Manage plugins for Cowork (Frontier)

  • Applies to: Microsoft 365 Copilot

[This article is prerelease documentation and is subject to change.]

Important

  • You need to be part of the Frontier preview program to get early access to Microsoft 365 Copilot Cowork. Frontier connects you directly with Microsoft's latest AI innovations. Frontier previews are subject to the existing preview terms of your customer agreements. As these features are still in development, their availability and capabilities may change over time.
  • If Cowork isn't visible in Microsoft Admin Center Agent management, ensure that the admin account is also enrolled in Frontier (Copilot -> Settings -> Frontier).
  • This is a preview feature.
  • Preview features may have restricted functionality. These features are available before an official release so that customers can get early access and provide feedback.
  • For more information, go to our Microsoft Product Terms.

Microsoft 365 Copilot Cowork supports plugins that add skills and connectors to extend what Cowork can do. As an IT administrator, you control which plugins are available in your organization, how they're deployed, and who can use them. This article covers plugin governance from an admin perspective.

For information on how users browse and use plugins, see Use plugins with Cowork. For information on building plugins, see Build plugins for Cowork.

What are Cowork plugins?

A Cowork plugin is a package distributed through the Microsoft 365 App Store that can contain:

  • Skills: Prompt-based workflows that teach Cowork new domain expertise, such as financial analysis, legal research, or HR workflows.
  • Connectors: Links to external data sources and services that Cowork can use during conversations.

Plugins use the same M365 app package format as Teams apps, Copilot agents, and Office add-ins. You manage them with the same admin tools you use for other Microsoft 365 apps.

Prerequisites

To manage Cowork plugins for your organization, you need:

  • Microsoft 365 admin center access: You must be a tenant administrator, or have the Copilot administrator role.
  • Microsoft 365 Copilot licenses: Users who use Cowork plugins must have Microsoft 365 Copilot licenses assigned.

Deploy plugins to your organization

You can deploy plugins to your entire organization or to specific users and groups, the same way you deploy other Microsoft 365 apps.

  1. Sign in to the Microsoft 365 admin center.
  2. Select Copilot > Agents > All agents.
  3. Find the plugin you want to deploy. You can search by name or browse the available plugins.
  4. Select the plugin to open its details.
  5. Under Deploy to, select Entire organization or Specific users/groups.
  6. Select Deploy.

When you deploy a plugin, it's automatically acquired for the target users. Users don't need to browse the plugin catalog or install it themselves. The plugin's skills and connectors become available in their Cowork conversations.

Tip

Cowork provides several plugins for Microsoft applications, including Dynamics 365 Customer Service, Dynamics 365 ERP, Dynamics 365 Sales, and Fabric IQ. These plugins are available from the Microsoft 365 App Store and can be deployed like any other plugin.

Learn more in Deploy agents in Microsoft 365 Copilot.

Control plugin availability

After you deploy a plugin, you can configure who can see it and how users interact with it.

Deployment types and user permissions

Deployment type Who gets the plugin User can remove it?
Deployed to entire organization All licensed Copilot users - acquired automatically No
Deployed to specific groups Target users - acquired automatically; visible to others if configured No (for target users)
Available in the App Store Users acquire it themselves Yes

Admin-deployed plugins display a Managed by your organization label in the user's plugin detail view. Users can't remove these plugins, but they can enable or disable them for their own conversations from the Sources & Skills panel.

Allow or block specific plugins

You manage plugin availability through the same app governance controls used for other Microsoft 365 apps:

  1. In the Microsoft 365 admin center, select Copilot > Agents > All agents.
  2. Find the plugin you want to manage.
  3. Adjust the availability setting:
    • Available to all users - All licensed Copilot users in your tenant can find and acquire the plugin.
    • Available to specific users or groups - Only the users or security groups you specify can see the plugin.
    • Blocked - No users in your tenant can access the plugin.

Note

Country or region-based scoping isn't supported for plugin availability. Use security groups to represent geographic or organizational segments.

Learn more in Manage agents in the Microsoft 365 admin center.

How users interact with deployed plugins

Understanding how plugins appear to users helps you plan your deployment:

  • Admin-deployed plugins appear in the user's Added Plugins tab automatically. The plugin detail view shows a Managed by your organization label.
  • Users can enable or disable any plugin - including admin-deployed ones - from the Sources & Skills panel. These preferences are saved per device.
  • Disabling a plugin hides its skills and connectors from new conversations but doesn't remove the plugin from the user's account.

