Copilot Studio: governed tool access

TrustGate publishes a merged MCP catalog to the agent and decides which tools it can reach at all. A TrustGuard policy on the consumer additionally inspects the content of that traffic. Read Microsoft Copilot Studio first if you have not decided between the two integration paths.

What it covers

This path sits on the agent’s MCP tool connection. TrustGate publishes one catalog and decides which of those tools the agent can reach.

Surface	Access only	With a TrustGuard policy
MCP catalog	Limited to the consumer’s registries and toolkit	Same registry and toolkit restrictions
Tool call (`tools/call`)	Routed only when the consumer may use the tool	Evaluated before the upstream tool runs. Block or Transform
Tool result (`CallToolResult`)	Delivered as returned	Evaluated before Copilot Studio receives it. Block or Transform
Rate limits	Per-tool limiter on the consumer	Same

You can use this path on its own, or together with threat detection. Threat detection screens every tool the agent runs; this path governs the MCP tools TrustGate publishes. Redaction is available when a TrustGuard policy is attached: Transform rewrites inspected text on DLP outcomes. Non-text image, audio, or resource blocks are not inspected. The Tool Injection policy applies only to LLM traffic and does not affect MCP.

Before you start

Requirement	Notes
An MCP consumer with OAuth2 authentication	Create it under Agent Gateway → Consumers. Copilot Studio uses OAuth2.
Registries and a toolkit assigned to the consumer	The consumer’s routing determines what the agent can call. An empty toolkit on a bound registry grants the entire server.
The endpoint from the consumer’s Connect tab	Always ends `/{consumer_slug}/mcp`.
Egress from the TrustGate data plane to each registry `url`	SaaS cannot call private VPC endpoints. Use Hybrid for internal MCP servers.
An IdP app (only if you use your own IdP)	Follow the Okta or Entra ID setup for the app registration and redirect URI.
Browser pop-ups allowed for the maker	Consent runs in a pop-up window. A blocked pop-up leaves the connection unfinished.
A TrustGate collector and TrustGuard runtime policy (optional)	Required only for inspecting tool calls and results. Include Input and Output rules if you need both directions.

Do not configure client credentials manually. TrustGate publishes OAuth metadata and supports Dynamic Client Registration, so Copilot Studio registers itself. If Copilot Studio asks for a Client ID or Client secret, confirm that authentication is set to Dynamic discovery and that the server URL is the endpoint copied from Connect.

1. Create the MCP consumer

In Agent Gateway → Consumers, create a consumer with protocol MCP and auth OAuth2, bind the registries and toolkit you want the agent to have, then copy the URL from the Connect tab:

https://{mcpHost}/{consumer_slug}/mcp

Authentication options. The Copilot Studio configuration is the same for both options; only the consumer configuration changes.

Option	Consumer setup
NeuralTrust (no external IdP)	Leave the OAuth Client blank, or select Use NeuralTrust.
Your IdP (Okta, Entra ID, etc.)	Attach an OAuth2 auth from Identity. Follow Okta or Entra ID for the IdP app and redirect URI.

Use an Identity-based consumer when different people should see different tools. The caller’s identity selects the roles, which determine the registries and toolkit available to that caller.

2. Add the MCP tool in Copilot Studio

Create a tool → MCP.
Set Authentication → OAuth → Dynamic discovery.
Paste the consumer URL from step 1 as the server URL. Leave the defaults. If Power Automate opens, no changes are needed there.

3. Build the agent and activate the connection

Create an agent and add the MCP Server tool from step 2.
On the first run, activate every connection when prompted, including the MCP Server itself.
Complete the NeuralTrust or IdP login if prompted. If an upstream registry uses OAuth (forwarded) and the user has not connected it, the first tool call returns a connection link. After authorization, TrustGate stores and refreshes the credential.

4. Verify

Submit a request that invokes a tool from a bound registry.
Confirm the agent lists only the tools granted by the consumer’s toolkit.
Confirm the call in TrustGate telemetry. See Metrics.

Optional: inspect tool calls and results

The preceding steps configure an access-only connection. To evaluate the content of MCP traffic with TrustGuard:

Follow the TrustGate integration to create a TrustGate collector and assign a TrustGuard runtime policy. Add Input rules for tool calls and Output rules for tool results. Start in Observe mode.
In Agent Gateway → Policies → Catalog, add TrustGuard. Select the collector, set direction to request_response, and target the Copilot Studio consumer. Keep the guardrail in Observe while testing.
Invoke a tool and confirm the input and output decisions in TrustGuard Activity.
After reviewing the decisions, switch the runtime policy and guardrail to Enforce.

