Call Microsoft Copilot Harness Agents from Copilot Studio via MCP and A2A
Diesen Beitrag auf Deutsch lesen
Configure Copilot Studio agents to call harness agents over MCP or A2A with Entra sign-in, on-behalf-of authentication, sharing and security roles. Both channels are in preview.
TL;DR
Published Microsoft Copilot harness agents in an Early release environment expose MCP and A2A endpoints that Copilot Studio agents can call. The setup needs an app registration with the delegated permission MCS.InvokeAsMCP or MCS.InvokeAsA2A, a client secret, a redirect URI and Manual OAuth. On-behalf-of sign-in lets users consent once in the conversation; sharing the agent, connector and a security role decides whether they get answers.
Original by Shaji Sivaraman, on The Custom Engine (Microsoft Copilot Studio CAT team blog). Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Write a specific server description when adding the MCP tool or A2A agent, since Copilot Studio routes on name and description; editing the connector later does not update it, so remove and re-add the tool to change it.
- Admins/CoE: The channels are in preview; plan the called agent in an Early release environment, admin consent for on-behalf-of token swaps, and sharing of agent, connector and a security role before other users can connect.
- Security/Compliance: Every call passes through Microsoft Entra as the signed-in user, and MCP and A2A each need their own consent, so review both delegated permissions separately.
- Leadership/Business: Existing standard agents can use new harness agents without being rebuilt, and credits are consumed in the called agent's environment.
Frequently asked questions
How do I call a Microsoft Copilot harness agent from a standard Copilot Studio agent?
Add it as a Model Context Protocol tool with Manual OAuth, the delegated permission MCS.InvokeAsMCP, a client secret and a redirect URI. Only the called agent needs an Early release environment.
Why do other users fail to connect to my Copilot Studio MCP tool?
Usually sharing is missing. Share the custom connector with Can view, share the called agent with the user, and assign a security role such as Basic User in a non-default environment.
Does MCP consent cover A2A for Copilot Studio agents?
No. User or admin consent is granted per protocol, so MCS.InvokeAsMCP and MCS.InvokeAsA2A each need their own consent, and admin consent is required for the on-behalf-of token swap.