For the full user experience, including browsing, acquiring, and using plugin skills, see Use plugins with Cowork.

Manage connector authentication

Some plugins include connectors that link Cowork to external services. When a plugin connector requires authentication:

  • You can't sign in on behalf of your users. Each user must complete the sign-in or consent flow themselves the first time they use that connector.
  • After the initial sign-in, Cowork remembers the user's authorization unless you or the user revokes it.

Dynamics 365 connectors

Dynamics 365 plugins (Customer Service, Sales, and ERP) use Microsoft Entra ID authentication and require users to select the Dynamics 365 environment they want to connect to. If only one environment is available, Cowork selects it automatically. If multiple environments are available, Cowork prompts the user to choose one.

Dynamics 365 Customer Service and Sales integrations are enabled by default and can be disabled in the Microsoft 365 admin center.

Monitor plugin usage

Microsoft Purview audit logs capture Copilot activities for your organization, including interactions with Cowork and its plugins. Audit entries appear under Copilot activities in Microsoft Purview. Audit Standard provides these logs at no extra cost.

Learn more in Audit log activities for Microsoft 365 Copilot.

Disable the plugin system

If you need to turn off plugins entirely for your organization, work with your service administrator to disable the plugin feature for your tenant. When disabled:

  • The Browse plugins button doesn't appear for users.
  • Plugin skills and connectors are not loaded, even if previously acquired.

To re-enable plugins, reverse the configuration. Users' previously acquired plugins become available again.

Plugin support for MCP servers

Cowork supports plugins with MCP servers and/or skills, packaged as Teams apps. Cowork performs dynamic tool discovery — when a plugin declares an MCP server, Cowork calls initialize and tools/list at runtime to discover available tools automatically. Plugins declare their MCP servers and skills in manifest.json:

{
    "$schema": "https://developer.microsoft.com/en/json-schemas/teams/vDevPreview/MicrosoftTeams.schema.json",
    "manifestVersion": "devPreview",
    "version": "1.0.0",
    "packageName": "com.cowork.plugin.contoso",
    "name": {
      "short": "Contoso Analytics",
      "full": "Contoso Analytics"
    },
    "description": {
      "short": "A Cowork plugin for data analysis workflows.",
      "full": "The Contoso plugin integrates Contoso's MCP server..."
    },
    "agentSkills": [
      { "folder": "./skills/data-summary" },
      { "folder": "./skills/trend-analysis" },
      { "folder": "./skills/report-builder" }
    ],
    "agentConnectors": [
      {
        "description": "Remote MCP server providing tools for Contoso",
        "toolSource": {
          "remoteMcpServer": {
            "mcpServerUrl": "https://api.contoso.com/mcp",
            "authorization": {
              "type": "OAuthPluginVault",
              "referenceId": "Y29udG9zby1tY3Atc2VydmVyLWF1dGg="
            }
          }
        },
        "id": "contoso",
        "displayName": "Contoso MCP Server"
      }
    ]
  }

Supported MCP features

The following MCP features are currently supported:

Feature Notes
Core MCP (initialize, tools/list, tools/call, notifications/initialized) Full tool lifecycle with JSON Schema definitions, capabilities exchange, Streamable HTTP transport; title annotation used as tool display name
Auth None (anonymous), OAuthPluginVault, and ApiKeyPluginVault — configured via agentConnectors schema with a referenceId from Teams Dev Center

MCP authentication

To use OAuth or ApiKey for authentication, refer to Configure authentication for MCP and API plugins in agents in Microsoft 365 Copilot for setup and configuration details.

Plugin validation and compliance

Plugins published to the Microsoft 365 App Store go through validation before they're available to your organization. The review covers manifest integrity, skill and connector validation, and compliance with Microsoft 365 app security requirements.

For the full list of validation rules, see Validation rules in the plugin development guide.

Sideloaded plugins

For testing purposes, users with appropriate permissions can sideload plugin packages through the M365 Admin Center > Manage Apps > Upload custom app. Sideloaded plugins bypass store validation, so use this option only for development and testing. Control who can sideload apps using your existing custom app policies.

Related content

  • Last updated on