Microsoft Copilot Studio
Connect a Microsoft Copilot Studio agent to the FinologeeBKO MCP server
Introduction
A Microsoft Copilot Studio agent connects to the FinologeeBKO MCP server as a custom MCP server tool, so the agent can use FinologeeBKO data and actions in its conversations. The agent acts under the rights of the user who signs in and follows the same signatory-rule approvals that apply elsewhere on the platform.
Only Copilot Studio agents can be connected to the MCP server.
Prerequisites
Before connecting, make sure you have:
- The MCP server enabled for your tenant. Contact [email protected] to request it.
- The Copilot Studio callback registered for your tenant's OAuth client. Ask [email protected] to register
https://global.consent.azure-apim.net/*before you start: without it, authentication fails even when every other setting is correct. - Your MCP endpoint URL and OAuth client ID. See MCP server for where to find these.
- A Microsoft Copilot Studio environment in which you can create or edit agents and add tools.
Adding the MCP server to your agent
- Open Microsoft Copilot Studio and create or open the agent that will use FinologeeBKO
- Open the agent's Tools configuration and select Add a tool
- Choose Model Context Protocol (MCP), then Add a custom MCP server
- Enter a descriptive name, for example
FinologeeBKO - Set the server URL to your MCP endpoint URL, for example
https://<your-tenant-host>/mcp - Set the authentication type to OAuth 2.0 and fill in the OAuth settings:
| Setting | Value |
|---|---|
| Client ID | Your OAuth client ID |
| Client secret | Any non-empty value, for example none |
| Authorization URL | https://idp.finologee.com/auth/realms/services/protocol/openid-connect/auth |
| Token URL | https://idp.finologee.com/auth/realms/services/protocol/openid-connect/token |
| Refresh URL | https://idp.finologee.com/auth/realms/services/protocol/openid-connect/token |
| Scopes | openid profile microprofile-jwt phone email offline_access address enpay-scope |
- Save the authentication settings
Client secretThe FinologeeBKO OAuth client is public and does not use a secret. Copilot Studio still requires a value in the Client secret field to create the connection, so enter any non-empty placeholder. Separate the scopes with spaces.
Authenticating
Start the sign-in flow from the tool. A browser window opens at the FinologeeBKO login page. Sign in with your FinologeeBKO credentials and approve access when prompted. The connection becomes available to the agent, and the agent discovers the FinologeeBKO tools.
Verifying the connection
Confirm the connection is working:
- Check that the agent lists tools namespaced
bko__<domain>__<verb>, for example:bko__cash_account__find_cash_accountsbko__counterparty__get_counterparties
- Ask the agent something that uses a tool, such as "list cash accounts", and confirm the tool runs.
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| Authentication callback rejected | The Copilot Studio callback https://global.consent.azure-apim.net/* is not registered for your OAuth client. Contact [email protected]. |
| The connection cannot be created without a client secret | Enter any non-empty value in Client secret. |
| Invalid scopes or insufficient scope | Check the Scopes value for typos: it must include openid and enpay-scope, separated by spaces. |
| Token issued for a different host | The server URL does not use your tenant's FinologeeBKO host. Use the same host as your FinologeeBKO login page. |
| Tools are missing, or a tool call is denied | Your account lacks the FinologeeBKO rights required for that action. Each tool requires its own permission. Review your permissions with your administrator. |
401 Unauthorized after a while | The session expired. Disconnect and reconnect the MCP server, then sign in again. |
Best practices
- Grant the minimum rights — The agent can do everything the signed-in user can do. Use an account whose rights match what the agent needs
- Review before enabling write actions — Test the agent with read questions before letting it create or change data
- Keep one connection per tenant — Scope each connection to the tenant it is meant for
- Remove unused connections — Disconnect the MCP server from agents that no longer need it
Related documentation
Explore related sections for more information:
- MCP server - Overview, rights, and connection values - Concepts, the rights model, and where to find your MCP URL and client ID
- Claude - Connect Claude to the MCP server - Setup for the Claude Code CLI, Claude Desktop, and claude.ai web
- ChatGPT - Connect ChatGPT to the MCP server - Setup for the ChatGPT custom connector
- Mistral - Connect Mistral to the MCP server - Setup for the Mistral Vibe custom connector
- Permissions - Access control and role-based permissions - Understanding the rights enforced for every MCP tool invocation
Support
For assistance connecting Microsoft Copilot Studio to the MCP server, contact [email protected].
Updated 8 days ago