectors. The earlier documentation term Personal Sync Connectors is therefore obsolete, although the URL of the documentation page still carries it. The Learn documentation still lists them as a preview for a limited set of customers, but the Message Center is now more specific: according to MC1459140, the public preview runs from late August to mid-September 2026, and GA rolls out worldwide from mid-September to mid-October 2026. Anyone planning a Copilot rollout this autumn should therefore stop treating the third model as a footnote and decide beforehand whether it stays on. Technically they are Synced (the content lands in the Microsoft Graph), organizationally they behave like Federated: each person sets up the Connector themselves, signs in with their own credentials, and only their own content is indexed. The admin enables the Connector in the Admin Center, hides it or disables it, but does not configure it. If a person disconnects or the admin disables the Connector, the index is deleted and synchronization stops.

They exist exclusively as Microsoft-published Connectors, so far for two sources:

Setup does not happen in the Admin Center but by the person themselves in the Microsoft 365 Copilot app or the web client via + → Change data sources. Initial indexing takes 30 minutes to a few hours, after which an incremental sync runs roughly every 15 minutes and a full sync roughly every 7 days. The 7-day review window for admins applies here too before a new personal sync Connector becomes visible to users. Two surfaces are supported so far: Microsoft 365 Copilot Chat and Microsoft 365 Copilot Search. Disconnecting is done via Settings → Sources, which removes the index and stops synchronization immediately. Microsoft has announced further data sources.

1.3 Synced vs. Federated · comparison table

The table contrasts the two main architectures. Self-serve Sync (see 1.2) is a special case of the Synced column: same data model, but user-level setup and user-level scope.

1.4 Connectors vs. Plugins vs. Agents

Three terms that live closely side by side in the Copilot world and are often confused:

• Connectors are data sources. Synced or Federated. They deliver knowledge.
• Plugins (Actions) are actions. They trigger something in the third-party system (create a ticket, book an appointment, update a record). Plugins typically enter Copilot via Power Platform Connectors or Declarative Agents.
• Agents are personas with knowledge, skills and instructions, built for a specific use case. An Agent can use Connectors as knowledge and bind Plugins as skills, but it is neither of the two itself.

1.5 Where Copilot Connectors appear

Connector content appears in different Copilot surfaces depending on type:

• Microsoft 365 Copilot Chat · Synced and Federated, both
• Researcher Agent (Deep Research Mode) · Federated in particular, Synced as background knowledge
• Copilot in Excel · Federated for live data, Synced for master data
• Copilot in Word/PowerPoint/Outlook · Synced, and according to the documentation update of 30 September 2026 now also Federated
• Microsoft 365 Copilot Search · the AI-powered enterprise search in the M365 Copilot app (desktop, web, mobile). Indexed Connector content flows in there without additional setup, including a citation to the original source.
• Microsoft Search (SharePoint Start, Bing for Business) · Synced only

1.6 Copilot Cowork · GA since June 2026

In May 2026 Copilot Cowork started as a Frontier preview, and since 16 June 2026 Cowork has been generally available (GA) for all tenants with an M365 Copilot license (tier 1 languages). Cowork is an environment for long-running multi-step tasks (comparable to Anthropic's Claude Computer Use or OpenAI's Operator). Cowork can consume Synced Connectors as knowledge and address Federated Connectors via MCP. Cowork is off by default, the admin has to enable it. Cowork plugins and Cowork Connector slots apply only within Cowork sessions, not in regular Copilot Chat.

GA brought several points that matter to Connector admins: plugins and skills are now browsed, installed and shared via a consolidated Customize page (instead of separate places), including a guided skill builder; Cowork is fully integrated with Agent 365 (observability, security and governance, which also means emergency disable paths via a central control plane); new is MCP Apps support (Cowork renders interactive UI widgets from the MCP server); and the model lineup moved considerably in September 2026. The picker defaults to Auto, in which case Cowork chooses for you. Manually, the Cowork documentation (as of 14 September 2026) lists GPT 5.5 (Frontier), GPT 5.6 Sol, GPT 5.6 Terra, GPT 6 Astra, Opus 5, Claude Sonnet 5 and Claude Fable 5.1. Opus 5 has replaced Opus 4.8, Fable 5.1 has replaced the earlier preview version Fable 5 (announced on 1 September 2026), and GPT 6 Astra was added on 4 September 2026. Microsoft no longer lists Fable 5.1 as a preview special case, but as a regular option for ambitious work. Cowork bills via usage-based billing (consumption and per-user/per-group limits in the M365 Admin Center) and is available on mobile (iOS and Android) in the Microsoft 365 Copilot app.

Also newly documented is the reasoning effort level next to the model picker: Light, Medium (default), High, Extra High and Max. The level you pick persists until someone changes it, and it is available in Cowork for web, Windows and macOS. For connector projects this is a cost topic, not only a quality topic: a higher level is more thorough, but slower and consumes more credits. According to the documentation, consumption also depends on model choice, context volume, orchestration and the tools used, which means the connectors a task pulls in. If you roll out Cowork with many connected sources, look at the level together with the per-user limits in the admin center.

1.7 Copilot Pages

Pages is the collaborative canvas surface (comparable to Notion or Confluence pages, but inside Copilot). Connectors are integrated into Pages indirectly: when a chat answer cites Connector data, the answer can be carried over into a Page, including source links. There is no separate Connector setup for Pages.

Before we get to setup, it is worth looking at the authentication methods, because they decide who grants which rights to whom and what ultimately happens in the Microsoft Graph or in the source system.

2.1 OAuth 2.0 · the standard

OAuth 2.0 is the default for practically all Connector setups. It works in both worlds (Synced and Federated), though with a different character.

For Synced: The AI Admin registers a Connected App with the source system vendor (Salesforce calls it that, Atlassian calls it "OAuth Integration", ServiceNow calls it "Application Registry"). This app receives a Client ID and Client Secret. The redirect URL must match exactly the value the Admin Center specifies during setup. Permissions in the source system are granted so that the Connector may see everything it is supposed to index (typically read scope on the object area).

For Federated: Here it is not an app identity that authenticates, but each person with their own identity. When the Connector is activated in Copilot Chat, a login pop-up of the source system opens, the person signs in, confirms scopes, done. The token is stored securely in the Microsoft identity platform and reused for every request.

2.2 Service Accounts vs. User OAuth

Synced Connectors need an account in the source system in whose name the crawler runs. There are two options:

• Service Account · Recommended for production. A technical identity without human login, dedicated to the Connector. Advantage: keeps running even if the person who set it up leaves the company. Disadvantage: needs a separate (often paid) license in the source system.
• Personal account · Theoretically possible, risky in practice. If the account is deactivated, the Connector silently falls over.

