Category: Microsoft 365

What is connecting Copilot agents to Dataverse, Graph, and connectors, really?

image

When people hear “Copilot Studio agent,” they picture a chatbot. That’s the wrong mental model. A modern agent is a reasoning layer sitting on top of three very different pipes: your business data in Dataverse, your organisational content in Microsoft Graph, and the wider universe of SaaS via Power Platform connectors.

Each pipe has its own auth story. And that’s where almost every SMB and MSP rollout I see comes unstuck.

That’s not a configuration problem. That’s an identity problem dressed up as a configuration problem.

Step-by-Step: wiring an agent to the three pipes
Set the agent’s authentication first

Before you add a single tool, go to Settings → Security → Authentication in your agent. Pick Authenticate with Microsoft. This uses Microsoft Entra ID to identify whoever is chatting — and it’s the prerequisite for almost everything that follows.

Skip this step and your agent runs as nobody. Which means it can’t read Dataverse on the user’s behalf, can’t honour SharePoint permissions, and can’t call a connector as the signed-in user. Get the front door right and the rest gets easier.

Add a Dataverse table as knowledge

Open Knowledge → Add knowledge → Dataverse. You can wire up to 15 tables per agent. Two things that catch people out:

  • Dataverse search must be enabled on the environment first.

  • Add synonyms and glossary terms for any column where your users speak a different dialect to the schema.

“Why doesn’t it find my open opportunities?”

Because your column is called statuscode and your users say “stage.” Synonyms fix that.

Add a Microsoft 365 Graph connector for content

Graph connectors are the other knowledge model — they index external content (Jira, ServiceNow, file shares, intranets) into the same semantic graph that Copilot already uses for Teams, SharePoint, and mail. Set them up in the Microsoft 365 admin center → Search & intelligence → Connectors. ACL-based permission trimming is preserved, so users only see what they’re allowed to see. Microsoft has a clear overview here.

Notice what’s missing? Dataverse is agent-scoped knowledge. Graph connectors are tenant-scoped knowledge. Different governance owners. Plan accordingly.

Add a connector as a tool

In your agent, Tools → Add a tool → Connector. Pick a standard, premium, or custom Power Platform connector. Now the agent can act — create a row, post to Teams, hit your line-of-business API.

Tool = action. Knowledge = retrieval. Don't confuse the two.
Pick the right credentials mode

Every tool asks one question that quietly decides your security posture: Maker Credentials or End User Credentials?

  • Maker Credentials: the connection runs as you, the builder. Easy demos. Terrible for anything user-specific.

  • End User Credentials: each chatter authenticates with their own account. Slightly more clicks for users. The only sensible default for production. Details here.

My recommendation? Default to End User and only fall back to Maker when there’s a genuine service-account scenario — like reading a shared mailbox.

Why this actually changes behaviour

Here’s the real win. Once authentication is correctly threaded through the agent, the same prompt produces different, personally-relevant answers for every user — because it’s their identity flowing into Dataverse, their Graph results coming back, their connector permissions being honoured.

That’s not a chatbot. That’s a tenant-aware assistant.

The other thing I notice with clients: governance conversations get easier. “Who can see what?” becomes a question of existing Entra groups and Dataverse row security — not a brand-new permissions matrix you have to invent for the agent.

Get the auth pattern right once and every agent you build afterwards inherits it. Get it wrong and you’ll be unpicking the same mess for months.

Wire the pipes. Mind the credentials. Ship something your clients actually trust.

Techwerks 30–24 June 2026

Designer

CIAOPS Techwerks face to face returns to Melbourne CBD on Wednesday the 24th of June 2026.

The course is limited to 20 people and you can sign up and reserve your place now! You reserve a place by completing this form:

http://bit.ly/ciaopsroi

or by sending me an email (director@ciaops.com) expressing your interest.

The content of these all day face to face workshops is driven by the attendees. That means we cover exactly what people want to see and focus on doing hands on, real world scenarios. Attendees can vote on topics they’d like to see covered prior to the day and we continue to target exactly what the small group of attendees wants to see. Thus, this is an excellent way to get really deep into the technology and have all the questions you’ve been dying to know answered. Typically, the event produces a number of best practice take aways for each attendee.

Recent testimonial – “I just wanted to say a big thank you to Robert for the Brisbane Techworks day. It is such a good format with each attendee asking what matters them and the whole interactive nature of the day. So much better than death by PowerPoint.” – Mike H.

The cost to attend is:

Gold Enterprise Patron = $50 ex GST

Gold Patron = $90 ex GST

Silver Patron = $180 ex GST

Bronze Patron = $360 ex GST

Non Patron = $720 ex GST

I hope to see you there.

Maybe Lists is a better tool?

image

Most SMBs I walk into are tracking something important in the worst possible place.

