Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Configure access so your Model Context Protocol (MCP)-compatible client can launch the Copilot Studio MCP npm package and connect to the service. Installing or registering the server in a client doesn't grant permissions to an environment or authorize every action.
Prerequisites
- A Microsoft work account with the required Copilot Studio entitlement and access to the intended environment.
- An MCP-compatible client that can launch a local stdio server.
- Node.js with npm and
npx, using a version that the package supports. Check the package README for the release's runtime requirements. - Permission to use the server under your organization's client and service policies.
- Access to any connectors or resources needed for the operations you request.
- Network access to npm for package retrieval, and to Copilot Studio and its authentication services.
Install the runtime where your MCP client launches server processes. For a remote development environment or container, this location might be a different machine from your desktop.
To configure Visual Studio Code or GitHub Copilot CLI, see Connect with Visual Studio Code and GitHub Copilot CLI.
Prepare access
Identify the environment and resources you want to work with. Use a development environment for initial evaluation where possible.
Confirm that your account can access the target through the normal Copilot Studio experience.
Ask your administrator to resolve missing permissions or required consent.
Confirm that your organization permits the selected client to run the Microsoft-published
@microsoft/copilot-studio-mcppackage.Register the server by using
npxor the supported registry installation experience, sign in, and select your environment.
Don't create a replacement environment or choose a production target because an expected environment is absent.
Authenticate and confirm the target
After the client starts the MCP server, ask it to check the connection state and sign in if needed:
Connect to Copilot Studio MCP and show my available environments so I can choose one. Don't create, publish, run, or repair anything.
Complete Microsoft work-account sign-in in the browser. Verify the requested permissions before you consent.
Choose the intended environment from the returned list. If a large inventory needs narrowing, provide an environment name or its complete ID.
Don't paste passwords, client secrets, access tokens, or consent codes into a prompt or commit them to client configuration. If you need more application configuration, follow the service's approved instructions rather than inventing a client ID or scope.
Before you use service tools, confirm the signed-in account and selected environment. If the connection is already ready, reuse it instead of signing in or selecting the same environment again.
Changing accounts or environments might change the tools and resources available. Refresh the connection context and tool catalog as required by the client and service. Check in-flight operations before you switch targets.
Restrict or remove access
Use the client's controls to stop, disable, or remove the MCP server. To revoke access more broadly, use the appropriate identity, environment-permission, and organizational policy controls.
Removing a client registration doesn't delete agents, workflows, or connections, and doesn't undo actions already completed. It also doesn't by itself revoke previously granted application consent.
Troubleshoot access
| Issue | What to check |
|---|---|
| The server can't start | Check that Node.js and npx are available where the client launches the process, and that npm access is permitted. |
| The service can't be reached | Check service availability and approved network or proxy configuration. Don't substitute an unverified server or service destination. |
| Sign-in fails | Confirm the client supports the service's authentication flow and that account, consent, and organizational policy requirements are met. |
| The intended environment is unavailable | Confirm the signed-in account and its access. Narrow the environment search by name, or use the intended environment's complete ID. |
| An operation is denied | Check permissions for the specific action and resource. Tool discovery alone doesn't grant permission to run it. |
| Tools are missing | Check authentication, context, client tool policies, and catalog refresh. Use the supported catalog rather than guessed tool names. |
| A connector requires sign-in | Complete the connector's supported authorization flow separately. Don't supply secrets in chat. |
If an operation might have changed a resource before an error occurred, inspect its known outcome before you retry. When you request support, include sanitized error codes and client versions, not credentials or unreviewed business content.