For the two ServiceNow Connectors (Knowledge and Catalog) there is now a third path, recommended by Microsoft: Federated Auth, also called Federated Identity Credentials in the documentation. Here the Connector authenticates against your ServiceNow instance via OpenID Connect, without a Client Secret having to be stored or rotated anywhere. In practice you create an OIDC provider in ServiceNow with the Microsoft client ID, plus an Integration User of type Machine whose user ID is the service principal object ID of the Microsoft Connector app. The Integration User receives the roles knowledge_admin or catalog_admin plus user_criteria_admin and user_admin. The effort is a one-off of just under an hour, and in return secret handling disappears completely. For new ServiceNow setups this is the recommendation.

Federated Connectors do not need a service account because each person connects themselves. Note that the word "Federated" means something different here than in Federated Connectors: Federated Auth is an authentication method for a Synced Connector, not a Connector type.

2.3 Basic Auth · in decline

Basic Auth (username + password) has been almost completely retired by 2026. Microsoft has removed the option from most Connectors. The few remaining cases: Confluence Cloud can still be authenticated via API token + email, which is technically Basic Auth. Otherwise: if a guide shows a username + password field, it is probably from 2022.

2.4 Model Context Protocol (MCP) · the protocol behind Federated

MCP is an open standard, originally introduced by Anthropic at the end of 2024, that standardizes communication between AI platforms and tools. Microsoft adopted the protocol for Federated Connectors in early 2026. In practice this means: if you register an MCP server in the tenant, you can use it as a Federated Connector without any further Microsoft code path.

Architecturally it looks like this: Copilot is the MCP client. The MCP server (hosted by the source system vendor or self-operated) offers tools (search, read, actions). Copilot calls the tools with the user's permissions, the server responds with data or asks for confirmation.

As of May 2026, Streamable HTTP transport is the only supported MCP transport in Copilot. Stdio and other transports are not allowed for security reasons.

2.5 Microsoft Entra SSO · the clean path for custom MCP

If you want to build your own MCP server to serve as a Federated Connector: Microsoft recommends Entra ID SSO as the auth method. Advantages: no separate user database in the MCP server, Conditional Access applies automatically, audit logs are available in Microsoft Purview, and users do not have to sign in twice.

Alternatively you can use classic OAuth 2.0 with your own authorization server. That is supported but means more operational effort on your side.

This chapter is for tenant admins. End users can skip it but need to know that Connectors do nothing if these steps are not done. Working cleanly here saves you the classic "Copilot can't find our data" later on.

3.1 Who may do what · AI Administrator role

Connector setup requires at least the AI Administrator role (formerly called "Copilot Administrator"). Global Admin works too, of course, but is oversized for pure Connector setup.

In the Microsoft Entra Admin Center under Roles & Admins → All Roles → AI Administrator the role can be assigned specifically to people who should administer only the Copilot area. That is the clean separation from the standard IT admin team.

3.2 License matrix · what costs what

For M365 Copilot Connectors there are essentially three license paths:

In the source system, license costs apply in addition, depending on the tool. More on that in 3.7.

3.3 Tenant prerequisites · Commercial, GCC, GCC-H, DoD

As of May 2026, Copilot Connectors are available in:

• Commercial Cloud · Full scope, all Connectors
• GCC (Government Community Cloud) · Available with restrictions, not all partner Connectors
• GCC High · Microsoft-built Connectors only, restricted catalog
• DoD · Selected Microsoft-built Connectors only

For DACH customers in regulated industries (insurance, health, public sector) it is worth checking the region list before promising a Connector.

3.4 IP firewall whitelist · this is often forgotten

Synced Connectors run from Microsoft data centers against your source system. If the source system sits behind a firewall, the Microsoft IP blocks must be whitelisted. Checked against the documentation on 31 August 2026 and unchanged, per region:

Microsoft maintains the list in the official documentation at learn.microsoft.com/en-us/microsoft-365/copilot/connectors/manage. Check the list against the current documentation before every setup, because it is occasionally extended.

3.5 Navigation in the Admin Center

This is how you find the Connector area:

1. Open admin.microsoft.com in the browser.
2. In the left sidebar, expand the Copilot area via the "Show all" menu.
3. Click Connectors.
4. You see two tabs: Gallery (all available Connectors) and Your Connections (what is already set up).

The Gallery can be filtered by Microsoft-built / partner-built and by category (Collaboration, CRM, Files, ITSM, HR, etc.).

A second place has been part of the picture since August 2026: the tenant-wide baseline, that is whether Microsoft-published and third-party Connectors may appear by default at all, sits under Agents → Settings → Allowed agent types. The Connectors area under Copilot remains the place for the individual connection, Allowed agent types is the place for the fundamental decision. Why it came to this and what it means for existing PowerShell scripts is covered in chapter 5.4.

3.6 Connector Checker · the diagnostic tool

In February 2026 Microsoft built the Connector Checker into the Admin Center navigation. It checks per Connector:

• Connection status to the source system
• Last crawl time (full and incremental)
• How many items were indexed
• Permission mapping status (are there users whose UPN cannot be found)
• IP whitelist reachability

When you get a bug report from the business ("Copilot can't find the Confluence doc"), the Connector Checker is the first stop before a Microsoft support ticket.

New since the release of 23 September 2026: According to the release notes (roadmap ID 502529), connector admins get pre-setup guides in the admin center that list the configuration steps before deployment, can edit settings after setup and receive actionable error messages with alerting. In practice: before every new Connector, walk through the pre-setup guide first (service account, permissions, firewall), and route alerts to a mailbox or group that someone actually reads. One exception remains: changed schema property values such as the AccessURL for ServiceNow can, according to the deployment docs, still only be set in a new connection.

3.7 Connector licenses in the source system · the common stumbling block

Microsoft itself licenses the Connector function via the M365 Copilot add-on. But the source system additionally needs an identity in whose name the crawler works, and that identity usually costs extra.

• Salesforce · Recommended is an API-only Integration User. Salesforce requires a separate license for it, depending on the edition level. Often included with Enterprise/Unlimited edition, an add-on for smaller editions.
• ServiceNow · An Integration User with the itil role (or narrower) is required. ServiceNow typically offers free integration licenses for this, but it has to be in the contract.
• Atlassian (Jira/Confluence Cloud) · A Service Account with its own Atlassian license, same price as a regular user seat.
• HubSpot · The account must be at least on the Professional tier so that all properties are accessible via API.

3.8 Staged Rollout · not tenant-wide right away

With every Connector setup you can enable a Staged Rollout to Entra groups in the custom settings. Recommendation: first a test group (10 to 30 people from power user teams), then roll out after 1 to 2 weeks with feedback, then two further waves.