An Excel file pinned to a Teams channel. A shared OneNote page. A SaaS tracker they pay for monthly because no one told them there was already one in the tenant.

Then they wonder why nothing gets logged, why two people overwrote each other’s edits, and why the boss can’t see what’s going on.

That’s not a process problem. That’s a tooling problem.

There’s a free, already-licensed, surprisingly capable tracker sitting in every Microsoft 365 plan you sell. Most of your clients have never opened it.

What is Microsoft Lists, really?

It’s a structured tracker. Rows and columns, like a spreadsheet — but every column has a type (date, person, choice, number, attachment), so nobody fat-fingers a status into the wrong column.

It lives in SharePoint underneath, surfaces in Teams as a channel tab, and has its own icon on the Microsoft 365 app launcher. Same list, three doors in.

And it brings two things Excel will never give you: a built-in form for people who shouldn’t see the whole list, and built-in rules that fire emails when things change. No Power Automate. No premium connector. No developer.

A spreadsheet in a Teams channel isn’t a tracker. It’s a graveyard with column headers.

Step-by-Step: build a working tracker in ten minutes
Open Lists from the app launcher

Hit the waffle in Microsoft 365, pick Lists, click + New list. You’re at the list creation chooser.

Pick a template, not a blank list

I know — you want to start from scratch. Don’t. Templates ship with sensible columns, conditional formatting, and views already done. Issue tracker and Work progress tracker cover most SMB scenarios. Adjust later.

Save it to a SharePoint site, not “My lists”

The one step everyone gets wrong. My lists is personal storage — the list can’t easily be moved to a team site later. Save it under the SharePoint site behind the relevant Team. Future-you will thank present-you.

Share the form, not the list

Open your new list and click Forms on the toolbar. The list’s own form pops up. Hit Share form, copy the link, send it to your client, your supplier, the new starter — anyone who shouldn’t see the whole pipeline. Their answers land as new rows. They never see the list itself.

Add a rule from the Automate menu

Click Automate > Rules > Create a rule. Pick a trigger — a column changes, a new item is created, an item is deleted, a date approaches. Pick the column, the value, the person to notify. Done. Microsoft’s own guide walks the same path.

When Status changes to Blocked
notify Assigned To

Notice what’s missing? Power Automate. Premium licensing. A developer. Rules cover the boring 80% of automation. Save Power Automate for the genuinely complex 20%.

Pin it as a tab in Teams

In the relevant channel, click + at the top, pick Lists, choose Add an existing list, paste the SharePoint URL. Now the team uses it where they already work. The official Teams guide spells it out.

Why this actually changes behaviour

“I’ll just email it to you.”

That’s the line that kills every SMB tracker. People email instead of logging.

A Lists form sitting on a channel tab fixes that in a way a spreadsheet never will. Anyone clicks + New, fills four fields, presses save. The rule emails the right person automatically. The boss opens the same list and sees everything, in real time, sortable, filterable, with history.

Meet people where they already are.

Lists isn’t there to compete with your project management tool. It’s there to replace the spreadsheet your clients are pretending is one.

If you’re rolling out Microsoft 365 Business Premium and you’re not showing clients this, you’re leaving value on the table they already paid for.

Copilot in Teams meetings

image

People keep telling me Copilot in Teams “writes notes for them”.

That’s not what it does. That’s what an action item list does.

What Copilot does is let you ask a meeting questions. Live, while it’s happening. Or three days later when someone CCs you in and asks for an opinion.

Most SMBs I work with have it switched on and have no idea. Staff have a Copilot license, the meeting has a transcript ticking along, and the Copilot pane sits there unused while everyone scrambles to take their own notes.

Notice what’s missing? The bit where someone actually uses it.

What is Copilot in Teams meetings, really?

It’s a question box that knows what was just said.

You open the Copilot pane during a call, type a question — what have we decided?, what did Sarah commit to?, am I even needed on this one? — and it answers from the live transcript.

After the meeting, that same pane becomes the intelligent recap: chapters, AI-generated notes, suggested follow-ups, and timestamps that jump you straight to the moment someone said the thing that matters.

That’s the whole product. Live Q&A on the meeting, plus a navigable recap after. There’s a broader catalogue of AI features in Teams, but this is the one that earns the license on day one.

Step-by-Step: Turning it on properly

Two things have to be true for any of this to work: a Copilot license on the user, and transcription enabled for the meeting. Without a transcript, the Copilot pane has nothing to read.

Here’s the order I run it.

Enable transcription in the meeting policy

In the Teams admin centre, go to Meetings → Meeting policies, open the policy that applies to your Copilot users, and switch Allow transcription to On. The default global policy is off in some tenants. Check.

Turn Copilot on in the same policy

Same screen, scroll down. Set Copilot to On with or without transcription for genuine flexibility, or On only with transcription if you want a paper trail every time. My recommendation? The second one, especially for any regulated client.

