# AI connectors and MCP servers: how to control which assistants reach your business apps, and where Microsoft's tools stop > Where an AI assistant's connection to your business apps is approved, who can see it and how to revoke it: Entra, Copilot, Agent 365 and third-party apps. Canonical: https://o365hq.com/blog/ai-connectors-and-mcp-servers-how-to-control-which-assistants-reach-your-business-apps Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book Published: 2026-11-11 · IT Partner A connection between an AI assistant and a business app is approved wherever the app being reached hands out the permission. For Microsoft 365 data that is Microsoft Entra consent. For Microsoft 365 Copilot and Copilot Studio it is the Microsoft 365 admin center and Power Platform data policies. For Agent 365 it is the Tools page. For a third-party assistant connected to a third-party app it is the two vendors' own admin settings, which Microsoft's tools do not see. Each case below says where the permission is granted, who approves it, where it is visible and how to revoke it. ## What a connector and an MCP server are A connector is a saved, authorized link from an assistant or agent to another system. It holds a credential, usually an OAuth token issued when a person or an administrator selects Allow, sometimes an API key, and lets the assistant read data or act there. Microsoft's Power Platform documentation (14 October 2026) says the same: a connector wraps an application's API, and a connection is a saved credential. A Model Context Protocol (MCP) server is the standardized far end of that link. The MCP specification (version 2026-07-28, under Sources) defines MCP as an open protocol connecting LLM applications to external data sources and tools; a server offers resources, prompts and tools the model can run. Authorization is optional and built on OAuth 2.1, and the specification says the protocol cannot enforce consent itself. The question is the same for both: who issued the credential, to which assistant, with what scope. Our own [o365hq.com MCP server](/blog/connect-the-o365hq-mcp-server-to-chatgpt-claude-copilot-gemini-and-grok-prices-quotes-and-services-from-your-ai-agent) sits at the low-risk end: no sign-in, so no token to anything of yours. ## Case 1: an assistant connected to Microsoft 365 mail, files, SharePoint or Teams When a third-party assistant asks for mail, files, SharePoint or Teams data, the permission lives in Microsoft Entra ID and the connector appears as an enterprise application in your tenant. - **Granted:** in Entra, as delegated permissions (the app acts as the signed-in user) or application permissions (no user present). - **Approved by:** whoever Enterprise apps > Consent and permissions > User consent settings allows. Under the Microsoft-managed setting, the default for a new tenant, users cannot consent to permissions such as Mail.Read, Files.Read.All, Sites.Read.All or Chat.Read (Microsoft Learn, 22 January 2026). With the admin consent workflow on, the user requests approval and a reviewer decides. A Privileged Role Administrator can grant any permission; a Cloud Application Administrator, Application Administrator or AI Administrator all except Microsoft Graph application permissions. - **Seen in:** Enterprise apps > the app > Permissions (Admin consent and User consent tabs) and the sign-in logs, which record user, client application and resource. App governance in Defender for Cloud Apps monitors OAuth apps and has been part of that license since June 2023 ([licensing paths](/blog/defender-for-cloud-apps-licensing-and-pricing-standalone-vs-e5-vs-defender-suite)). - **Revoked by:** selecting Revoke permission on the Admin consent tab; user consent grants need Microsoft Graph or PowerShell. Setting Enabled for users to sign in to No stops tokens being issued. Tightening the consent setting affects future consent only; existing grants stay until revoked. [One worked example](/blog/microsoft-365-copilot-vs-chatgpt-business-and-enterprise-for-a-microsoft-365-organization) shows another vendor's SharePoint connector. ## Case 2: Microsoft 365 Copilot and Copilot Studio reaching outside data There are three routes. **Copilot connectors.** Microsoft's overview (30 September 2026) describes synced connectors, which index external content into Microsoft Graph, and federated connectors, which fetch content at query time over MCP and store nothing in Graph. AI Administrators generally set them up; consenting to the Graph permissions can need a Global Administrator unless that right is delegated. A deployed connector is tenant-wide unless access to its items is restricted. **Agents.** In the Microsoft 365 admin center, Agents > All agents > Registry lists agents from Microsoft, external publishers and your own makers. An agent's Data & tools tab shows its knowledge sources, connectors and MCP servers (read-only, and not populated for every agent); its Permissions tab shows what it was granted. An AI Administrator or Global Administrator approves, installs, blocks or deletes agents. **Copilot Studio agents.