This is how you create a Synced Connector in the M365 Admin Center. The eight steps are identical for Microsoft-built Synced Connectors, only the detail fields differ per Connector type. Afterwards we show three concrete end-to-end walkthroughs (Jira Cloud, Confluence Cloud, Salesforce).

4.1 The 8-step standard process

1. Sign in as AI Administrator at admin.microsoft.com.
2. Navigation: Sidebar → Copilot → Connectors → tab Gallery.
3. Choose Connector. Click the tile of the desired tool (e.g. Jira Cloud).
4. Set display name. Shown later in Copilot as the source label. Name it sensibly if you have multiple instances ("Jira Prod", "Jira Legacy").
5. Enter instance URL. The base URL of the source system (e.g. https://yourorg.atlassian.net).
6. Choose authentication. OAuth (Connected App in the source system), service account, or API token, depending on the Connector. Insert credentials.
7. Staged Rollout (optional). Select the Entra group(s) for which the Connector goes live. Default is tenant-wide.
8. Create. Microsoft validates the connection and starts the initial crawl. For large source systems (>100k items) this can take hours to 1 to 2 days.

4.2 Custom setup tabs · the fine-tuning

After Create you land in the Connector's detail view. Three tabs matter:

Users tab · who may see what

Here you configure the permission model:

• Access Permissions: Two options.
  • Everyone · All tenant users may see all indexed items. Convenient but weak on compliance. Only sensible for public wikis or marketing material.
  • Only people with access · ACLs from the source system are indexed alongside. Copilot shows a person only the items they may also see in the source system. Default and the right choice in 95% of all cases.
• Map Identities: How does Copilot link the Microsoft user (Entra UPN) with the user record in the source system? Default is UPN-to-email. If your source system uses an identity other than email (e.g. Salesforce username, ServiceNow user ID), you have to map manually here.

Content tab · which fields are indexed and how

• Properties: Every field in the source system (Subject, Description, Status, Created-By, Tags, Custom Fields…) has four optional flags.
  • search · full-text search index
  • query · filterable (e.g. Status = Open)
  • retrieve · content is shown in the Copilot answer
  • refine · facet filter in the Microsoft Search UI
• Semantic Labels: Microsoft standard labels (Title, Author, CreatedDateTime, ModifiedDateTime, ContainerWebUrl, …) are mapped to your source properties. Important because Copilot works semantically via these labels, not via the raw source property names.
• Default Expressions: Appearance of the search result in the Microsoft Search UI (title, icon, snippet, URL).

Sync tab · when crawling happens

• Full Crawl: Default is daily. Re-indexes everything, removes deleted content and recalculates all permissions. Can be set manually per tenant to hours or weeks.
• Incremental Crawl: Default is every 15 minutes. Fetches changes only. The distinction is finer than it is often presented: incremental does recalculate the permissions of changed items, including permission changes at item level. What incremental does not touch are identities and group memberships (for ServiceNow the assignment of users to User Criteria) as well as items whose permissions changed only at the parent level, for instance on the Knowledge Base rather than the article. Exactly these two cases need a full crawl.

4.3 Crawl strategy · the ACL trap

4.4 End-to-end walkthrough: Jira Cloud

1. In Atlassian: Log in as org admin, id.atlassian.com → Apps → OAuth 2.0 (3LO) → Create new app. App name: "M365 Copilot Sync".
2. Permissions: Add the scopes read:jira-work, read:jira-user, read:project:jira, read:issue:jira.
3. Callback URL: Copy from the Microsoft Admin Center (later, step 5b). The format is https://gcs.office.com/v1.0/admin/oauth/callback.
4. Client ID + Secret: Atlassian shows both after saving, copy both into a secure store.
5. In the Admin Center: Gallery → Jira Cloud → display name "Jira Production" → instance URL https://yourorg.atlassian.net → insert OAuth keys.
6. Project filter: If you do not want to index all projects, specify a JQL filter in the custom setup under the Content tab (e.g. project IN ("CRM", "SALES")).
7. Permission model: Users tab → "Only people with access", Map Identities to Atlassian email.
8. Click Create. The initial crawl starts, status runs in the Connector Checker.

4.5 End-to-end walkthrough: Confluence Cloud

1. Auth: Confluence Cloud supports OAuth 2.0 or API token (Basic). We recommend OAuth.
2. Atlassian setup: As with Jira (4.4), but with the scopes read:confluence-content.all, read:confluence-space.summary, read:user:confluence.
3. Space filter: In the Admin Center, restrict spaces during setup if needed (entered as a comma-separated list of space keys, e.g. SALES,HR,ENG).
4. Permission model trap: Confluence does not automatically inherit page permissions downwards. If a page is write-protected, the child pages may be open. The Connector indexes exactly the source permission model, so it can happen that Copilot shows child pages that a user would also find via the browser, just less prominently. Check this on a sample before the production rollout.

4.6 End-to-end walkthrough: Salesforce CRM

1. In Salesforce: Setup → App Manager → New Connected App. Name: "M365 Copilot Sync". OAuth settings: Enable OAuth, callback URL from the Admin Center, selected OAuth scopes: api, refresh_token, offline_access.
2. Service account: Create an API-only Integration User in Salesforce. Profile: minimal read on all object types Copilot is supposed to see (typically: Accounts, Contacts, Opportunities, Cases, Knowledge articles). License as described in 3.7.
3. In the Admin Center: Gallery → Salesforce → display name, instance URL (e.g. https://yourorg.my.salesforce.com), Client ID + Secret from the Connected App.
4. Content tab: Which Salesforce objects should go in? The default suggests Accounts, Contacts, Opportunities, Cases. Add custom objects manually if relevant. Flag properties per object (Name = search+retrieve, AccountId = query, etc.).
5. Identity mapping: UPN-to-Salesforce-email by default. If your Salesforce has its own user login (no Microsoft SSO), map manually.
6. Crawl frequency: For Salesforce we recommend full daily, incremental every 15 minutes.

4.7 Most common setup errors

• UPN mismatch: If the Microsoft UPN does not match the email in the source system (e.g. a person has an @xyz.onmicrosoft.com UPN in MS but @xyz.de in Salesforce), they see nothing in Copilot. Configure manual mapping in the Users tab.
• Schema change not possible: If you want to add properties after the initial crawl, you have to recreate the Connector. There is no schema edit path. Plan the mapping cleanly beforehand.
• IP whitelisting forgotten: Connector shows "Connection failed" in the Checker. Solution in 3.4.
• Service account license missing: Crawler fails with 401 or 403. Solution in 3.7.

Federated Connectors have been generally available since 2 June 2026 (GA), after starting as the first wave in May. They differ fundamentally from Synced in three respects: no indexing, user-level auth, live retrieval at runtime. For use cases where same-day freshness and real time matter more than volume, Federated is the right architecture.