Set the room expectation

Drop one line into the meeting invite: This meeting uses Microsoft Copilot. A transcript will be generated. Teams shows attendees a banner anyway when transcription starts, but writing it once removes the awkward moment.

Show people the pane

Open a meeting. Click the Copilot icon in the toolbar. Ask it something live. Then do it again from the recap tab after the meeting ends. Two clicks. That’s the training.

Why this actually changes behaviour

The win isn’t the summary. The win is what people stop doing.

Here’s the real one. They stop typing notes mid-meeting. They stop joining meetings they didn’t need to be in, because the recap takes two minutes afterwards. They stop emailing what did we agree? — they ask Copilot, and it answers with a timestamp.

Can I just ask what I missed? Yes. That’s the whole point.

Copilot doesn’t replace the meeting. It replaces the scramble around the meeting.

For regulated clients, the privacy notes for intelligent recap are worth ten minutes — they’re the answer when a client asks “but is this safe?”

Copilot in Teams meetings isn’t there to take notes for you. It’s there to make notes optional.

If you’re not showing your SMB clients this in their next review, someone else will.

Need to Know podcast–Episode 365

In this episode, we dig into Cowork Skills and why they represent a genuine shift from “AI as a novelty” to “AI as part of how work actually gets done.” Not more prompts. Not more tools. But fewer decisions, less friction, and more consistency across the business.
If you’ve ever thought “Copilot is interesting, but it’s not really embedded yet”, this episode is for you.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-365-skills-not-apps/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog – CIAOPS – Information about SharePoint, Microsoft 365, Azure, Mobility and Productivity from the Computer Information Agency

Join my Teams shared channel – Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron – CIAOPS Patron

CIAOPS Brief – CIA Brief – CIAOPS

CIAOPS Labs – CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS – Support CIAOPS

Get your M365 questions answered via email

Please fill out this form

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com
CIAOPS MSP Skills

Microsoft Build

Choose how OneNote opens Microsoft 365 file links

How Storm-2949 turned a compromised identity into a cloud-wide breach

Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware

Exposing Fox Tempest: A malware-signing service operation

A faster, more efficient Editor experience with Narrator in Word

Launched: Microsoft 365 Copilot Adoption Hub Redesign

Copilot prompt libraries for your tenant

image

Most Copilot rollouts I see have a strange shape. The licences are bought. The admin centre is half-configured. And nobody is using it.

Six months in, a few power users are saving an hour a week. Everyone else opens Copilot, stares at a blank box, and closes the tab.

That’s not a Copilot problem. That’s a prompting problem.

And the worst part? Microsoft has already shipped the fix. Most tenants haven’t turned it on.

What is a tenant prompt library, really?

A prompt library is a list of known-good prompts pinned inside the Copilot experience itself. Your users see them when they open Copilot — in chat, in Word, in Excel, in Outlook, wherever you’ve published them.

Two layers matter for SMBs and MSPs.

The first is the Microsoft Copilot Prompt Gallery — the public set Microsoft maintains. Useful. Generic.

The second is promoted prompts — your own prompts, pushed to your own users from the Microsoft 365 admin centre. This is the layer almost nobody uses, and it’s the one that actually changes behaviour.

Think of it as the difference between handing someone a generic cookbook and putting a Post-it on their fridge that says “this is how we make pasta”.

Step-by-Step: publishing a tenant prompt library

Portal walkthrough, no PowerShell.

Open the admin centre

Sign in to the Microsoft 365 admin centre as a Global or Copilot admin. Expand Copilot in the left nav, then Settings, then Promoted prompts.

Write the prompt your users actually need

Don’t reach for a clever one. Reach for the boring one your help desk keeps explaining. “Summarise this week’s emails from my customers and group by client.” “Draft a weekly status update for my manager based on my meetings and Teams chats.” Plain English, written the way a non-technical user would actually type it.

Pin it to the right app

You can target the prompt to Microsoft 365 Copilot chat, Word, Excel, PowerPoint, Outlook, Teams, or OneNote. Pin one prompt per app where it’s actually useful. Five great prompts beats fifty mediocre ones.

Set the audience

Use a group, not “everyone”. Roll it to a pilot. Sales gets the sales prompts. Finance gets the finance prompts. The prompt is the training material.

Publish and watch adoption move

Promoted prompts surface at the top of the Copilot prompt UI for the assigned users within a few hours. Microsoft’s Copilot Prompt Gallery documents the surfaces they show up on.

Title: Weekly client summary
App:   Microsoft 365 Copilot chat
Prompt:
Summarise emails and Teams messages from
my customers this week. Group by client.
Highlight any unanswered questions.

Notice what’s missing? No mention of how Copilot does the work. No file picker. No talk of Work IQ. The user just asks once and gets the outcome. That’s the brief.

