Connecting a Copilot Studio agent to your systems with the Model Context Protocol (MCP) means adding an MCP server as a tool, at which point Copilot Studio auto-discovers everything that server exposes — its tools and resources — and keeps them current as the server changes. MCP reached general availability in Copilot Studio on May 29, 2025, and because MCP servers ride on Power Platform connector infrastructure, they inherit the enterprise controls you already run: data loss prevention (DLP) policies, virtual network integration, and multiple authentication methods.

This guide is written for the IT architects, platform owners, and security leads who have to decide how their organization wires agents into line-of-business systems — and govern the result. It covers what MCP is, how it differs from a traditional custom connector, the exact steps to connect a server, where the governance boundary actually sits, and what the approach costs to run.

Key Takeaways

• MCP is an open standard, not a Microsoft feature. Anthropic introduced it on November 25, 2024 as a universal way to connect AI applications to tools and data — often described as "USB-C for AI."
• It went GA in Copilot Studio on May 29, 2025. You add a server through the MCP onboarding wizard, and generative orchestration must be turned on for MCP to work.
• MCP servers run on connector infrastructure. That means they inherit Power Platform DLP, virtual network integration, and OAuth or API-key authentication rather than bypassing them.
• Auto-discovery is the core advantage over custom connectors. Each tool a server publishes appears automatically with its name, inputs, and outputs, and updates or removals are reflected without a rebuild.
• DLP governs the wiring, not the words. Connector data-group policy controls which sources an agent can combine at design time; it does not inspect what a live response actually returns.
• The failure mode is the misconfigured server, not the protocol. Microsoft's own guidance is secure-by-default: vetted servers behind a gateway, short-lived least-privilege tokens, and consent before an agent makes changes.

The short answer: how MCP works in Copilot Studio

MCP lets an agent connect to an external server that advertises three kinds of capability. Copilot Studio consumes the first two today.

• Tools: functions the language model can call to perform an action, such as looking up an order or creating a ticket.
• Resources: file-like data an agent can read for context, such as API responses or file contents.
• Prompts: predefined prompt templates for specific tasks — part of the MCP spec, though Copilot Studio currently supports tools and resources.

When you connect a server, every tool it publishes becomes an available action that inherits the server's name, description, inputs, and outputs. As the server team adds, changes, or retires a tool, Copilot Studio reflects that automatically — so the integration maintains itself instead of drifting out of date. One server can expose many tools, and each is individually callable by the agent.

What is the Model Context Protocol (MCP)?

MCP is an open-source standard for connecting AI applications to external systems, introduced by Anthropic in November 2024 and since adopted across the industry. Before MCP, every AI application needed bespoke plumbing to reach each tool or data source; the standard replaces that fragmented, one-off connector code with a single, shared interface. Microsoft joined the MCP steering committee in 2025 and co-authored the official C# SDK, signaling that MCP is now a first-class integration path across its stack, not an experiment.

The architecture has three roles. An MCP host is the application the user interacts with; an MCP client is the protocol layer that handles messages; and an MCP server is the tool provider that exposes capabilities. In the Copilot Studio pattern, your agent is the client, and the server can run inside your own infrastructure or be a remote, certified server from a vendor. Copilot Studio focuses on remote servers over streamable HTTP transport, with OAuth or API-key authentication — the pattern enterprises need for a secure, auditable channel.

MCP vs. a traditional custom connector: which should you use?

MCP does not replace custom connectors — MCP servers are surfaced through connector infrastructure. The practical decision is whether you wire a system in once as a static custom connector, or expose it through an MCP server that publishes a self-updating catalog of tools. The difference shows up most in maintenance and in how many capabilities you expect to grow over time.

MCP server vs. custom connector, compared

Custom connector (traditional)

• Tool discovery: Each action is defined and maintained by hand in the connector definition.
• Change handling: A new capability on the backing API requires editing and redeploying the connector.
• Best for: A stable API with a small, fixed set of operations.

MCP server

• Tool discovery: The server advertises its tools and resources, and Copilot Studio adds them automatically.
• Change handling: Tools added, changed, or removed on the server are reflected in the agent without a rebuild.
• Best for: A system whose capabilities evolve, or a server you want portable across multiple AI clients.

The portability point matters for architecture decisions. Because MCP is an open standard, a server you build for Copilot Studio also works with other MCP clients with no code changes — so the integration investment is not locked to a single platform.

How do you connect an MCP server to a Copilot Studio agent?

The path from an existing server to a working, callable tool is short. Microsoft documents it as an onboarding-wizard flow, and the sequence looks like this.

1. Turn on generative orchestration for the agent — MCP will not function without it.
2. Have or build a server. Use an existing certified MCP server, or create your own with one of the available SDKs to expose your tools and data.
3. Run the MCP onboarding wizard from the agent — in the maker experience this is "Add a Tool" — and point it at the server URL.
4. Authenticate using OAuth or an API key stored in Power Platform connector security, and approve the consent prompt.
5. Add the server's tools and resources to the agent, then test each tool call in the test pane before publishing.
6. (Optional) Publish the connector so it can be reused across environments or tenants.

The one prerequisite teams overlook is generative orchestration. If it is off, the MCP server can be added but the agent will not reason its way into calling the tools — a silent dead end that looks like a broken integration.

How is MCP governed in Copilot Studio?

Because MCP servers connect through Power Platform connectors, they fall under the same DLP model as any other connector. In the Power Platform admin center, administrators sort connectors into three data groups — Business, Non-business, and Blocked — and the platform prevents connectors in different groups from sharing data inside the same agent. Critically, blocking the underlying Power Platform connectors also blocks access to the tools in a connected MCP server, so your existing DLP posture extends to MCP by default. Data-policy enforcement has been mandatory for all tenants since early 2025; the old ability to exempt an agent no longer exists.