5.1 What Federated does differently

• No index: Nothing is stored in the Microsoft Graph. Every request goes live to the source MCP server.
• User-level auth: Each person connects themselves via OAuth in the source system. Their permissions are checked at runtime.
• MCP protocol: Instead of Microsoft's proprietary Connector API, Copilot speaks Model Context Protocol with the source system.
• Surface restriction: Federated data does not appear everywhere Synced shows up. Since the documentation update of 30 September 2026 Microsoft lists these surfaces: Microsoft 365 Copilot Chat, Agents, Cowork, Copilot in Word, Excel, PowerPoint and Outlook, and the Researcher Agent. Microsoft Search and SharePoint Start remain Synced-only.

5.2 The Federated Connectors Gallery (178 entries, as of 30 September 2026)

Entries are either Microsoft-published or submitted by partners and reviewed by Microsoft. In the release notes of 23 September 2026 Microsoft lists Federated Copilot Connectors as a rolled-out feature (roadmap ID 501120). With the documentation update of 30 September 2026 the Gallery then almost doubled: from 94 to 178 entries. At the same time Microsoft recut the categories again, there are now sixteen. The current, categorized overview:

What this wave added. 93 new entries plus five renames. The clusters that matter most for the mid-market:

• Project and collaboration standards · Asana, monday.com, Smartsheet, Airtable, Miro, Trello, Make and Gmail. For the first time the Gallery includes the PM and whiteboard tools that run alongside Microsoft 365 in many teams. With awork there is also a German PM tool from Hamburg.
• Documents and content · Egnyte, PandaDoc, TextMine, Gamma, SlidesGPT, Fireflies, Goodnotes and GoLinks.
• Finance · D&B Finance Analytics, D&B Risk Analytics, Morningstar Credit Analytics, MT Newswires, Quartr, S&P Kensho, PrivCo, Fiscal.ai, Square and Zoho Books.
• Legal and HR · Litera, Relativity, NetDocuments US, LegalZoom, Midpage Legal Research, Teamtailor and SeekOut. Legal and HR now share one category.
• Research, analytics and learning · IBISWorld, EIU, Mixpanel, Contentsquare, Dovetail, Ask Rystad and Tastewise, plus learning sources such as Articulate, Articulate EU, Learn365, Padlet and Siemens.
• Health, life sciences and reference · BioRender, DrugBank, ChEMBL, Cortellis Regulatory Intelligence, FDA Safety (openFDA), ICD-10 Diagnosis Codes and more. Mostly US registries and specialist databases, so for German hospitals and pharma customers more of a research tool than a primary source.

For DACH SMEs, HubSpot (live CRM), Notion (wiki), Linear (PM roadmaps), Intercom (support) and Canva (design assets) are usually the first candidates, since 30 September 2026 also Asana, monday.com, Smartsheet, Miro and Trello, plus the finance sources (LSEG, Moody's, Morningstar, FactSet, S&P Kensho) for investment and consulting firms. Immediately usable in the mid-market are Klardaten DATEV-Connector (tax and accounting data from DATEV live in Copilot, the first truly DACH-specific entry in the Gallery), awork, Statista and DeepL MCP. With Articulate EU a second provider follows the Harvey pattern of a dedicated EU variant. Current status: learn.microsoft.com/en-us/microsoft-365/copilot/connectors/federated-connectors-overview.

5.3 Admin setup · 7-day review window

Microsoft has built a 7-day review window into Federated Connectors: when a new Microsoft-published Federated Connector appears in the tenant, for the first seven days it is visible to AI Admins only. End users do not see it yet. This gives the admin team time to review it, block it or enable it selectively.

Settings in the Admin Center:

• Enable / Disable per Connector: Switch each Connector on or off tenant-wide individually. The default for Microsoft-published is "automatically on after 7 days".
• Staged Rollout: In the Staged Rollout column, use Add staging to set one or more Entra ID groups for which the Connector becomes visible. Everyone else does not see it.
• Tenant-wide baseline: Whether Microsoft-published and third-party Connectors appear by default at all has depended since August 2026 on the Allowed agent types setting in Agent 365. It also applies to Connectors published in the future. Details in 5.4.

5.4 Tenant-wide bulk disable · the governance path changes

The new path: Allowed agent types in Agent 365

You now set the tenant-wide baseline in the Agent 365 surface of the Admin Center:

admin.microsoft.com → Agents → Settings → Allowed agent types

There are three switches there that together determine what appears in the catalog at all:

• Allow apps and agents built by Microsoft · covers the Microsoft-published Federated Connectors.
• Allow apps and agents built by your organization · covers your own Connectors and Agents published in the tenant.
• Allow apps and agents built by external publishers · covers the partner Connectors, i.e. everything submitted by third parties and approved by Microsoft.

If you remove the Microsoft-published and the third-party option, Federated Connectors are no longer active by default in the tenant, including ones published in the future. You then enable each Connector individually in the Admin Center. That is exactly the behavior the PowerShell toggle used to deliver, just in the UI and together with Agent governance.

What technically happens when you switch off

Since the documentation update of 27 August 2026 Microsoft also describes the mechanics behind it, and for operational practice they matter more than the switch itself. If you disable the agent type the Copilot Connectors use, the Connectors do not disappear from the tenant:

• End users lose access immediately. The Connectors are no longer available in Copilot.
• Admins still see everything. Existing Connectors remain visible in the Admin Center so that management and governance remain possible.
• The user scope is automatically set to No users. The Connector is not removed, its allowed-user scope is pulled to zero. That is the actual lever.

This yields the re-enable path for individual sources: you open the settings of the respective Connector and set its allowed-user scope to the desired people or groups. The tenant-wide block remains in place. For regulated environments this is the clean state: globally closed, selectively reopened with documentation.

The old path, as long as it still holds

For completeness, because it is still in many runbooks: Microsoft provides a dedicated PowerShell module Connector.Cmd (version 2.1 or higher) for this. The prerequisite is the Global Administrator or Search Administrator role. Invocation:

# Install the module once (version 2.1 or higher)
Install-Module Connector.Cmd

# Set the toggle: shows the current state and prompts for Enable/Disable
Set-FederatedConnectorToggle

The cmdlet interactively asks for authentication, shows the current state of the toggle and then lets you choose between Disable (all Federated Connectors off) and Enable (default behavior). As long as it still responds, a second call without changes is the easiest way to read the current state. But do not build new automation on it anymore.

You can specifically re-enable individual Connectors despite an active global disable, directly in the Admin Center. That is the recommended path for regulated environments: globally off, then deliberately enabled Connector by Connector.