Why this actually changes behaviour

Most adoption programmes hand out PDFs nobody reads. Promoted prompts put the training inside the product, at the moment of use.

“I don’t know what to ask Copilot for.”

That sentence kills more rollouts than any licensing or governance issue. A prompt library answers it.

Three things shift the day you publish one:

  • New users see a starting point on day one instead of a blinking cursor.

  • Power users stop reinventing the same prompt twelve different ways.

  • You finally have a measurable, governable surface to iterate on.

That last one matters for MSPs. You can review the prompt library quarterly with your client, the same way you review a security baseline. Copilot doesn’t get tired. Use that.

For the deeper guidance on what makes a prompt land, Microsoft’s own write effective prompts page is worth lifting language from when you draft yours.

One closing thought

If you’re rolling out Copilot to a client and you haven’t published a single promoted prompt, you’re charging them for a tool and shipping them a blank page.

Promoted prompts aren’t there to teach people how to use Copilot. They’re there to remove the moment of not knowing what to ask completely.

Driver & firmware update management via Intune

image

Walk into most MSP-managed Windows fleets and the update story stops at quality and feature rings.

Drivers? “Windows Update grabs those.” Firmware? “The OEM utility does that.”

That’s not a strategy. That’s three different cooks in the same kitchen, and you’re praying none of them serves up a bad BIOS on a Friday afternoon.

Here’s the real win. Intune has had a dedicated approval surface for driver and firmware updates for a while now. And almost nobody’s switched it on.

What is a driver update policy, really?

It’s a separate Intune profile that sits alongside your existing update rings. It shows you every driver and firmware update Windows Update has queued for your managed devices, and lets you decide — one at a time — whether to ship it.

Approve, pause, defer, hold back the one dodgy NIC driver while the rest go through. All in the portal.

Critically, it’s the same pipeline Windows Autopatch uses for drivers. Five-laptop accounting firm on Business Premium or 500-seat shop on M365 E3 — same surface. You need Intune Plan 1 and a Windows licence that includes the Autopatch entitlement (Business Premium and M365 E3/E5 both have it), devices must be Entra joined or Entra hybrid joined, and telemetry must be set to Required or higher. That’s the lot.

Step-by-Step: switching it on
Check your existing rings aren’t blocking drivers

This is the bit that catches people. If your existing Update Ring or Settings Catalog policy blocks drivers, the whole feature does nothing. In your update ring, set Windows driver to Allow. In the Settings Catalog, set Exclude WU Drivers in Quality Update to Allow Windows Update drivers.

Both default to Allow, but I’ve found plenty of older tenants where someone clicked Block years ago and forgot.

Open the right blade

Sign in to the Microsoft Intune admin centre → Devices → By platform → Windows → Manage updates → Windows 10 and later updates → Driver updates tab → Create profile.

Pick an approval mode

You get two:

  • Automatically approve all recommended driver updates — anything the OEM tags “recommended” gets approved on its own, with a deferral you set between 0 and 30 days.

  • Manually approve and deploy driver updates — every driver lands as Needs review and waits for you.
Approval method:   Automatically approve all recommended driver updates
Make updates       7
available after:

Notice what’s missing? There’s no per-vendor split and no per-device override. One policy, one device — stack two driver policies on the same machine and you’ll fight yourself.

Assign and stage

Pilot group of around 10% — your own laptops, IT, one tolerant power user. Watch it for a fortnight. Then 25%. Then the rest. The per-driver pause button is your friend the first time something breaks.

Why this actually changes behaviour

Most clients have never had a driver controlled by anyone other than Windows Update itself. The first time a Lenovo BIOS update bricks a laptop at 4pm on a Friday, that’s the conversation you do not want to be having with the owner.

With a policy on, you see the update before it hits anyone. You pause it. The rest of the fleet still ships. The client doesn’t even know it happened — and that’s the point.

“But surely Windows Update already knows what’s safe?”

Windows Update knows what applies. It doesn’t know your fleet. You do.

One last wrinkle. The policy doesn’t honour the OEM’s Computer Hardware ID targeting — so managed devices can pick up a newer “recommended” driver even when the OEM reserved a CHID-matched build for that exact model. My recommendation? Use manual approval on hardware you don’t have a spare of in a drawer to test against.

Driver update policies aren’t there to give you more buttons to click. They’re there to take the OEM utility, the random Windows Update behaviour, and the 4pm Friday surprise off the table completely.

If you’re not running one on every managed tenant, you’re outsourcing your hardware change control to luck.

CIA Brief 20260523

image

Security & Threat Intelligence

Microsoft 365 Apps & Productivity

Microsoft 365 Copilot

After hours

Clarkson’s Farm Series 5 | Official Trailer – https://www.youtube.com/watch?v=GJxPc3B2osU

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week