To add enterprise data to a Microsoft Copilot agent safely, connect the agent to a Model Context Protocol (MCP) server that reaches your systems of record, then carry each user’s identity and permissions through to every source.
Skip that second step and the agent either answers from general model knowledge or reads data through a shared service account that can see more than any one user should.
The Microsoft and CData partnership addresses this. It brings Connect AI’s MCP connectivity into Copilot Studio and Microsoft Agent 365, so agents can read, write, and act on real-time data in systems like Salesforce, SAP, and NetSuite.
Your security team needs to know who can see what and how access is audited. Your engineering team needs a build that holds up in production. This guide covers setup, per-user permissions, governance, and observability for both.
What copilot agent data access means (and why native connections fall short)
With Copilot agent data access, an agent built in Copilot Studio pulls live business data when a user asks a question. Microsoft states that Copilot only surfaces data a user has at least view permission to access in Microsoft Graph. Your Salesforce pipeline, SAP orders, and Workday records sit outside Microsoft Graph, so that check doesn’t apply to them.
To reach those systems, the agent needs a tool, and MCP has been the standard way to add one since Microsoft made it generally available in Copilot Studio in May 2025. Most teams start by connecting one server per source, which holds up for a pilot with one or two systems.
At dozens of sources, your team maintains separate tools, credentials, and policies for each one, and an audit request means stitching logs together from every server. CData’s Copilot integration page also notes that without a managed layer, Copilot filters, joins, and groups datasets in code, which in some cases uses up to 10X more tokens.
A centralized gateway replaces those servers with a single connection point. CData Connect AI works as that governed gateway, sitting between Copilot and hundreds of enterprise systems, with permissions and logging handled in one place.
Area | AI gateway with Connect AI | One MCP server per source |
Connections | One governed MCP connection to hundreds of systems | A separate server for each source |
Tools | Universal MCP tools, plus custom tools | Tools that vary with each API |
Computation | Pushed to the query engine | Done by the model through code |
Governance | Central monitoring, permissions, and audit | Configured ad hoc by each user |
The result is one connection to secure, monitor, and audit, however many sources sit behind it.
Prerequisites: Copilot Studio capabilities, licensing, and governance requirements
Copilot Studio is the copilot agent builder for Microsoft 365. You create an agent, write its instructions, add knowledge, and attach tools before you publish it. Makers typically get access through a free Copilot Studio user license or a Microsoft 365 Copilot license. Microsoft notes that the free user license requires a tenant prepaid Copilot Credit pack first.
Runtime usage is billed in Copilot Credits. For Microsoft 365 Copilot licensed users, classic answers, generative answers, and Microsoft Graph grounding in Copilot Chat, Teams, or SharePoint don’t count against the meter. Plan credit capacity for any other usage.
Prerequisite | Why it’s needed | Where to configure it |
Copilot Studio access and Copilot Credits or Microsoft 365 Copilot licenses | Builds and runs the agent | Power Platform admin center |
Generative orchestration | Required for MCP tools | Agent settings in Copilot Studio |
Microsoft Entra identity and SSO | Gives every request a known user | Microsoft Entra admin center |
CData Connect AI account with at least one source | Provides the AI gateway | Connect AI console |
Microsoft Agent 365 license (optional) | Adds a registry, tool approval, and observability across agents | Microsoft 365 admin center |
For a faster security review, settle the governance decisions before anyone builds. Decide which sources need per-user access, whether admins will block shared maker credentials, and who approves new MCP servers. Agents built after those calls are made don’t need to be reworked for security review later.
How to connect enterprise data to a Copilot agent via MCP (step by step)
Each step below closes one of the gaps that per-source integrations leave open. By the end, every request from the agent carries the signed-in user’s identity to the source.
Step 1: Set up your AI gateway connection in CData Connect AI
Sign in to Connect AI or start a trial. If your organization uses single sign-on (SSO), you can have CData enable it for your account so people sign in to Connect AI with their corporate identity.
Every source you add sits behind one MCP endpoint, https://mcp.cloud.cdata.com/mcp, which you enter as the server URL in clients that ask for one. Connect AI supports OAuth and Basic authentication, and Basic uses your Connect AI user ID and a personal access token (PAT). A PAT ties every request to one account, so keep it for testing and use OAuth for production agents.
Step 2: Add and configure enterprise sources like Salesforce and SAP
In Connect AI, open Sources and select Add Connection.
Add each system the agent needs, such as Salesforce CRM, SAP ERP, or Workday.
Where the source supports it, switch the connection to per-user authentication so each user signs in to the source with their own account.
On the Permissions tab, set Select, Insert, Update, Delete, and Execute rights for each user.
Connections use shared credentials by default. That’s reasonable for read-only reference data with no user-specific permissions. For CRM, ERP, and HR data, per-user authentication is what keeps the source system’s role-based access control (RBAC) in effect when a user asks the agent a question.
Step 3: Attach the MCP toolset to your agent in the Copilot agent builder
Open the agent in Copilot Studio, go to the Tools page, and select Add a tool. From there, you can add the certified CData Connect AI connector, which has users sign in with their Connect AI account. You can also use the MCP onboarding wizard with the endpoint from Step 1.
