Microsoft 365 Copilot agent#

The Reportworq Microsoft 365 Copilot agent lets Copilot users ask about their reports in natural language, in chat, Teams, and the Microsoft 365 app, without leaving Copilot. The agent reaches your on-prem instance over the outbound-only CloudHub relay, and every request runs as the signed-in user, scoped to the reports, folders, and workspaces that user is allowed to see.

This is a two-role task. A Reportworq administrator generates the agent package. A Microsoft Entra Global Administrator grants one-time consent and deploys it to users.

When to use it. Reach for the Copilot agent when your organization has standardized on Microsoft 365 Copilot and wants governed, identity-scoped access to distributed reports, and when you cannot or do not want to expose an inbound endpoint. Desktop AI clients such as Claude Desktop use the MCP shim instead, and air-gapped deployments use direct on-prem MCP. See Copilot, MCP, and trust paths.

Before you begin#

• The on-prem instance is registered with CloudHub (Enable Cloud API / the Cloud Connector is on). See Copilot, MCP, and trust paths.
• The instance is in OAuth access mode with the CloudHub relay channel enabled and a Cloud API key configured. The Copilot recipe only appears once these are set, because the production Copilot experience is per-user identity.
• You have the Cloud API URL (the CloudHub base URL) and the Cloud API key (the CloudHub connector key) to hand.
• A Microsoft Entra Global Administrator is available for one-time consent and deployment, and agent users have Microsoft 365 Copilot licenses.

Generate the agent package (administrator)#

1. Open Settings ▸ AI Agent Access (MCP).

2. Expand the Connect: Microsoft 365 Copilot recipe.

3. Fill in the package fields. Sensible defaults are supplied for each:

   Field	Notes
   Agent name	Defaults to "Reportworq". Shown to Copilot users.
   Description	A short and a long description; defaults supplied.
   Instructions	Guidance the agent follows. Reportworq appends a fixed response-style policy that always wins.
   Conversation starters	Up to six suggested prompts, for example "What reports are available?". Four defaults supplied.
   Color and outline icons	Defaults shipped; if you replace them, match the exact required dimensions.
   Cloud API URL	The CloudHub base URL. Required.
   API key	The CloudHub connector key. This is a routing key, not a workspace selector.

4. Choose Download to get the agent package (.zip) and note the admin-consent link.

5. Hand the .zip and the consent link to your tenant's Microsoft Entra Global Administrator.

The agent's identity is stable across API-key rotations, so a later re-download uploads as an update, not a duplicate. Regenerate and re-upload the package after a Reportworq upgrade that changes the tool surface, because Microsoft 365 captures the tool list at deployment time.

Deploy the agent in Microsoft 365 (Entra Global Administrator)#

1. Grant one-time admin consent using the link supplied by the Reportworq administrator. The Reportworq Copilot application is a multi-tenant Entra app, so it works across tenants with tenant consent and no per-customer registration.
2. Deploy the package to users or groups. In the Microsoft 365 admin center, go to Settings ▸ Integrated apps and upload the agent .zip, then assign the recipient users or groups.
3. Consider a staged rollout: deploy to a small test group first, validate against Reportworq, then widen.

A Global Administrator can revoke the application at any time under Entra Enterprise applications.

Use the agent (integration user)#

The first time they use the agent, a Copilot user signs in with their Microsoft 365 work account. From then on, results are automatically limited to their Reportworq permissions. They can, for example:

• Ask what reports are available.
• Ask for the figures in the latest quarterly forecast, answered from the report's content.
• Ask the agent to email a report in a chosen format, confirming the recipient first.
• Ask it to compare two runs of a report, quoting the source values from each.

Notes and limits#

• Downloads of large outputs go by identity-gated link or email. A small output is returned inline in the conversation. A large one is handed a CloudHub download link that only the user it was issued to can retrieve. If your policy keeps download links off, oversized outputs are emailed instead and small ones still return inline.
• The package holds no standing credentials. Entra issues short-lived per-user tokens; a token reaches a given instance only over that instance's own relay connection.
• Regenerate after a tool-surface upgrade. Microsoft 365 captures the function list at deployment time, so a Reportworq upgrade that adds or changes tools requires a re-download and re-upload.

Going deeper. For the outbound-only relay model, the identity-versus-network security boundary, and how the same tools reach desktop clients, see Copilot, MCP, and trust paths. Every agent request is recorded; see MCP audit.