** Connectors and MCP tools are governed in the Power Platform admin center. Classic data policies (Security > Data and privacy > Data policy) are set tenant-wide by a Power Platform Administrator or per environment by its admin. Advanced connector policies (9 September 2026) allow only listed certified connectors and can block a whole MCP server, though not single tools; custom connectors still need classic policies. A blocked connection is disabled, in most cases within an hour. [Power Platform Governance and Center of Excellence Setup](/services/power-platform-governance-center-of-excellence) ($4,950 per project, an estimate confirmed as a fixed written quote; three weeks) sets up the data policies; the [Copilot Studio Agent Security Review](/services/copilot-studio-agent-security-review) ($2,950, two weeks) tests one agent's connectors and tools. See also the [platform comparison](/blog/copilot-studio-vs-azure-ai-foundry-which-agent-platform-what-it-costs-and-when-to-bring-us-in). ## Case 3: agents registered in Agent 365 Microsoft documents Agent 365's tooling in the same Agents area of the Microsoft 365 admin center. What its pages say about tools and MCP servers: - **A Tools page** lists the AI tools and MCP servers available in the organization, with Block tool and Unblock tool actions; agents cannot reach a blocked tool. Microsoft's own servers appear there (Work IQ Mail, Calendar, Teams and SharePoint among them). The page dated 1 May 2026 limits the feature to Frontier tenants and says allowing or disallowing MCP servers was still rolling out. - **Your own remote MCP servers** can be registered through the Agent 365 CLI (preview, 28 October 2026); administrators then review, approve, consent to, block and monitor them in Agent Tools. - **Gateways.** With Azure API Management (preview, 24 September 2026), Agent 365 inventories the MCP servers behind your gateways and blocks or unblocks them. - **Identity.** An agent extended with the Agent 365 SDK gets a Microsoft Entra-backed agent identity. A Microsoft 365 E7 or Agent 365 license is needed for the registry's Risks column and an agent's Security tab (21 April 2026); the Learn pages do not state which license the Tools page itself requires, and Microsoft's licensing FAQ lists tool controls for agents among the capabilities that need an Agent 365 license. [Agent 365](/subscriptions/agent-365) is $15.00 per user per month on our November 2026 price list (annual commitment, billed annually). The pages we read describe no inventory of connectors inside another vendor's assistant. The [AI Agent Inventory and Lifecycle Governance Implementation](/services/ai-agent-governance-implementation) ($4,950 fixed, three weeks, up to 25 agents) builds the registry; our [agent governance article](/blog/agent-governance-microsoft-365-ai-2026) covers ownership. Who has to hold an Agent 365 license is answered in [our Agent 365 licensing article](/blog/microsoft-agent-365-what-it-does-licensing-and-who-needs-a-license). ## Case 4: a third-party assistant connected to a third-party app One IT team we spoke with in November 2026 asked about this case: an employee connects an approved assistant to another business app, and neither end is Microsoft's. - **Granted:** in the business app, which shows its own authorization screen and issues a token to the assistant, or through an API key the employee pastes. Unless that app uses Microsoft Entra as its authorization server, nothing is created in your tenant. - **Approved by:** the assistant's workspace admin (which connectors and custom MCP servers members may add) and the business app's admin (which outside apps may be authorized, who may create API tokens). - **Seen in:** the assistant's admin settings and audit log, and the business app's list of authorized apps and tokens. - **Revoked by:** removing the authorization or rotating the token in the business app, then removing the connector. Microsoft's tooling adds a perimeter: - **Single sign-on.** If both services sign in through Entra, Assignment required limits who gets a token for each, [Conditional Access](/services/microsoft-entra-id-conditional-access-policy-implementation) sets the conditions, and the sign-in logs show who signs in to which. - **Devices.** Defender for Cloud Apps discovers AI apps reached from managed devices and, with Defender for Endpoint, blocks those tagged unsanctioned ([implementation](/services/microsoft-defender-for-cloud-apps-implementation), $4,500 per project, 14 days; see [shadow AI](/blog/control-shadow-ai-microsoft-365-purview)). - **Network.** Microsoft Entra Internet Access, standalone or in the [Microsoft Entra Suite](/subscriptions/microsoft-entra-suite) ($12.00 per user per month, same price list), identifies traffic to AI apps and SaaS MCP servers; its MCP firewall (preview, 6 August 2026) allows or blocks remote MCP servers on devices running the Global Secure Access client with TLS inspection. What Microsoft's tooling cannot see: a grant made inside one non-Microsoft cloud service to another travels between those vendors' servers, not across your devices or tenant, so Microsoft's tools can neither list nor revoke it. One documented exception: app governance also covers OAuth apps on Google and Salesforce once those platforms are connected to it. ## Three risks and a one-page policy ### The risks - **A token that carries one person's full access.