Skip to main content
Microsoft 365 Copilot is the Copilot embedded in Microsoft 365: the Copilot app, and the Copilot pane in Word, Excel, PowerPoint and Outlook. It reaches external systems through remote MCP servers. Point that connection at a TrustGate application and Copilot sees only the tools in that application’s toolkit. Microsoft hosts model execution, so nothing of ours sits in the data path. This page covers Microsoft 365 Copilot. For agents built in Copilot Studio, see Microsoft Copilot Studio.

​
Choose a path

Governed tool access decides which tools exist at all. Threat detection inspects the content of the traffic that passes. Use one, or both.

​
How it deploys

Governed tool access has two deployment routes. Both point at the same TrustGate application, so the catalog, identity and policies behave identically, and neither requires the Microsoft Commercial Marketplace. Choose the agent when you want control over the assistant’s own instructions. Choose the connector for coverage across the tenant without asking users to invoke anything. You can run both.

​
Scope

Microsoft lists Word, Excel, PowerPoint and Outlook among the experiences federated connectors support. A custom connector did not appear in those panes when this was tested, in either the desktop or the web client, while working normally in Copilot Chat. Verify in your own tenant before relying on it.

​
Where enforcement holds

Microsoft 365 has no per-agent allowlist. An administrator can allow or block agents by publisher type and restrict which users may install them, but cannot require that only one specific agent runs, and SharePoint agents are governed by file permissions rather than by those settings. The control that holds is not at the agent, it is at the credential. When the MCP servers and the upstream tokens for your internal systems exist only behind TrustGate, an agent that was never approved can still be created, but it has nothing to connect to. Microsoft 365 admin controls reduce the surface as a second layer. They are not the primary control.

​
What the perimeter covers

The governed perimeter is every action Copilot takes toward your systems: which tools exist at all, who may call them, what arguments leave, and what content comes back. That is the surface an assistant with access to internal systems acts through, and it is covered end to end on both deployment routes. Two things sit outside it, by Microsoft’s architecture rather than by any choice of vendor. The conversation. What someone types into Copilot reaches Microsoft’s orchestrator and is answered by Microsoft’s model without leaving Microsoft’s boundary, and Microsoft applies its own filtering there. No third party sits on that path. It is also the path that matters least once tools are attached: Microsoft’s filter catches an instruction the user types, and does not inspect what a tool returns, which is where this integration applies. The open document. In Word and Excel, the content of the file on screen is not sent with the tool call. Microsoft’s documentation states that declarative agents have access to the open document by default; that applies to API plugins using the reasoning state object, not to MCP-based actions. In the Office apps the perimeter is the actions, not the content on screen.

​
Where to go next

Set up governed tool access

The TrustGate application and the Entra registration, then either deployment route.

Set up threat detection

The collector and runtime policy that evaluate tool calls and their results, in Monitor or Block.