5.5 End-user experience · what a Federated Connector feels like

From the end user's perspective, the Federated flow looks like this:

1. Open Copilot Chat. At m365.cloud.microsoft.com or in the Teams or Outlook sidebar.
2. Select Researcher Agent (in the mode selector) or activate the Deep Research mode.
3. Open the Sources menu. By default Web, Files, Mail. Add further sources via the plus icon.
4. Select e.g. "HubSpot". The first time, an OAuth pop-up opens, log in to the source system, confirm permissions.
5. Ask a question: "What does my pipeline for Q2 in DACH look like? Compare with Q1." Copilot calls the HubSpot MCP server live and writes the answer with citations.

The OAuth connection is stored per user, next time it is one click.

5.6 Where Federated Connectors work (surface list)

• Copilot Chat · always
• Researcher Agent / Deep Research Mode · main consumer, multi-source answers, stays read-only even with the write actions from 5.7
• Copilot in Excel · Federated Connectors as a selectable data source in the workbook, not as a formula function
• Copilot in Word, PowerPoint and Outlook · new in the documentation update of 30 September 2026
• Agents · also newly documented, so Federated Connectors are available in agents too
• Cowork sessions (GA since June 2026) · yes, with its own Cowork plugin list
• Not in Microsoft Search / SharePoint Start (that is Synced only)

What actually lands in Excel is now documented separately. Microsoft maintains a dedicated list of the Federated Connectors usable in Copilot in Excel, and it is shorter than the gallery in 5.2. As a first tier the support documentation names Canva, CB Insights, Daloopa, FactSet, Google Calendar, Google Contacts, HubSpot, Intercom, Linear, LSEG, Moody's, Morningstar, Notion, PitchBook and S&P Global. Below that sits a second tier of further sources, among them Article Galaxy, Autodesk, Blockscout, BoardWise, Clarify, Clarity AI, Cloudinary, Context7, Customer.io, Dice, Excalidraw, Fellow.ai, Fitch Solutions, Forrester, GoDaddy, Grain, GraphOS MCP Tools, Harvey, HG Insights, Hugging Face, Infor Nexus Digital Assistant, Jam, Kindora Funder Discovery, Legal Data Hunter, MailerLite, Malwarebytes, Microsoft Learn, NyquistAI, pg-aiguide, Polar Analytics, Pulse by PassBy, Sight Machine, Sprouts Data Intelligence, Taskrabbit Booking Assistance, Wolfram and ZipRecruiter. A commercial Copilot subscription is required, every person has to consent to the connection explicitly, and the admin approval from 5.3 applies here just the same. For finance, controlling and research teams this makes Excel the most important place, next to the Researcher agent, where Federated Connectors actually arrive. Check the list before you commit to anything: support.microsoft.com/excel/copilot/copilot-in-excel-data-sources. As of 30 September 2026 the Excel page still names Daloopa, PitchBook, S&P Global, Blockscout, Forrester, Infor Nexus Digital Assistant and Sight Machine, which no longer appear in the Learn overview from 5.2. Test these sources in your own tenant before promising them to teams.

5.7 Write actions · Write, Update and Delete from October 2026

Until now Federated Connectors were read-only. With MC1476316 of 22 September 2026 Microsoft announces that Copilot can also create, change and delete data in the source system via Federated Connectors, provided the vendor ships the matching MCP tools. The rollout runs worldwide from early to late October 2026. Examples from the docs: turn an escalation email into an issue in a project tool, update a CRM record or comment on a ticket, straight from Copilot Chat.

• Own permissions: Actions run with the user's permissions in the third-party system. Copilot can only change what the user is already allowed to change there.
• No extra switch: Write, update and delete tools are part of the Connector and are not enabled separately. Whoever enables a Connector also enables its write tools.
• Researcher stays read-only: In the Researcher Agent, Federated Connectors do not perform write actions.
• Data egress: Write actions export customer data to the connected system. While a confirmation is pending, nothing is sent.

Approvals apply per tool, not per Connector. Under Settings → Sources every user sees a Connector's tools split into Read tools (always allowed) and Write/Delete tools (default Needs approval) and can revoke an "Always allow" there. If the vendor adds a new write tool or changes one, it automatically goes back to Needs approval.

As of May 2026, more than 100 Microsoft-built Connectors are available, plus dozens of partner-built ones. In the February 2026 GA wave alone, Microsoft put 35 new Synced Connectors live. We proceed in three stages: first Microsoft-built by category, then partners, then Federated.

6.1 Microsoft-built Synced Connectors (100+, as of August 2026)

Categorized as in the Microsoft Gallery, which was last updated on 20 August 2026. All entries are reachable via the Admin Center under Gallery. Connectors marked Preview require the Targeted release option on the admin account, otherwise they do not show up in the Gallery at all.

A reading aid for the documentation: Microsoft now mixes both architectures in the Microsoft-built Gallery. Entries such as HubSpot, Notion or Linear are partly listed there as Preview with a reference to the Federated documentation, and a collective category Others lists pure Federated Connectors (Canva, Google Calendar, Google Contacts, HubSpot, Intercom, Linear, LSEG, Moody's, Notion). So whenever you see a name in the Gallery, always check whether Synced or Federated sits behind it. The architecture determines setup, auth and cost, not the name.

Collaboration & Productivity

• Aha! · Roadmaps, Ideas, Features
• Azure DevOps · Work Items, Repos, Pipelines
• Jira Cloud · Issues, Projects, Workflows (Cloud only)
• Jira Data Center · on-prem variant
• Linear · Issues, Projects (also Federated, see 5.2)
• Miro · Boards, Frames, Content
• Notion · Pages, databases (also Federated)
• Shortcut · Stories, Epics, Iterations
• Trello · Boards, Lists, Cards
• Zoom · Meetings, Recordings, Transcripts
• Egnyte · content platform, files and workflows

Content Management & Knowledge

• Confluence Cloud · Spaces, Pages, Comments
• Confluence Server / Data Center · on-prem variant
• Coda · Docs, Tables, Views
• Adobe Experience Manager Assets · published assets from AEM (Preview)
• Adobe Experience Manager Sites · published web content from AEM (Preview)
• Enterprise Websites Cloud · index any non-SharePoint websites
• Enterprise Websites On-premises · the same for internal websites behind the firewall
• Guru · Knowledge Cards
• MediaWiki · content from MediaWiki installations
• Salesforce Knowledge · knowledge articles from Salesforce, separate Connector alongside Salesforce CRM
• ServiceNow Knowledge · knowledge articles from the ServiceNow KB
• Unily · intranet and digital workplace content
• WordPress.com · hosted WordPress sites
• WordPress.org · self-hosted WordPress installations
• SharePoint Server · on-prem SharePoint (not to be confused with SharePoint Online, which is native in the Graph)
• Stack Overflow for Teams · Q&A content
• Veeva QualityDocs · quality documents from Veeva Vault
• Veeva Vault PromoMats · approved promotional and regulatory content incl. approval status and version history
• Veeva Vault RIM · Regulatory Information Management

