Adding a Scanner for Microsoft 365 Copilot
Add a scanner to discover, import, and sync Microsoft 365 Copilot agents into Exchange. Then you can govern the agents and consume them in other applications.
The scanner discovers declarative agents and custom engine agents in Microsoft 365 Copilot. The scanner reads agent metadata from the Microsoft Graph Package Management API. It does not change your agents.
|
The scanner counts toward the service capacity limit of 20,000 services. The Scanners page shows the capacity your organization has used. |
Before You Begin
Before you add the scanner, make sure you have these accounts, permissions, and values so the scanner can access and list agents:
-
Prerequisites:
-
A Microsoft tenant with a Microsoft Agent 365 license. Without the license, the scanner cannot read agents.
-
A Microsoft Entra app registration to generate the necessary credentials. The scanner supports client-credentials OAuth only.
-
-
Required configuration values:
-
Tenant ID (Directory ID)
-
Client ID (Application ID)
-
Client secret
-
-
Required permissions:
Admin consent for the
CopilotPackages.Read.AllMicrosoft Graph application permission.
Configure Microsoft Entra ID
To configure Microsoft Entra ID before you add a scanner, review these high-level steps. For details, see the Microsoft Entra documentation.
-
Create an app registration:
-
In the Microsoft Entra admin center, click App registrations, and then register a new application.
-
Create a client secret and copy the value.
-
Record the tenant ID, client ID, and client secret. You need these values when you add the scanner in Exchange.
-
-
Add the Microsoft Graph permission:
-
From the app registration, click API permissions, and then click Add a permission.
-
Click Microsoft Graph, and then click Application permissions.
-
Search for
CopilotPackages.Read.All, select it, and click Add permissions. -
Grant admin consent, which is required for Microsoft Graph application permissions:
-
If you have permission to grant tenant-wide consent, click Grant admin consent for <tenant_name> and confirm.
-
If you do not have permission, ask your Microsoft Entra administrator to grant consent.
-
-
Before you continue, verify that the status of the permission is Granted for <tenant_name>.
-
Add a Scanner for Microsoft 365 Copilot
-
Verify that you are in the business group where you want to add the scanner.
-
From the sidebar in Exchange, click Scanners.
-
Enter a name for the scanner. Optionally, enter a description.
-
From Scanner Run Configuration, complete these fields or options:
Field/Option Value Run Schedule
Select a frequency and time.
Sync Review
Select an option: Ask to review or Auto-resolve.
-
From Connection Configuration, complete these fields:
Field Value Provider
Select Microsoft.
Platform
Select Microsoft 365 Copilot.
Service Type
Agents is set automatically.
Authentication Method
OAuth is set automatically.
Tenant ID
Enter the tenant ID.
Client ID
Enter the client ID.
Client Secret
Enter the client secret.
-
Click Test connection.
If the connection fails, review the Connection Configuration settings. Update the settings, and then test the connection again.
-
To send email notifications:
-
Select Advanced Settings and turn on Send Email Notifications.
-
Enter an email address.
-
-
Click Add Scanner.
Information the Scanner Imports
For each agent it discovers, the scanner imports this information when it’s available:
-
Name
-
Description
-
Publisher
-
Version
-
Package type
-
Availability
-
Deployment status
-
Blocked status
-
Owner ID, creation date, and last modified date of the catalog package
For declarative agents, the scanner also imports the agent instructions, truncated to 2,000 characters. For custom engine agents, the scanner imports the foundation model if the agent manifest identifies one.
The owner and dates describe the catalog package, not the agent. The scanner doesn’t import supported host products. Declarative agents use the managed models in Microsoft 365 Copilot, so the scanner doesn’t import a foundation model for them.