Technology · Platform

Microsoft Copilot Studio

I expose a trimmed, authenticated tool surface to Microsoft Copilot Studio through an edge proxy, and worked out from the wire why its connector stalled after initialisation.

Auth and access planeConnector behaviour read from the wireAn edge proxy in front
Copilot StudioEntra tokens
Edge proxyanswers the probe
MCP servertunnel only
  • ≈300lines in the edge proxy
  • 21tools for desktop assistants, over a local transport
  • 8tools offered to Copilot Studio

Reading the connector from the wire

I wanted Microsoft Copilot Studio agents to call tools on my private MCP server in the Auth and access plane, and I wanted that server to accept no public connection. The standard MCP OAuth path stalled right after initialize, and Copilot Studio's MCP connector was thinly documented. I decided to work out its behaviour from the wire and build around what it actually does.

I read the connector's traffic end to end in edge logs and wrote it down as observed fact, which made each proxy decision traceable to something the connector does.

Connector traffic
reachability probe
tool listing and calls
cached 401s after a fix, until the connection is recreated
Observed on the wire · and what the proxy does about it
  • An unauthenticated reachability check comes first; nothing else follows unless it returns the server's capabilitiesno credentials
  • Real tool listing and tool calls carry an Entra bearer token and context headers naming the caller's tenanttenant pinned
  • A configured query parameter can be renamedmatch by value
  • Microsoft's API hub caches responses for minutes, so stale 401s and 404s outlive a fixreconnect

An edge proxy as the only public surface

From that I built a small edge proxy. It answers the discovery probe without credentials: authentication applies to operations and stays off the reachability probe, because gating the probe makes the connector stop.

On every real call it checks the tenant-pinned Entra JWT, an RS256 signature against cached signing keys plus tenant and application checks, or it matches a high-entropy key by value, which survives the vendor renaming the parameter. For defence in depth it compares the tenant header with the token.

Entra token
High-entropy key
Tenant header differs
Trivial method
edge proxyprivate tool server
The tool server binds privately, and calls reach it with a server-held bearer token.

My OAuth server also carries client profiles for Copilot Studio. The JavaScript page covers the edge implementation, and the Zero inbound network exposure page covers the pattern.

A tool surface shaped for the connector

I also built a weather-intelligence MCP server shaped for Copilot Studio. It has two surfaces, because the connector and its users need fewer, simpler tools than a desktop assistant.

Desktop assistants · local transport
Copilot Studio · Streamable HTTP
The Copilot Studio surface exposes the session header its connector needs.

I packaged it as a container and later ported it to .NET on the official MCP C# SDK. The consent model behind both is in The hardening fix that locked everyone out.

The integration holds up against the connector's quirks without opening my estate. Copilot Studio is Microsoft's platform; the proxy, the tool surfaces and the connector findings are mine.

When a vendor platform is under-documented, I learn it from the wire.