** A delegated permission lets the app act as the user, so within the scopes it was granted the connector reaches everything that person can open. A Copilot Studio agent shared with its maker's credentials embedded lends that access to every user; a preview setting in the Power Platform admin center (4 November 2026) blocks such sharing. - **Connections that outlive the project.** A grant stays until someone revokes it; the agent registry counts agents whose owner has left. - **Data copied to a place with different retention.** A synced connector indexes outside content into Microsoft Graph, and an assistant may keep what it fetched under its own retention. ### The policy 1. **Anyone may connect** an approved assistant to public or low-sensitivity sources with read-only tools. 2. **IT approves** any connector that reads company data; it runs under the person's own account with the narrowest scope offered. 3. **A named owner, a security review and an end date** for connectors that write, use application permissions or use API keys. 4. **Not allowed:** connectors in unapproved assistants and unreviewed custom MCP servers. Requests use one form: assistant, target app, read or write, data involved, owner, end date. For Microsoft 365 data the admin consent workflow is that form. Answer within a stated number of working days, because blocking has a cost: the people wiring tools together are often the ones trying to improve the work. Each quarter, export the Entra permissions, the agent registry, the Power Platform connections and each vendor's authorized-app list, and remove whatever has no owner or is past its end date. The register also answers customer contracts that ask where AI touches their data. A firm of thirty with one assistant can keep a single list instead, and a regulated organization may reasonably ban the third tier. Connectors are one of four layers. [AI governance in a Microsoft 365 organization](/blog/ai-governance-in-a-microsoft-365-organization-four-layers-and-the-order-to-build-them) sets out the other three and the order to build them. ## Checklist for the first two weeks **Days 1 to 5: see what exists** 1. Entra: note the User consent setting, turn on the admin consent workflow, and list enterprise apps holding mail, files, sites or chat permissions. 2. Microsoft 365 admin center: export the agent registry; note agents without owners. 3. Power Platform admin center: confirm a data policy covers the default environment. 4. Each approved assistant: record who may add connectors and custom MCP servers, and which are connected. 5. The five business apps with your most sensitive data: list authorized outside apps and API tokens. **Days 6 to 10: decide and close** 6. Set user consent to the Microsoft-managed setting or stricter, and revoke grants nobody claims. 7. Limit connector creation in each assistant to admins or an approved list, where the vendor offers it. 8. Put the assistant and those five apps behind Entra single sign-on with assignment required. 9. If Defender for Cloud Apps is licensed, tag the unsanctioned AI apps it discovered. 10. Publish the policy and the form, name an owner for the register, and book the first quarterly review. ## Frequently asked questions ### Does Microsoft's tooling govern a connector between two non-Microsoft apps? Not the connector itself. Microsoft Entra decides which apps company accounts may sign in to, Defender for Cloud Apps discovers and blocks AI apps on managed devices, and Microsoft Entra Internet Access can filter MCP traffic leaving them (preview). The grant is approved, seen and revoked in the two vendors' admin settings. ### Is an MCP server riskier than an ordinary connector? Not because it is MCP. The protocol standardizes how an assistant discovers and calls tools; the risk lies in what the tools can do and what the credential behind them can reach. Judge a server by its publisher, whether its tools read or write, and the scope requested. ### Can an employee connect an assistant to their mailbox without IT? It depends on the User consent setting in Microsoft Entra. If users may consent to all apps, yes. Under the Microsoft-managed setting, Microsoft's page dated 22 January 2026 lists mail, files, sites, calendar and chat permissions among those users cannot grant, so the request goes to an administrator. ### Do we need Agent 365 to control connectors? Not for the first, second or fourth case, which are handled in Microsoft Entra, the Microsoft 365 admin center, the Power Platform admin center and the vendors' own settings. Microsoft documents the Tools page for MCP servers and the risk views under Agent 365, which is $15.00 per user per month on our November 2026 price list; agent identity and the registry come with any Microsoft cloud subscription, per Microsoft's licensing FAQ. ### Should we buy a separate AI governance product? Count first. If most connections fall under the first three cases, the controls above cover them and a second product would duplicate them. If most run between non-Microsoft services, Microsoft's tools will not inventory them, and a product that reads those services' admin interfaces can be the right purchase. ## Sources - [Model Context Protocol specification, version 2026-07-28](https://modelcontextprotocol.io/specification/2026-07-28) — Model Context Protocol project, 2026-07-28 - [Manage app consent policies](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-app-consent-policies) — Microsoft Learn, 2026-01-22 - [Configure how users consent to applications](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent) — Microsoft Learn, 2025-06-15 - [Configure the admin consent workflow](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow) — Microsoft Learn, 2024-12-29 - [Grant tenant-wide admin consent to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent) — Microsoft Learn, 2025-03-25 - [Review permissions granted to enterprise applications](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-application-permissions) — Microsoft Learn, 2025-03-03 - [Properties of an enterprise application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties) — Microsoft Learn, 2026-10-20 - [What are Microsoft Entra sign-in logs?](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins) — Microsoft Learn, 2025-11-07 - [Microsoft 365 Copilot connectors overview](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/overview-copilot-connector) — Microsoft Learn, 2026-09-30 - [Grant administrative rights to AI Administrators to manage connectors](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/connector-admin-delegation) — Microsoft Learn, 2026-09-30 - [Build or reuse MCP servers](https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/build-reuse-mcp-servers) — Microsoft Learn, 2026-10-28 - [Agent management in Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-365-overview) — Microsoft Learn, 2026-04-21 - [Understand agent details in Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-details) — Microsoft Learn, 2026-04-21 - [Manage agent registry in Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry) — Microsoft Learn, 2026-05-01 - [Manage tools for agents in Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent) — Microsoft Learn, 2026-05-01 - [Govern tools with Microsoft Agent 365 and Azure API Management (preview)](https://learn.microsoft.com/en-us/azure/api-management/agent-365) — Microsoft Learn, 2026-09-24 - [Data policies](https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention) — Microsoft Learn, 2026-10-14 - [Manage data policies](https://learn.microsoft.com/en-us/power-platform/admin/prevent-data-loss) — Microsoft Learn, 2026-04-07 - [Advanced connector policies](https://learn.microsoft.com/en-us/power-platform/admin/advanced-connector-policies) — Microsoft Learn, 2026-09-09 - [Control sharing agents with embedded maker credentials (preview)](https://learn.microsoft.com/en-us/power-platform/admin/security/control-sharing-agents-with-embedded-maker-credentials) — Microsoft Learn, 2026-11-04 - [Configure Global Secure Access MCP firewall (preview)](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-mcp-firewall) — Microsoft Learn, 2026-08-06 - [Shadow AI discovery in Global Secure Access](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-shadow-ai-discovery) — Microsoft Learn, 2026-06-04 - [What is Global Secure Access?](https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-access) — Microsoft Learn, 2026-04-15 - [App governance in Microsoft Defender for Cloud Apps](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-manage-app-governance) — Microsoft Learn, checked 2026-11-11 (via search results) - [Govern discovered apps using Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-cloud-apps/mde-govern) — Microsoft Learn, checked 2026-11-11 (via search results) - [Microsoft Licensing FAQs: Microsoft Agent 365](https://www.microsoft.com/licensing/faqs/122) — Microsoft, checked 2026-11-11 - IT Partner price list, November 2026: Agent 365, Microsoft Entra Suite ## Key takeaways - A connector's permission is granted by the system being reached, so the place to approve, see and revoke it differs for Microsoft 365 data, Copilot, Agent 365 and third-party apps. - For Microsoft 365 data the control point is Microsoft Entra: user consent settings, the admin consent workflow, each enterprise application's Permissions tab and the sign-in logs. - Copilot connectors and agents are managed in the Microsoft 365 admin center, and Copilot Studio connectors and MCP servers through Power Platform data policies and advanced connector policies. - Microsoft documents an Agent 365 Tools page that blocks or unblocks MCP servers; its page dated 1 May 2026 limits the feature to Frontier tenants and says the rollout was still in progress. - A connection between two non-Microsoft cloud services is governed in those services' admin settings; Microsoft's tools see sign-ins with company accounts and traffic from managed devices, not the grant itself. - A one-page policy with three tiers, one request form and a quarterly review of granted permissions is enough for an organization of a few hundred people. --- If you want the inventory of agents, connectors and permissions built with your team, start with [AI Security for Microsoft 365 Copilot and Agents](/services/ai-security-microsoft-365-copilot-agents), a two to three week engagement from $6,950.