CRM

• HubSpot · Contacts, Companies, Deals, Tickets (also Federated)
• Salesforce CRM · Accounts, Contacts, Opportunities, Cases, Knowledge

Databases

• Azure SQL · Microsoft's own cloud SQL
• Microsoft SQL Server · on-prem
• Oracle Database · via Tabular Connector
• PostgreSQL · standard OSS (Preview)
• Airtable · Bases, Tables, Records (Preview)
• DataStax · real-time data access to Cassandra workloads (Preview)
• CSV · index content from CSV files

Developer Tools

• Bitbucket · Atlassian code hosting
• GitHub · Repos, Issues, Discussions (GitHub Cloud)
• GitHub Server · self-hosted GitHub Enterprise Server, Issues, Pull Requests, Knowledge (new July 2026)
• GitLab · self-hosted and SaaS

Files & Storage

• Amazon S3 · index bucket content
• Azure Data Lake Storage · Gen2
• Dropbox · files and folders
• Google Drive · files (mirrored, not to be confused with the Federated Google Drive)
• Azure File Share · content from Azure file shares
• File Share · classic on-premises Windows file shares, the mid-market classic

HR

• BambooHR · employees, absences, documents
• Workday · HCM data
• SAP SuccessFactors · enterprise HR
• 15Five Priorities · OKRs and team priorities from 15Five (new June 2026, currently Preview)
• 15Five High Fives · recognition and kudos from 15Five (new June 2026, currently Preview)
• Credly · digital certificates and badges of the workforce (Preview)

IT Service Management

• Freshservice · Tickets, Knowledge
• PagerDuty · Incidents, Schedules, Services
• ServiceNow Catalog · service catalog items
• ServiceNow Tickets · Incident, Change, Problem

Project Management

• Asana · Tasks, Projects
• monday.com · Boards, Items, Updates
• Smartsheet · Sheets, Rows

Data Visualization

• Tableau Cloud · dashboards and BI content from Tableau Cloud (Preview). So far the only data source in this category.

Sales & Customer Engagement

• Gong · call recordings, transcripts

Support

• Zendesk Help Center · self-service knowledge base
• Zendesk Ticket · tickets from the Zendesk service desk (Preview)

6.2 Partner-built Synced Connectors

Microsoft curates a growing ecosystem of third-party Connectors. The most important ones:

• BA Insight (part of Upland) · >40 Connectors, including Documentum, FileNet, ECM systems, very strong in the enterprise content space
• RheinInsights · >20 Connectors, often DACH-specific, good Confluence and Jira extensions
• ServiceNow Connectors Suite · >15 ServiceNow-specific modules
• Accenture Aspire · >25 Connectors, often for large enterprise environments with custom backends

6.3 Certified for Microsoft 365 Copilot · the premium label

In 2026 Microsoft introduced a seal of approval: "Certified for Microsoft 365 Copilot". It is awarded after manual review, and with it Microsoft confirms enterprise readiness and consistent retrieval behavior across Copilot and Microsoft Search. As of 7 September 2026, still only three partner Connectors carry it:

• Box
• CB Insights
• getAbstract

The seal is displayed in the Admin Center next to the Connector tile.

New and easy to confuse: Since the Gallery update of 1 September 2026, Box appears twice in the catalog. Once as a certified partner Connector in the Synced architecture (indexes Box content into the Microsoft Graph), and once as a Microsoft-published Federated Connector under Files & Documents (reads files and folders live). Both can sit side by side in the same tenant. Decide deliberately for one of the two variants, otherwise you produce exactly the duplication effect we describe in 8.1 as a common practical error. The certificate applies only to the Synced variant.

6.4 Federated Connectors (178 entries, as of 30 September 2026)

See chapter 5.2 for the full, categorized list.

6.5 What matters for SMEs and DACH

If you set up tenants in German-speaking mid-market environments, the following Connectors are almost always part of the picture:

Microsoft maintains the complete official list at learn.microsoft.com/en-us/microsoft-365/copilot/connectors/connectors-gallery.

If a source system exists neither as a Microsoft-built nor as a partner Connector, you can build it yourself. There are two paths: Custom Synced (Graph Connectors API) or Custom Federated (your own MCP server). Which one is right depends on whether you want to index data or query it live.

7.1 Custom Synced Connector · Graph Connectors API

The classic way to pump your own data into the Microsoft Graph:

1. App registration in Entra ID. Register the app in the Entra Admin Center, add the application permissions ExternalConnection.ReadWrite.OwnedBy and ExternalItem.ReadWrite.OwnedBy, grant admin consent.
2. Schema definition. Define in code: which properties does an item have? Which are searchable, queryable, retrievable, refinable? Which semantic labels apply? The schema is uploaded once and is immutable afterwards.
3. Create the connection. Create an ExternalConnection via the Microsoft Graph API. ID, name, description.
4. Push items. One update call per item. Content + properties + ACLs. ACLs are mandatory, otherwise the item is not accessible.
5. Adaptive Cards rendering. If you want to display the results with a custom UI in Microsoft Search, supply an Adaptive Card for the item layout.

The Microsoft Teams Toolkit / Agents Toolkit (in VS Code) has a template that turns most of these steps into a click-through setup. Hands-on tutorial: learn.microsoft.com/en-us/microsoft-365/copilot/connectors/build-tutorial.

7.2 Custom Federated Connector · your own MCP server

If your source system is to be queried live, you build an MCP server and attach it to your own tenant as a Connector. Microsoft has now documented this path concretely, and it does not run through a wizard in Copilot Studio but through the Teams Developer Portal plus the M365 Admin Center.

Prerequisites

• MCP server with read-only tools at a reachable URL, typically search, fetch or query. For Copilot, Streamable HTTP transport is mandatory (see 2.4).
• Roles: Global Administrator or AI Administrator in the M365 Admin Center, plus a suitable Entra admin role if you set up SSO, and access to the Teams Developer Portal.
• Formalities that are requested: developer or company name, website URL with the documentation for the MCP server, link to the privacy policy and link to the terms of use. Without these four details you will not get through the form.

Step 1 · Choose and register authentication

Custom Federated Connectors support exactly three methods:

For OAuth 2.0, enter the following as the allowed redirect URI in the source system:

https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect

Then, in the Teams Developer Portal under Tools → OAuth Client Registration → New OAuth connection, you create the connection: name, Client ID, Client Secret, authorization, token and refresh endpoints as well as the scopes. PKCE can optionally be enabled if your provider supports it, and should be on when in doubt. At the end the portal generates a registration ID, for SSO the Entra SSO registration ID, for OAuth the OAuth client registration ID. You will need it in a moment, so copy it away.