That control is real, but it has a precise limit worth naming. DLP data groups govern which connectors can be wired together at design time — they do not inspect the content a compliant connector returns during a live conversation. An approved Business-group tool can still surface personally identifiable information or secrets embedded in the records it retrieves. The connector passed policy; the response was never inspected.

With MCP, the risk was never the protocol — it is the one misconfigured server that hands your agent the keys to data it should never touch.

This is why Microsoft's own internal guidance treats MCP as a communications-security problem, not just an API question. Their secure-by-default pattern is instructive: register every remote server behind an API gateway so there is a single place to authenticate, authorize, rate-limit, and log; allow only vetted, attested servers; issue short-lived, least-privilege tokens scoped to the right audience; require explicit user consent before an agent makes changes; and verify tool descriptions on connection so a silently altered tool is blocked rather than trusted. The throughline is ownership and inventory — knowing which servers are "in the room" and noticing when one drifts.

Getting that boundary right is exactly the kind of work BabyBots does in a fixed-fee Copilot Studio governance engagement — mapping which servers and connectors an agent may touch, wiring DLP and authentication to match your data classes, and standing up the inventory and runtime controls that keep a compliant configuration compliant after go-live. Our guide to governing AI agents in Copilot Studio covers the identity and oversight layer that sits underneath this.

What does connecting agents with MCP cost?

MCP itself is a protocol, not a licensed product — there is no per-server fee to speak of. The cost lands in two familiar places: the Power Platform connector and environment posture you run the servers through, and the Copilot Studio consumption the agent burns when it reasons over and calls those tools. Because MCP requires generative orchestration, tool-heavy agents lean on reasoning, and reasoning is where Copilot Credits accumulate. Every live MCP call also consumes context window, so a chatty multi-tool agent costs more per turn than a single scripted lookup.

The right way to budget is to model the agent's real tool-call pattern rather than the sticker price of the platform. For the full credit rate card and how architecture — not headcount — drives the bill, see our breakdown of what AI agents actually cost in Microsoft 365.

Frequently Asked Questions

When did MCP become generally available in Copilot Studio?

Microsoft announced general availability of MCP integration in Copilot Studio on May 29, 2025, following a public preview that began in March 2025. GA added capabilities including a tool-listing view on the server settings page, streamable transport, and enhanced tracing that shows which MCP server and tool were invoked at runtime.

Do I need a special license to use MCP in Copilot Studio?

MCP is an open standard with no separate license. You need Copilot Studio to build and run the agent, generative orchestration enabled, and the Power Platform connector and environment entitlements the server's connectivity requires. End users typically consume the finished agent through their existing seat rather than needing premium licenses of their own.

Does MCP bypass my existing DLP and security controls?

No. MCP servers are made available to Copilot Studio through connector infrastructure, so they inherit Power Platform DLP data groups, virtual network integration, and authentication controls. Blocking the underlying connectors also blocks the tools in a connected MCP server. The gap to plan for is runtime: DLP governs which connectors can combine, not the content a live response returns.

What is the difference between an MCP server and a custom connector?

A custom connector defines each action by hand and must be edited when the backing system changes. An MCP server advertises its own tools and resources, which Copilot Studio discovers and keeps current automatically. MCP servers actually run on connector infrastructure, so the choice is about self-updating breadth and portability versus a fixed, hand-maintained action set.

Can external MCP servers reach my internal data?

Only to the extent you allow. When you connect to a non-Microsoft or external server, you are responsible for the tools and resources you expose to it, and administrators can restrict access through DLP, endpoint filtering, and authentication scopes. Microsoft's recommended pattern is to route remote servers through an API gateway, use only vetted servers, and pass the minimum context each tool needs.

What transport and authentication does Copilot Studio use for MCP?

Copilot Studio focuses on remote servers over streamable HTTP transport; the older SSE transport has been deprecated and remains in preview only. Authentication uses OAuth or an API key stored in Power Platform connector security, which gives enterprise tenants a secure, auditable channel and lets you scope what each server is permitted to do.

Where this is heading

MCP is consolidating into the default way agents reach tools and data across the major AI platforms, which means the integration you build once becomes increasingly portable and increasingly central to how work gets done. The organizations that win with it will not be the ones that connect the most servers fastest — they will be the ones that treat every server as a governed identity with an owner, a scope, and an audit trail. As agent estates grow, that inventory-and-ownership discipline is what separates a scalable platform from the next generation of shadow IT.

Connect your systems to Copilot Studio — governed from day one

If you are deciding how to wire your agents into line-of-business systems with MCP, book a BabyBots Copilot Studio integration assessment. In a single working session we map your target systems, the servers and connectors each agent needs, and the DLP, authentication, and inventory controls to govern them — so you leave with a build plan, not a pilot. Start the conversation at babybots.ai.

Sources

• Microsoft Copilot Blog — MCP is now generally available in Microsoft Copilot Studio (May 29, 2025)
• Microsoft Copilot Blog — Introducing MCP in Copilot Studio (March 19, 2025)
• Microsoft Learn — Extend your agent with Model Context Protocol (updated Aug 26, 2026)
• Microsoft Learn — Configure data policies for agents (Copilot Studio DLP)
• Microsoft Inside Track — Protecting AI conversations with MCP security and governance (Feb 12, 2026)
• Anthropic — Introducing the Model Context Protocol (Nov 25, 2024)
• Model Context Protocol — Official documentation and specification