Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
[This article is prerelease documentation and is subject to change.]
Important
This feature is part of Frontier preview program. Frontier connects you directly with Microsoft's latest AI innovations. Frontier previews are subject to the existing preview terms of your customer agreements. As these features are still in development, their availability and capabilities might change over time.
Anyone in your organization with access can build apps in Cowork and bring them to the Microsoft 365 ecosystem. Every app comes with a set of default settings already in place. Each app inherits a default policy that governs what it can connect to, how broadly it can be shared, and how it behaves at runtime.
Since default governance is in place from day one, you don't need to set up anything as an admin. Makers can build inside a Microsoft-curated set of capabilities from the start. You can review these default settings at any time, customize them when you need to, and rely on them working alongside any Power Platform governance you already have.
This article walks through:
- Where to review the default settings that every app inherits.
- How to customize those settings when your organization needs different rules.
- How apps work with existing Power Platform governance so the configurations you already set up aren't overridden. See If you're an existing Power Platform customer for details.
Required roles
Entra role assignments control access to environment groups in the Microsoft 365 admin center.
| Role | Access level |
|---|---|
| Global Administrator | Read and write |
| Power Platform Administrator | Read and write |
| Global Reader | Read-only |
| AI Administrator | Read-only |
| AI Reader | Read-only |
Read-only roles can see every setting in the policy (connectors, actions, sharing rules, and content security) but can't make changes.
Where to find it
In the Microsoft 365 admin center, go to Apps > Settings. Select Environment groups to open the environment groups page.
Review the default settings
These default settings live in a default environment group. The system automatically provisions this group when the first app is created in Cowork, or when an admin visits the app governance experience in the Microsoft 365 admin center (MAC) or the Power Platform admin center (PPAC). You can't delete this group. It scopes to Everyone (it applies to all makers who build apps), and Microsoft manages it.
To review it, go to Apps > Settings > Environment groups and select the group to open its page. The page lists four rules that together define these settings: routing, connectors and MCP servers, sharing, and content security policy.
Routing
The routing rule automatically directs new or existing app creators into isolated personal environments when they build apps. By default, it applies to Everyone.
Customize connectors and MCP servers
Apps reach external services through connectors, and a connector's actions determine what it can do. MCP (Model Context Protocol) servers do the same for an app's AI capabilities. By controlling which connectors, actions, and MCP servers are available, you determine what apps in this group can connect to and do.
The connector and MCP server rule controls which connectors, connector actions, and MCP servers apps in this group can use.
The default environment group includes 18 Microsoft first-party connectors that authenticate exclusively through Entra ID:
| Category | Connectors |
|---|---|
| Content | SharePoint, OneDrive for Business, Word Online (Business), OneNote (Business) |
| Collaboration | Microsoft Teams, Office 365 Outlook, Office 365 Groups Mail |
| Identity | Office 365 Users, Office 365 Groups |
| Task management | Microsoft Planner, Microsoft To Do, Microsoft Bookings |
| Data & Analytics | Microsoft Forms, Excel Online (Business), Dataverse, Power BI |
| Social | Yammer / Viva Engage |
| DevOps | Azure DevOps |
A connector is included in the allow list when it meets all of the following criteria:
- The publisher is Microsoft.
- It's generally available (GA).
- It supports Entra ID authentication exclusively.
- It keeps data within the tenant or connects to Microsoft-managed services.
- It exposes only purpose-scoped actions.
The following connectors are excluded by design:
- Connectors in preview
- Deprecated connectors
- Flow/automation-only connectors
- Security and admin connectors
- Infrastructure connectors
- Third-party and independent software vendor (ISV) connectors
- Custom connectors
MCP servers follow the same criteria, except for general availability (GA) status, because MCP is an emerging protocol and many servers ship in preview. Any future connector that meets the inclusion criteria is added to the allow list automatically.
Blocked connector actions
Some approved connectors contain actions that bypass their intended purpose. For example, these actions can send arbitrary HTTP requests or execute arbitrary code. These actions are blocked by default, even though the connector itself is allowed:
| Action type | Affected connectors | Examples |
|---|---|---|
| Open-ended HTTP requests | SharePoint, Microsoft Teams, Office 365 Outlook, Office 365 Users, Office 365 Groups, Office 365 Groups Mail, Azure DevOps | "Send an HTTP request" actions that let makers construct arbitrary REST API calls |
| Arbitrary code or query execution | Excel Online (Business), Power BI | "Run script" (Office Scripts), "Run a query" (freeform DAX with user impersonation) |
| Arbitrary platform API calls | Dataverse | "Perform an unbound/bound action" that invokes arbitrary Custom APIs |
The connector remains available. Only the specific actions listed earlier are disabled.