Step 2 · Create the Connector in the Admin Center

admin.microsoft.com → Copilot → Connectors → Gallery
  → Created by your org → Create a new connector → Add
  → Connect to MCP server → Add

There you enter three things: Display name (the name users will see later, e.g. "Company intranet"), Base URL (the MCP endpoint, e.g. https://mcp.example.com) and the registration ID from step 1. Saving creates the Connector.

Step 3 · Roll out and manage

The finished Connector appears in Your Connections. From there:

• Staged rollout: Select the Connector, Staged rollout, then Users or Groups and enter the test users. Once it holds up, Deploy to all users.
• Enable releases the Connector to its target group, Disable pauses it and keeps the configuration, Delete permanently removes the Connector and its configuration.

The server side remains your responsibility: tools with clean JSON schema definitions, hosting according to your compliance situation (Azure App Service, containers, on-prem) and the SDKs from github.com/modelcontextprotocol.

7.3 When to choose what

7.4 Ecosystem reality June 2026

Dynamic Tooling · a fixed part of the documentation since August 2026. For MCP-based Federated Connectors (Microsoft-published and custom), Microsoft rolled out Dynamic Tool Discovery in July 2026 (for MCP-based Declarative Agents already since late June) and now describes it as a regular feature under the name Dynamic Tooling. It allows the tools provided by the MCP server to be updated at runtime without republishing the Connector. Copilot itself selects at runtime which of the server's tools it needs for a request, for instance knowledge search, record lookup, project or status query. The identity and rights of the signed-in person in the source system remain decisive. This noticeably reduces the maintenance effort for changing tool sets.

7.5 Getting your own MCP server into the Gallery · the partner program

The path from 7.2 publishes a custom Federated Connector only within your own tenant. Software vendors who want to offer their MCP server to all Copilot customers go through the partner submission program. For most SME projects this is not relevant, but for product teams with their own SaaS it is the decisive channel.

Two hard prerequisites upfront: it requires active support from a Microsoft business development contact and a signed contract that allows Microsoft to use the MCP server in Copilot. Without both, the submission does not start.

The technical requirements for the server:

• Read-only tools only. Microsoft activates only tools that search and retrieve. Every tool must carry the readOnlyHint annotation, otherwise it is not enabled in the Gallery.
• Public HTTPS endpoint for the MCP server, e.g. https://mcp.example.com/mcp.
• OAuth 2.0 for all authenticated scenarios, with an OAuth reference ID from the Microsoft registration.
• Metadata and assets: display name, short description of at most 80 characters, up to 10 synonyms, logo as a 192x192 color PNG and a 32x32 outline PNG, complete tool list, documentation and support links, test credentials and at least three sample prompts with expected answers.

Submission is via the Federated Copilot Connector form, questions go through submit-fcc@microsoft.com. Microsoft accepts submissions on a rolling basis, and the review time depends on volume and the completeness of the documents. Interim states are not actively reported, status runs via the Microsoft contact.

Since August 2026 the following also applies to ISVs: there is one shared Connector manifest and one shared publishing pipeline for all Connector types. So anyone who has already submitted a Synced Connector no longer goes through a second, separate process for the Federated Connector.

Full requirements: learn.microsoft.com/en-us/microsoft-365/copilot/connectors/submit-federated-connector.

7.6 Alternative · buy a partner Connector

If you do not want to build anything yourself but no native Connector exists, it is worth looking at partners: RheinInsights and BA Insight each have more than 20 specialist Connectors in their program, mostly with DACH-relevant backends. Cost structure and support model are cleanly documented, and responsibility lies with the partner.

7.7 Helpful resources

• Connectors documentation hub: learn.microsoft.com/en-us/microsoft-365/copilot/connectors/
• Graph Connectors API reference: learn.microsoft.com/en-us/graph/api/resources/externalconnectors-overview
• MCP specification: modelcontextprotocol.io
• Work IQ Dev Tools (wiqd, Preview): terminal tools for building, checking, packaging and publishing Copilot extensions. Since August 2026 Microsoft has displayed the notice above all Connectors documentation pages, but explicitly marks the tools as experimental and not production-ready, with breaking changes announced. So nothing for customer projects yet, but fine for trying out: aka.ms/wiqd/docs
• Microsoft build tutorial: developer.microsoft.com/en-us/microsoft-365/copilot
• Field report from the Microsoft 365 Copilot Blog (23 July 2026) on how a custom Connector was scaled to one million documents and more than 300 agents: techcommunity.microsoft.com · Microsoft 365 Copilot Blog

The most common stumbling blocks from everyday Connector work, the diagnostic tools and the sources that keep you up to date.

8.1 Top 10 stumbling blocks

1. UPN mismatch in permission mapping. The Microsoft user has name@company.onmicrosoft.com, the source system knows them as name@company.de. Copilot sees no permissions. Solution: manual identity mapping in the Users tab.
2. Service account license missing in the source system. The crawler gets 401 or 403. Solution in 3.7.
3. ACL drift with incremental only. Permission changes only arrive with the next full crawl. Solution: full crawl at least daily.
4. Custom URL expressions wrong. The default expression in the Content tab generates a link that is not clickable or leads nowhere. Solution: compare the expression template with the source system documentation.
5. IP whitelisting forgotten. Connector shows "Connection failed". Solution in 3.4.
6. Confluence parent page permissions were not inherited. Child pages appeared even though the parent page was protected. Since 15 July 2026 Microsoft solves this with Nested Permissions (see the box below). In older connections that have not yet been switched over, the effect persists, and the only remedy there is to rethink the permission model and, if necessary, cut spaces more strictly.
7. Schema change not possible after setup. Anyone who wants to add properties in the Content tab has to recreate the Connector completely. Plan cleanly beforehand.
8. Synced and Federated in parallel confuse end users. If both are set up (e.g. HubSpot Synced for knowledge articles, HubSpot Federated for the deal pipeline), Copilot may show different answers depending on the mode. Solution: clear internal documentation on "when Researcher Agent, when standard chat".
9. Roles in the source system too weak. The service account in ServiceNow has oauth_user but not itil, so no incidents. Check roles per module.
10. Default crawl schedule too long. Anyone who leaves the default setup is fine with the daily full crawl, but an incremental of 4 hours is too slow for dynamic source systems. Set it to 15 minutes.

8.2 Connector Checker · first-response tool

As soon as any Connector acts up: Admin Center → Copilot → Connectors → Connector Checker. Shows per Connector: connectivity, last sync, permission mapping status, IP reachability. 80% of bug reports are already answered here before you open a Microsoft ticket. Note: in the first wave (February 2026) the Connector Checker covered only the ServiceNow KB Connector, further Connectors are being added step by step.

