--- id: copilot-connectors lang: en track: copilot title: "Connectors" seoTitle: "Copilot connectors: bring outside systems in" description: "How Copilot connectors bring outside systems into Microsoft Graph, why an admin deploys them tenant-wide, who sees what, and how to ask for the one you need." part: working-smart partTitle: "Working smart" partOrder: 4 order: 5 level: Intermediate durationMinutes: 7 outcome: "Understand how Copilot connectors bring outside systems in, who controls them, and how to ask for the one you need." summary: "Copilot connectors bring outside systems into Microsoft Graph, but unlike Claude's self-serve connectors, an admin deploys them tenant-wide and decides who sees what." draft: false updated: "2026-10-14" furtherReading: - title: "Microsoft 365 Copilot connectors overview" url: "https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/prebuilt-connectors-overview" note: "The connectors gallery and what the prebuilt connectors cover." - title: "Deploy Microsoft 365 Copilot connectors" url: "https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/deployment-overview" note: "How admins deploy connectors from the Microsoft 365 admin center." - title: "Copilot connectors overview" url: "https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/overview" note: "How connectors bring external content into Microsoft Graph." - title: "Researcher agent in Microsoft 365 Copilot" url: "https://learn.microsoft.com/en-us/microsoft-365/copilot/researcher-agent" note: "How Researcher draws on connected work content." keywords: - Copilot connectors - Microsoft 365 Copilot connectors - Microsoft Graph connectors - connector permissions - admin-deployed connectors - external data in Copilot quiz: intro: "Five quick questions. Ace them all and the next lesson unlocks." passScore: 5 questions: - q: "What does a Copilot connector actually do?" options: - "It lets Copilot post on your behalf in any app" - "It replaces Microsoft Graph with an external search engine" - "It gives each user a private copy of an external app" - "It brings content from an external system into Microsoft Graph, so Copilot Chat, Microsoft Search, and agents can find it" answer: 3 explain: "It brings content from an external system, like ServiceNow, Salesforce, or Jira, into Microsoft Graph, making it searchable through Copilot Chat, Microsoft Search, and tools like Researcher, Analyst, and Agent Builder." - q: "Who sets up a Copilot connector?" options: - "An admin with the AI administrator role, from the Microsoft 365 admin center" - "Any user, from a Connectors Directory inside Copilot Chat" - "Microsoft, automatically, for every app you use" - "Whoever builds an agent in Agent Builder" answer: 0 explain: "An admin with the AI administrator role, through the Microsoft 365 admin center. For some connectors users then sign in with their own account, but only once an admin has enabled them." - q: "An admin deploys a connector and sets its access to \"only users with access to the content.\" What does that mean for you?" options: - "Everyone in the tenant sees all of that system's content" - "Only admins can see the indexed content" - "You only see indexed content you could already open in the source system yourself" - "You see the content only after building an agent for it" answer: 2 explain: "You only see indexed content from that system if you could already open it there yourself, the same permission-inheritance principle Claude connectors always follow." - q: "What does the \"everyone in the organisation\" access setting do that has no real equivalent on Claude's side?" options: - "It blocks the connector for everyone except admins" - "It makes indexed content visible tenant-wide, regardless of who could open it at the source" - "It lets every user add connectors themselves" - "It switches on write and delete actions" answer: 1 explain: "It makes a connector's indexed content visible to the whole tenant regardless of who could actually open it in the source system, a genuine widening of visibility an admin has to choose deliberately." - q: "A file's access permissions changed in the source system, but Copilot's search results still reflect the old permissions. What's the likely explanation?" options: - "Incremental crawls don't update permissions; the change only arrives with the next full crawl" - "Copilot ignores permissions for connected content" - "The connector has been deleted" - "Permissions only refresh when you start a new chat" answer: 0 explain: "Incremental crawls don't update permissions. The change only propagates once a full crawl runs, which happens periodically rather than continuously." pass: badge: "Perfect score" title: "Part 4 done: you work smart with Copilot." body: "Full marks, and that closes out Working smart. You know what a connector does, who sets it up, and how access settings shape what you see. Next up: Copilot Studio, the deeper low-code tool for building agents and automations." retry: "Check the marked answers and give it another go. You've got this." --- > **Level:** Intermediate ยท **Reading time:** ~7 min > > **What you'll be able to do:** understand how Copilot connectors bring outside systems in, who controls them, and how to ask for the one you need. By now you've met Copilot's grounding (4.1), built an agent (4.2), scoped a Notebook to the sources you chose (4.3), and used two of its specialist agents (4.4). All of that works on content Copilot already has a route to: your mail, files, chats, and whatever's indexed through Microsoft Graph. A connector is how more content, from outside Microsoft 365 entirely, joins that pool.