In the tool’s settings, set Credentials to use to End user credentials. Each user then signs in the first time the agent calls the tool. The other option, maker-provided credentials, runs every request as the person who built the agent. Admins can block maker credentials across an environment from the Power Platform admin center.
For a full walkthrough, follow the Copilot Studio and Teams guide. If your source is a REST API, the API data guide covers that setup.
Security and governance: RBAC, OAuth/SSO passthrough, and Agent 365 controls
A security lead will usually start by asking whether a user can see more through the agent than they could by logging in to the source directly. That depends on four links in the identity chain.
The user signs in to Microsoft 365 with Microsoft Entra ID.
End-user credentials send the request to Connect AI as that user.
Connect AI applies its per-user permissions, with SSO through your identity provider.
Per-user authentication sends the query to the source, where its RBAC applies unchanged.
Together, these links are OAuth/SSO passthrough. If any link falls back to a shared identity, the agent can return data the user can’t see on their own. With all four in place, the source system decides what comes back, the same way it does when the user logs in directly.
Because every request passes through one gateway, your security lead reviews one set of identity settings and one log, instead of auditing a separate integration for each source.
Microsoft Agent 365, generally available since May 1, 2026, governs the agents. Admins get one registry to observe and manage agents, and they can approve or reject custom MCP servers in the Microsoft 365 admin center.
Connect AI governs the data access underneath with its query log, which records the timestamp, user, query text, and status for every query. A separate audit log tracks administrative changes such as new users and permission edits. The MCP security playbook covers how to route these logs into your monitoring tools.
Control | What it governs | Where it lives |
End-user credentials | Whose identity the agent uses | Copilot Studio tool settings |
Per-user authentication | Which records each user can retrieve | Source system RBAC through Connect AI |
Connection permissions | Which operations each user can run | Connect AI Permissions tab |
Agent registry and tool approval | Which agents and MCP servers are allowed | Agent 365 in the Microsoft 365 admin center |
Query and audit logs | Who accessed what, and when | Connect AI logs |
Troubleshooting: why your Copilot agent still gives generic answers
A generic answer usually means the agent never reached your systems and fell back on general model knowledge. A few causes account for most cases.
Missing tool: Add the Connect AI tool to the agent and turn on generative orchestration, which MCP tools require.
No sign-in: With end-user credentials, each user has to sign in to the connection before the agent can call it.
No source access: If the user has no rights in the source, an empty result is correct and shows the permission chain is working.
Missing context: The agent can reach a source and still miss the right field. Connect AI’s per-source MCP instructions describe each system’s structure and business definitions, so the agent finds the right data.
Most of these take a few minutes to rule out in Copilot Studio and the Connect AI console. Run this check before you escalate.
Look for the Connect AI tool on the agent’s Tools page.
Check that generative orchestration is turned on.
Make sure the user has signed in to the connection.
Verify the user has access to both the source and the Connect AI connection.
Open the activity map in Copilot Studio to see which MCP tool the agent called.
Bring enterprise data in your Copilot agent with CData Connect AI
With one governed AI gateway connection in place of dozens of point-to-point integrations, your security team approves a single layer that inherits the permissions your source systems already enforce.
To build your first Copilot agent, follow the Connect AI quickstart, which sets up a Copilot Studio agent on sample data in a few minutes.
When you’re ready for Salesforce, SAP, or Workday, see the Copilot integration page and start a 14-day free trial of CData Connect AI.
Frequently asked questions
What types of enterprise data can a Copilot agent access?
Inside Microsoft 365, an agent can use Microsoft Graph content such as files, mail, and Teams messages. Through CData Connect AI, it can also query hundreds of outside systems, including Salesforce, SAP, NetSuite, Snowflake, and Workday.
Does a Copilot agent access data that the user isn’t already authorized to see?
For Microsoft Graph content, no. For external sources, it depends on the tool’s credentials. With end-user credentials in Copilot Studio and per-user authentication in Connect AI, the agent returns only what that user can already see.
Is it safe to use confidential company data with a Copilot agent?
It can be, once identity and logging are set up correctly. Microsoft states that prompts, responses, and Microsoft Graph data aren’t used to train Copilot’s foundation models. For outside systems, per-user authentication keeps source permissions in force, and Connect AI logs every query.
What do I need before I can connect a Copilot agent to enterprise data sources like Salesforce or SAP?
You need Copilot Studio access, Copilot Credits or Microsoft 365 Copilot licenses, and Microsoft Entra identity for sign-in. You also need a CData Connect AI account with at least one source connected. Agent 365 is optional.
Why is my Copilot agent giving generic answers instead of pulling from my company’s live data?
Usually the agent never reached your systems. Check that the Connect AI tool is attached, generative orchestration is on, and the user has signed in to the connection. The activity map in Copilot Studio shows which tool the agent called.
How do admins control which data sources and users a Copilot agent can access?
In the Power Platform admin center, admins can block maker-provided credentials so every tool runs as the signed-in user. In Agent 365, they approve or reject MCP servers. In Connect AI, they set per-user authentication and operation-level permissions on each connection.
What’s the difference between a Copilot agent and Copilot Studio when it comes to enterprise data access?
A Copilot agent is the assistant your users talk to in Microsoft 365 Copilot, Teams, or SharePoint. Copilot Studio is where you build it and attach tools such as MCP servers, which is how it reaches data outside Microsoft 365.