8.3 Connectors Usage Report · GA wave in progress

Since June 2026 there has been a new Connectors Usage Report in the Microsoft 365 Admin Center. According to MC1404326, the public preview ran from late June to early July 2026, and GA rolls out worldwide from early to mid-September 2026. So in most tenants the report has just left preview. It shows how heavily Connectors are actually used and delivers three views:

• Overall connector activity · total activity across all Connectors.
• Connector-powered response patterns · how often Connector data flows into Copilot answers, over time.
• User-level connector adoption · which users use Connectors and how intensively.

The report covers all platforms (web, desktop, Mac, iOS, Android) and is the natural complement to the Connector Checker: the Checker answers "does the Connector work?", the Usage Report "is it actually used?".

admin.microsoft.com → Reporting → Usage → Microsoft 365 Copilot → Connectors

The report is active by default, respects existing permissions and needs no preparation. Two points that regularly raise questions in projects: it requires a Microsoft 365 Copilot (Premium) license, and the evaluation by individual person is subject to co-determination. In Germany, clarify the use of the user-level view with the works council before using it for adoption reporting.

8.4 Staying current · three-source routine

1. Microsoft 365 Roadmap. microsoft.com/microsoft-365/roadmap. Set the filter to "Microsoft 365 Copilot", status "In Development" and "Rolling Out". Worth a weekly 5-minute check.
2. Tech Community Blog · What's New in Copilot. techcommunity.microsoft.com/category/microsoft365copilot. Monthly update, new Connectors, GA waves, feature presentations.
3. Microsoft Learn · Release Notes. learn.microsoft.com/en-us/microsoft-365/copilot/release-notes. Official status on features, GA dates, license prerequisites. Note for old bookmarks: the former address /copilot/whats-new has returned a 404 since September 2026, the Release Notes are the successor. Cowork has its own page: learn.microsoft.com/en-us/microsoft-365/copilot/cowork/whats-new.

8.5 Delimitation · what Cowork does with Connectors

Copilot Cowork (GA since 16 June 2026, see 1.6) can use Connectors too, but has its own Cowork plugin list maintained via the Customize page. Anyone with Cowork consumers in the company should maintain this plugin list separately. The confusion in forums typically goes like this: "My Connector works in standard chat but not in Cowork". Solution: the Cowork plugin entry has not been created yet.

New since the documentation update of 1 September 2026: On the admin side this is growing together. Microsoft now explicitly describes Copilot connectors → Your connections as one place for Copilot Connectors, Synced Connectors, Federated Connectors and the supported Cowork plugins. The Customize page in Cowork remains the self-service place for the end user, but the governance view no longer sits in two places. For your runbook this means: the admin check for a Cowork incident now starts in the same list as for any other Connector. Fittingly, with Flow Studio Cowork (access to Power Automate workflows) the first Federated Connector has landed in the Gallery that carries Cowork in its name.

New in August 2026, three points with Connector relevance. For context: Microsoft lists these three entries in the Cowork changelog under August 2026, not under July.

• Workspace files as tool input. Plugin Connector tools can now accept files from the running Cowork session as input. The plugin author declares a tool parameter with contentEncoding: base64 for this, and Cowork resolves the workspace file into content before the call. This lets a tool convert a document, analyze an image or attach a file to a third-party system without a detour via OneDrive.
• Event-driven tasks. Cowork tasks can now be attached to events instead of a schedule, for instance to an incoming mail with a certain pattern or a Teams message with an @-mention. This is described in natural language, and Cowork proposes the automation for confirmation. Relevant for Connector admins because such tasks access connected sources in the background: they appear together with the scheduled prompts on the Automations page.
• Local browser use is GA. Cowork can complete web tasks in a local Microsoft Edge on the person's device, using their existing sign-ins and the organization's policies. In August 2026 the feature moved from Frontier to general availability for all M365 Copilot tenants, the prerequisite being an installed Edge. Relevant for Connector admins as a delimitation: what happens here does not run through Connectors but through the person's browser session. It therefore does not show up in Connector governance either but is regulated via the browser use controls in Cowork administration.

New in September 2026, one point with Connector relevance. Microsoft extended the Cowork changelog on 8 September 2026. Of the four entries, three concern models and the new app skill, and only one is relevant for Connector admins: plugins can now also be found and configured in the mobile app, via the attachment menu + → Skills. This closes a gap that regularly came up in projects: until now every person had to set up their Cowork plugins on the desktop, even if they used Cowork mostly on mobile. For your enablement this means the plugin setup now belongs in both guides, not only in the desktop version. Nothing changes for governance: what appears in the mobile app is the same approved plugin list from the Admin Center.

8.6 DACH specifics · EU Data Boundary, GDPR, Purview

• EU Data Boundary: If your tenant is in the EU region (EUR IP blocks in 3.4), you benefit from the EU Data Boundary. Connector content is processed exclusively in EU data centers, as far as the source system allows.
• GDPR implications: Indexed data in the Microsoft Graph formally becomes processing data under Art. 28 GDPR. Microsoft offers a DPA (Data Processing Addendum) that covers this. For particularly sensitive data sources (personnel files, medical data) it is worth looking at the Connector configuration: if a property can be marked as sensitive, Copilot does not output it unfiltered.
• Check regional Connector variants: Federated Connectors index nothing in Microsoft 365, but the live request ends up with the vendor and thus in its hosting region. Since September 2026 the Gallery has listed explicit residency variants for the first time with Harvey EU and Harvey AU (see 5.2). Before every approval, check whether an EU variant exists, and then enable only that one.
• Microsoft Purview · audit trail: All Connector crawl events and all Federated Connector requests become audit-loggable in Purview. For compliance audits this is the central point of contact. Activation in the Microsoft Purview Compliance Portal.

8.7 Common error messages

"Tenant not licensed for Microsoft 365 Copilot"

No Copilot add-on license is active in the Admin Center. Check in the Microsoft 365 Admin Center under Billing → Licenses.

"Authorization failed" during OAuth setup

The callback URL in the source system does not match the expected Microsoft URL. Exactly what Microsoft specifies in the setup wizard has to be copied 1:1 into the source system. No trailing slash, no additional parameter.

"Connector quota exceeded"

Per tenant there are default limits for indexed items per Connector (typically 5 million per Connector, higher tiers can be purchased). Check the volume in the Connector Checker, set filters more restrictively if necessary or request a quota increase from Microsoft.

"Item not found in Copilot Chat" despite a successful crawl

Two common causes:

• ACLs not indexed alongside (items have neither Everyone nor a user ACL entry). Solution: check the Content tab.
• Property not flagged as retrieve. Solution: flag properties correctly.