> ## Documentation Index > Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > These docs cover three products: TrustGate (AI agent gateway), TrustGuard (runtime security), and TrustTest (AI red teaming). Start from each product overview for the definition and How it works. Prefer the .md URL next to a page in /llms.txt when you need the full article. Use /llms-full.txt for a single-file dump of the site. # Microsoft 365 Copilot > Govern the MCP tools Microsoft 365 Copilot can reach through a TrustGate application, and screen their payloads with TrustGuard Microsoft 365 Copilot is the Copilot embedded in Microsoft 365: the Copilot app, and the Copilot pane in Word, Excel, PowerPoint and Outlook. It reaches external systems through remote MCP servers. Point that connection at a TrustGate application and Copilot sees only the tools in that application's toolkit. Microsoft hosts model execution, so nothing of ours sits in the data path. This page covers Microsoft 365 Copilot. For agents built in Copilot Studio, see [Microsoft Copilot Studio](https://docs.neuraltrust.ai/integrations/copilot-studio.md). ## Choose a path | Path | What it does | What you can enforce | Where you configure it | | - | - | - | - | | **[Governed tool access](https://docs.neuraltrust.ai/integrations/microsoft-365-copilot-governed-tool-access.md)** | TrustGate publishes the assigned MCP servers through one endpoint and limits the catalog to the application's registries and toolkit. | Tool access and rate limits | The TrustGate application, and Copilot's MCP connection | | **[Threat detection](https://docs.neuraltrust.ai/integrations/microsoft-365-copilot-threat-detection.md)** | A TrustGuard policy on the application evaluates `tools/call` requests and `CallToolResult` responses. | Monitor · Block · Transform | On the TrustGate application | Governed tool access decides which tools exist at all. Threat detection inspects the content of the traffic that passes. Use one, or both. ## How it deploys Governed tool access has two deployment routes. Both point at the same TrustGate application, so the catalog, identity and policies behave identically, and neither requires the Microsoft Commercial Marketplace. | Route | Who enables it | When it applies | | - | - | - | | **Declarative agent** | A developer builds the agent; an administrator publishes it to the organization | When a user invokes that agent | | **Federated connector** | An administrator registers TrustGate in the Microsoft 365 admin center and rolls it out | In base Copilot, with nothing to invoke | Choose the agent when you want control over the assistant's own instructions. Choose the connector for coverage across the tenant without asking users to invoke anything. You can run both. ## Scope | Surface | Declarative agent | Federated connector | | - | - | - | | Microsoft 365 Copilot app | Confirmed | Confirmed | | Word, Excel | Confirmed | Not available at the time of writing | > [!NOTE] > > Microsoft lists Word, Excel, PowerPoint and Outlook among the experiences > federated connectors support. A custom connector did not appear in those panes > when this was tested, in either the desktop or the web client, while working > normally in Copilot Chat. Verify in your own tenant before relying on it. ## Where enforcement holds Microsoft 365 has no per-agent allowlist. An administrator can allow or block agents by publisher type and restrict which users may install them, but cannot require that only one specific agent runs, and SharePoint agents are governed by file permissions rather than by those settings. The control that holds is not at the agent, it is at the credential. When the MCP servers and the upstream tokens for your internal systems exist only behind TrustGate, an agent that was never approved can still be created, but it has nothing to connect to. Microsoft 365 admin controls reduce the surface as a second layer. They are not the primary control. ## What the perimeter covers The governed perimeter is every action Copilot takes toward your systems: which tools exist at all, who may call them, what arguments leave, and what content comes back. That is the surface an assistant with access to internal systems acts through, and it is covered end to end on both deployment routes. Two things sit outside it, by Microsoft's architecture rather than by any choice of vendor. **The conversation.** What someone types into Copilot reaches Microsoft's orchestrator and is answered by Microsoft's model without leaving Microsoft's boundary, and Microsoft applies its own filtering there. No third party sits on that path. It is also the path that matters least once tools are attached: Microsoft's filter catches an instruction the user types, and does not inspect what a tool returns, which is where this integration applies. **The open document.** In Word and Excel, the content of the file on screen is not sent with the tool call. Microsoft's documentation states that declarative agents have access to the open document by default; that applies to API plugins using the `reasoning` state object, not to MCP-based actions. In the Office apps the perimeter is the actions, not the content on screen. ## Where to go next > [card] [Set up governed tool access](https://docs.neuraltrust.ai/integrations/microsoft-365-copilot-governed-tool-access.md) > > The TrustGate application and the Entra registration, then either > deployment route. > [card] [Set up threat detection](https://docs.neuraltrust.ai/integrations/microsoft-365-copilot-threat-detection.md) > > The collector and runtime policy that evaluate tool calls and their > results, in Monitor or Block. ## Related * [Governed tool access](https://docs.neuraltrust.ai/integrations/microsoft-365-copilot-governed-tool-access.md): coverage and setup * [Threat detection](https://docs.neuraltrust.ai/integrations/microsoft-365-copilot-threat-detection.md): coverage and setup * [Microsoft Copilot Studio](https://docs.neuraltrust.ai/integrations/copilot-studio.md): the same two paths for agents built in Copilot Studio * [MCP Gateway](https://docs.neuraltrust.ai/trustgate/mcp/overview.md): applications, catalog merging, toolkits, and upstream authentication * [TrustGate and TrustGuard](https://docs.neuraltrust.ai/integrations/trustgate.md): collector, policy, verdict, and failure behavior * [Microsoft 365 Copilot extensibility](https://learn.microsoft.com/microsoft-365-copilot/extensibility/): Microsoft reference This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.