Skip to main content
Microsoft Copilot Studio lets a maker add a remote MCP server as a tool for any custom agent they build. Because this uses Copilot Studio’s own maker-to-server connection, Microsoft does not review or approve it — the agent stays inside your tenant unless you separately publish it through the M365 Agent Store. This guide covers the maker-side steps only; anything past adding the tool happens entirely inside Copilot Studio.
This is the fastest way to bring Interchange into Copilot: any maker with Copilot Studio access and an Interchange account can complete it without Microsoft’s involvement. It does not by itself list Interchange in a Microsoft-curated gallery.

​
Before you start

You need:
  • Microsoft Copilot Studio maker access in your tenant;
  • an Interchange buyer or seller account; and
  • your tenant admin’s confirmation that Interchange’s endpoint is allowed through any Data Loss Prevention (DLP) policy that governs custom connectors (see Tenant DLP below).

​
1. Add Interchange as a tool

  1. Open your agent in Copilot Studio and go to Tools.
  2. Select Add a tool → New tool → Model Context Protocol.
  3. Complete the server form:
  1. Save the tool. Copilot Studio requests the server’s tool list over MCP; review the discovered tools before publishing the agent.
Copilot Studio’s MCP connector speaks Streamable HTTP only — it does not support stdio or SSE-only servers. Interchange’s remote MCP endpoint is Streamable HTTP, so no adapter is needed; if a form step asks about transport, choose Streamable HTTP (sometimes labeled just “HTTP”).

​
2. Authenticate

Interchange supports OAuth 2.0 authorization-code sign-in with PKCE for MCP clients, including dynamic client registration (DCR) so a compliant host can register itself automatically rather than being issued a fixed client ID in advance (the same mechanism described in Authentication → MCP OAuth resource binding).
Verification status: Interchange’s OAuth flow, including DCR, is proven against several MCP hosts (see Built for Agents), but we have not yet completed end-to-end verification of DCR against Copilot Studio’s own connection wizard specifically. If Copilot Studio completes sign-in automatically when you save the tool, DCR is working for your tenant. If it does not, use the manual fallback below rather than treating the connection as broken.

​
Manual fallback: register a static client first

If Copilot Studio’s wizard does not complete an automatic OAuth handshake, register a client ahead of time instead of relying on DCR, then enter its credentials directly:
  1. Before registering anything, get the exact redirect URI Copilot Studio’s tool authentication form displays for your tenant. Microsoft’s OAuth redirect host is not the same for every cloud environment or region — https://token.botframework.com/.auth/web/redirect is the commercial-cloud default, but a sovereign or regional cloud can use a different host. Using the wrong one registers a client bound to a callback Interchange will never see a request from, and Interchange’s exact redirect-URI matching rejects the authorization as a result.
  2. Register a client with Interchange’s OAuth endpoint using that exact URI:
  3. Copy the returned client_id.
  4. In Copilot Studio’s tool authentication settings, choose OAuth 2.0 (manual) instead of relying on auto-discovery, and enter:
    • Authorization URL: https://api.interchange.io/authorize
    • Token URL: https://api.interchange.io/auth/token
    • Client ID: the value from step 3
    • Scope: openid profile email
  5. Complete sign-in with the Interchange account the agent should act as.
Dynamic registration issues a public client (no client secret); do not treat the generated client_id as sensitive, but do not reuse one tenant’s registered client for another tenant’s agent.

​
Tenant DLP

Copilot Studio’s custom-connector and MCP-tool surface is subject to your Microsoft 365 tenant’s Data Loss Prevention policy, the same as any other non-Microsoft connector. If your tenant restricts custom connectors to an allowlist, ask your Microsoft 365 admin to allow api.interchange.io before makers can save the tool. This is a Microsoft-side, tenant-level control — Interchange has no visibility into your DLP configuration and cannot make this change for you.

​
Next steps

Once the tool is added and authenticated, ask the agent something that exercises a read, for example “list my advertisers” or “show my storefront’s current inventory,” and confirm the result before building further logic on top of it. For the full tool catalog available over these endpoints, see Available MCP Tools.