MCP servers
The default environment group includes 12 Microsoft first-party MCP (Model Context Protocol) servers:
| MCP server | Connects to | Auth |
|---|---|---|
| Power Apps MCP Server | Power Apps tasks, data entry | Entra ID |
| Work IQ Copilot MCP Server | Copilot orchestration | Entra ID |
| Work IQ Teams MCP Server | Teams messages and channels | Entra ID |
| Work IQ Outlook Mail MCP Server | Exchange / Outlook mail | Entra ID |
| Work IQ Outlook Calendar MCP Server | Exchange calendar | Entra ID |
| Work IQ Word MCP Server | Word document operations | Entra ID |
| Work IQ User MCP Server | Entra user profile data | Entra ID |
| Work IQ OneDrive MCP Server | OneDrive files | Entra ID |
| Work IQ SharePoint MCP Server | SharePoint sites and content | Entra ID |
| Fabric MCP | Microsoft Fabric data and analytics | Entra ID |
| Microsoft Learn Docs MCP | Microsoft Learn documentation | None (public) |
| Microsoft MCP Servers | MCP management and custom server creation | Entra ID |
Customize sharing
The sharing rule controls how broadly makers can share apps they build:
- Allow sharing with everyone in your organization: Allows sharing the app with other people in the tenant.
- Allow sharing with guest users: Extends sharing to external guest users.
Customize content security policy
Content Security Policy (CSP) is a browser standard that limits where an app can load scripts, styles, images, and other resources from, and which sites can frame it. It gives you fine-grained control over what an app is allowed to load and which sites can embed it.
By default, apps use a restrictive policy that limits content to approved sources. Administrators can review and customize this policy for each environment group.
Content security policy can run in two modes:
- Enforced (default). The browser blocks any resource that violates the policy.
- Report-only. The browser allows everything but reports what would have been blocked. Use this mode to roll out or tighten a policy without breaking a running app.
Before enforcing a changed policy, use report-only mode to identify resources that the policy might block. Add sources only when they're required for approved app functionality.
Important
Keep additions as narrow as possible. Allow only specific, trusted origins, and don't use broad wildcard permissions.
Customize the default settings
The default settings are restrictive on day one, but you can adjust the connectors, sharing, and content security rules when your organization needs different behavior. Open the default environment group from Apps > Settings > Environment groups, and then edit the rule you want to change.
Connectors and MCP servers
View the allow list (connectors apps can use) and the blocked list (everything else). The allow list shows each connector's name, number of allowed actions, publisher, and a link to learn more.
To see which actions are enabled or disabled for a connector, select the connector name. Each action has an on/off toggle. Actions that are disabled by default (such as open-ended HTTP requests) are clearly marked.
To add connectors, select Add connectors and browse or search the full connector catalog.
Taking full control
By default, Microsoft curates the connector policy for you. To switch from Microsoft-curated to full control, select Edit this policy in the Connectors and MCP servers flyout.
This change applies specifically to the advanced connector policy: the list of approved connectors, their action controls, and MCP servers. Once switched:
- Automatic updates from Microsoft stop for connectors, MCP servers, and action controls.
- The admin can add or remove connectors from the allow list.
- The admin can enable or disable individual connector actions.
- The admin can add or remove MCP servers.
A warning dialog appears before the switch takes effect, calling out that:
- Existing apps might be affected if connectors or actions change.
- The connector policy no longer receives automatic additions from Microsoft.
Sharing
Select Sharing and turn on or off either setting to widen or restrict how broadly makers can share their apps.
Content security policy
Configure CSP settings to control what apps can do in a browser:
- Reporting for apps: Optionally collect reports on content blocked by this policy.
- Enforce content security policy: Block violations of content security policy for end users.
- Configure directives: Review and update the approved sources that apps can use.
You can always directly edit sharing rules and content security settings, regardless of whether the connector policy is Microsoft-curated or under your full control.
If you're an existing Power Platform customer
If your tenant already has environment routing rules, environment groups, or advanced connector policies configured in the Power Platform admin center, apps created in Cowork respect those existing configurations. The app governance experience doesn't override what IT already set up.
How it works depends on the current routing state. The following changes are applied automatically when the first app is created in Cowork, or when you visit the app governance experience in the Microsoft 365 admin center or Power Platform admin center.
For more information, see Environment routing in the Power Platform documentation.
No routing configured
Environment routing is enabled for this app creation experience only. All new personal environments are routed into a single environment group that is preconfigured with the rules described earlier.
Routing enabled with no routing rules
If you enable environment routing for one or more products without configuring a routing rule, two things happen. First, routing is automatically enabled for app creation. In the Power Platform admin center Tenant settings > Environment routing panel, app creation appears as a routing product with its own checkbox. Then, a routing rule is added so that all new personal environments created from routing are placed into a single environment group that is preconfigured with the rules described earlier.
Routing rules with an "Everyone" catch-all
Microsoft 365 admin center preserves and reflects your existing environment groups and routing rules. The Environment groups page in Microsoft 365 admin center (under Apps > Settings) shows the same information as the Environment routing panel in Power Platform admin center (under Tenant settings). Each group includes app-specific settings, such as sharing limits and content security.
Security-group-scoped routing without a catch-all
This option uses the same configuration as the previous option, but users outside all configured security groups aren't automatically provisioned a personal environment. The existing routing scope stays the same.
In all cases, app-specific rules layer in without overriding existing configurations. Microsoft 365 admin center preserves whatever the admin previously set up.
You can't turn off environment routing for apps created in Cowork. The routing rule you create for these apps is permanent and can't be deleted from either Microsoft 365 admin center or Power Platform admin center.