MCP event	What TrustGuard evaluates	Behavior in Enforce mode
`tools/call`	The tool name and string values in its arguments	Block prevents the upstream tool from running and returns an MCP policy error. Transform rewrites argument values but does not change the tool name.
`CallToolResult`	Text content blocks and string values in `structuredContent`	Block discards the result and returns an MCP policy error; it cannot undo an action the tool already performed. Transform rewrites the inspected values before Copilot Studio receives the result.

In Observe mode, findings are recorded without blocking or rewriting traffic. If a transform cannot be applied safely in Enforce mode, TrustGate blocks instead of forwarding unmasked content. Redaction applies to DLP outcomes only.

Reference

Configuration

MCP endpoint. Each MCP consumer has a streamable-http endpoint. The agent receives the merged catalog from the registries assigned to that consumer:

https://{mcpHost}/{consumer_slug}/mcp

The slug is the first path segment on the consumer’s proxy URL, and the path must end in /mcp. Copy the URL from the Connect tab instead of assembling it manually. Agent authentication. TrustGate acts as an OAuth2 authorization server for connecting agents and supports Dynamic discovery:

Endpoint	Purpose
`/.well-known/oauth-protected-resource`	Protected-resource metadata.
`/.well-known/oauth-authorization-server`	Authorization-server metadata.
`/register`	Dynamic Client Registration.
`/authorize` · `/callback` · `/token`	Authorization-code flow with PKCE.
`/connect` · `/disconnect`	The consent flow used by `forwarded` upstream auth.

The consumer configuration determines which IdP handles the login. See Auth. Upstream authentication is separate. Authenticating Copilot Studio to TrustGate is not the same as authenticating TrustGate to the MCP servers behind it. Configure the latter with mcp_target.auth.mode on the registry: none, static, client_credentials, passthrough, exchange or forwarded. forwarded requires the user to provide consent on first use. Tool names. Unique names pass through unchanged; a collision is prefixed with the registry name (asana_create_task). Use the name shown to the agent when configuring tool restrictions. Fail mode. fail_mode on the consumer decides what happens when an upstream server is unavailable. open skips the failed server; closed fails the call. For role-based consumers the effective mode is open only when every contributing role declares it open.

Troubleshooting

Symptom	Cause
Copilot asks for a Client ID or Client secret	Confirm authentication is set to Dynamic discovery and the URL ends in `/{consumer_slug}/mcp`. Manual client credentials are not required
Consent does not finish	Allow pop-ups in the maker’s browser, then retry connection activation
Tools are missing, or an upstream call fails	The consumer has no bound registries, the toolkit excludes the tool, or the user has not completed the IdP or upstream OAuth flow
The agent sees no tools at all on first run	Not all connections, including the MCP Server itself, were activated on the first run
A tool the maker expected is silently absent	A bound registry is down and `fail_mode` is `open`, so it was skipped rather than erroring
Tool calls or results do not appear in TrustGuard Activity	The default setup is access-only, or the TrustGuard policy is not targeted to this consumer or direction
A tool-result block did not undo an external action	Output inspection runs after the tool executes. The result can be blocked or rewritten, but the tool action cannot be reversed

Microsoft Copilot Studio: the choice between both paths
Threat detection: coverage and setup for the other path
MCP Gateway: consumers, catalog merging, toolkits, and upstream authentication
TrustGate guardrails: configure the optional policy
Consumers: slugs, routing modes, and the Connect tab
TrustGate authentication: OAuth2 authentication for MCP consumers
Okta and Entra ID: IdP applications and redirect URIs
Roles: identity-scoped toolkits

Catalog

AI coding agents

Agent platforms

AI gateways

Agent frameworks

Build your own

What it covers

Before you start

1. Create the MCP consumer

2. Add the MCP tool in Copilot Studio

3. Build the agent and activate the connection

4. Verify

Optional: inspect tool calls and results

Reference

Configuration

Troubleshooting

​What it covers

​Before you start

​1. Create the MCP consumer

​2. Add the MCP tool in Copilot Studio

​3. Build the agent and activate the connection

​4. Verify

​Optional: inspect tool calls and results

​Reference

​Configuration

​Troubleshooting

​Related

What it covers

Before you start

1. Create the MCP consumer

2. Add the MCP tool in Copilot Studio

3. Build the agent and activate the connection

4. Verify

Optional: inspect tool calls and results

Reference

Configuration

Troubleshooting

Related