Copilot Studio makes it easy to build custom AI agents. In very little time you can create, for example, an agent that drafts a standard customer contract from a few details. But it gets harder when the task is more than filling in blanks. Choosing different clauses for different clients, or editing an existing document instead of creating a new one, is not easy without additional tools. That's where OfficeAgent helps. As an MCP server, it gives agents tools to edit real Word documents, keeping their styling, comments, and tracked changes intact.
In the previous article I explained how to deploy the OfficeAgent MCP server to Azure. This article connects a Copilot Studio agent to it and lets it modify an existing Word document.
What you need before you start
1. The hosted MCP endpoint from the previous article. From that deployment you will need your tenant id and the Easy Auth app's client id.
2. A Copilot Studio agent - an existing one or a new blank agent.
3. An app registration for Copilot Studio to sign in with. Copilot Studio needs its own identity to obtain an Entra token to connect to the endpoint:
- In the Entra admin center, open App
registrations and create a new registration. Name it (e.g.
officeagent-copilot), keep the defaults, and register it. Copy the Application (client) ID. - On the app's Certificates & secrets page, create a new client secret and copy its Value right away - it is shown only once.
- You will add a redirect URL to this registration later - Copilot Studio shows it during the connection setup.
Add the MCP server to the agent
- Open your agent in Copilot Studio and check that it uses generative orchestration (on the agent's Settings page, under Generative AI). MCP tools are not available under classic orchestration.
- Open the Tools page, click Add a tool, and pick Model Context Protocol.
- Enter a name (
OfficeAgent), a short description ("edits Word documents in SharePoint through validated change plans"), and the server URL:https://<app-url>/, the root of the deployed container app. - For authentication, pick OAuth 2.0.
The OAuth values
All of these come from the deployment:
| Field | Value |
|---|---|
| Client ID | the officeagent-copilot app's client id |
| Client secret | the secret you created for it |
| Authorization URL | https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize |
| Token URL | https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token |
| Refresh URL | same as the token URL |
| Scopes | the scope the Easy Auth registration exposes, on its Expose an API page, typically api://<easyauth-client-id>/user_impersonation
|
Finish the connection
- Finish the wizard. Copilot Studio now shows the redirect URL for this
connection - copy it, go back to the
officeagent-copilotregistration in the Entra admin center, and add it under Authentication as a Web redirect URI. - Create the connection when Copilot Studio asks you to sign in. This is the moment the OAuth loop closes: you sign in, consent, and the tool shows as connected.
In the tool listing you should see seven tools: inspect_document,
find_in_document, preview_plan, apply_plan, register_document,
remove_document, and list_connections.
The first edit
With the tools added, you can ask the agent something concrete:
Update the payment terms in
https://contoso.sharepoint.com/sites/legal/Shared%20Documents/msa-draft.docx
from 30 to 45 days.
Under the hood, the agent will register the document with the OfficeAgent MCP server, find all appearances of "30 days", prepare a modification plan, and apply it.
The result lands in SharePoint as a new version of the document, and the edit itself is a Word tracked change - open the document and you review it like a colleague's edit, accept or reject. The agent proposes the change; you decide what the document finally says.
Whose permissions apply
In the deployment article's setup the server uses one application identity (appOnly), scoped with Sites.Selected to the sites you granted. Every user of the agent reaches the same documents, which fits back-office automation. The provider also supports an on-behalf-of mode, where the server acts as the signed-in user and SharePoint permissions apply per user - the right choice for an assistant many people share. The identity table in the deployment guide
covers what that mode requires.
Let me know in the comments if this article is useful, and a star on GitHub helps other developers find it.
Top comments (0)