Connect Microsoft Copilot

Copilot has two routes. Dynamic discovery is the one to use: Copilot Studio negotiates OAuth with Msharti and each person signs in as themselves. Where corporate DLP policy blocks that, an API key gets you connected without losing role scoping or audit.

Option A: dynamic discovery Recommended

1. Open Copilot Studio. Go to Tools → Add tool → Model Context Protocol. The alternative path is M365 Admin Center → Copilot → Connectors → Create.
2. Paste the server URL. Set Authentication: OAuth 2.0 → Dynamic discovery, paste https://mcp.msharti.dev/mcp, and click Create.
3. Sign in and choose the credential scope. Sign in, then Allow access. Under Details → Credentials to use pick Maker-provided for one shared org-wide connection, or Per-user so every person authenticates as themselves.

Option B: API key DLP fallback

Use this when your tenant's data loss prevention policy blocks the interactive OAuth redirect. The connection is still scoped by role and still fully audited; it simply identifies a machine rather than a person.

1. Generate a Copilot key. In the Msharti console go to Settings → API Keys → New key → Copilot and copy the msh_cop_… value. It is shown once.
2. Add it in Copilot Studio. On the MCP tool set Authentication: API key and supply the header below.

Header: Authorization
Value:  Bearer msh_cop_xxxxxxxxxxxxxxxx

Check it works

Reconcile our Paybill collections against Sage invoices
for last month, and flag any supplier whose KRA TCC has expired.

That question crosses three connectors in one request, which makes it a good smoke test. Open Usage in the Msharti console afterwards and confirm you see calls against M-Pesa, Sage and KRA.

Rolling it out to a department

1. Decide the roles first. Finance rarely needs the same tools as Operations. Build the roles before you invite people, not after. See roles and permissions.
2. Prefer per-user credentials. It is the difference between an audit log full of names and one full of a single maker account.
3. Invite seats in the console. Team → invite, assign a role. Their Copilot connection inherits it automatically.
4. Watch the first week in the audit log. Denied calls tell you where a role is too tight; unexpected tools tell you where it is too loose.

If it does not connect