Who sets up a connector, and where it reaches An admin deploys a connector from the Microsoft 365 admin center. Once live, its content flows into Microsoft Graph, and from there into Copilot Chat, Microsoft Search, Researcher and Analyst, and Agent Builder knowledge sources. An admin decision, not a personal one Admin M365 admin center Connector ServiceNow, Jira... Microsoft Graph who sees it: admin's choice Copilot Chat and Microsoft Search Researcher and Analyst Agent Builder knowledge sources There is no self-serve flow: ordinary users can't add a connector themselves. Access is still scoped per connector: only-your-access, or everyone in the org.
## What a Copilot connector is A connector brings content from an external system, ServiceNow, Salesforce, Box, Jira, MediaWiki, Azure, and well over a hundred others listed in the Connectors gallery, into Microsoft Graph. Once it's there, that content becomes searchable the same way your own files are: through Microsoft Search, through standard Copilot Chat, and through the specialist agents and tools built on top of Graph, including Researcher and Analyst from the [last lesson](/learn/copilot/working-smart/researcher-and-analyst), and as a knowledge source you can pick when building an agent in Agent Builder. Picture what this actually unlocks. Before a connector exists for your ticketing system, asking Copilot "what's the status of the Henderson support case" gets you nothing, Copilot has no route to that data at all. After your admin deploys a connector for it, the same question can surface the ticket directly, because the content has joined the same pool Copilot already searches for your mail and files. ### Where connected content actually shows up It's not just the chat window. Once a connector is live and indexed, that content can surface in four separate places: a plain Microsoft Search query, a standard Copilot Chat answer, the scope Researcher draws on when you ask it to search "work content," and the list of knowledge sources you can tick when building an agent in Agent Builder. An agent you build for, say, answering questions against your company wiki only becomes possible once a connector has brought that wiki into Graph in the first place; Agent Builder can't reach a system Graph has never heard of. ## Who actually sets one up Here's the structural difference worth getting straight, because it changes how you should think about every connector you ever see show up in Copilot. With Claude, connecting an app is something you do yourself, in the moment: open the Connectors Directory, pick an app, click Connect, sign in, and it's live in your next chat. A Copilot connector doesn't work that way. Setting one up requires the AI administrator role in the [Microsoft 365 admin center](https://admin.microsoft.com): go to Copilot, then Connectors, choose a source from the Gallery, give it a name and URL, pick an authentication method, and create it. There's no equivalent flow where you, as an ordinary user, browse a directory and add any app you like. The closest thing is a newer middle ground: for some connectors (self-serve sync connectors and federated connectors), the admin enables the connector once and each user then signs in with their own account to start using it. Even then, what you can connect is limited to what your admins approved. Whatever external systems are reachable through Copilot are whatever your organisation has switched on, not whatever you personally decide to connect. That's a real trade-off, not simply a restriction. A connector you set up yourself in Claude only ever affects your own chats. A connector an admin deploys in Copilot is a tenant-wide decision: once it's live, it's available to everyone the admin granted access to, which is exactly why standing it up needs someone with the authority to make that call for the whole organisation, not an individual flipping a switch for themselves. ## Who can see what, once it's connected This is the admin's second real decision, not an afterthought. For each connector, they choose between two access models: "only users with access to the content," which maps you by your email address to your identity in Microsoft Entra ID and surfaces indexed content only to people who could already see it in the source system, or "everyone in the organisation," which makes the indexed content visible tenant-wide regardless of who could open it at the source. The first option is the one that matches how Claude connectors always behave: you only ever see what you could already see. The second has no real Claude equivalent at all, a connector can genuinely widen visibility beyond the source system's own access list if an admin chooses that setting, which is exactly why it's a deliberate admin decision and not a default anyone falls into by accident. ### Keeping it tidy: the permission-sync catch One operational detail worth knowing before you ever question a surprising search result: incremental crawls, the routine, frequent updates that keep a connector's content fresh, don't update permissions. If someone's access to a file changed in the source system, that change only propagates to Copilot's index on a full crawl, run periodically rather than continuously, not the moment the access change happens. If content ever looks like it's showing up for someone it shouldn't, or missing for someone it should reach, a stale permission sync is a real, documented explanation worth checking before assuming something's broken or escalating it as a security incident. ## Act, not just read Claude draws a clean line between a connector reading your data and one that can act, sending a message, creating a ticket, deleting a file, and asks you to treat the second kind with real caution. Copilot connectors started out mainly for search and retrieval, bringing content in to be found, but federated connectors, generally available since September 2026, are extending that same reach toward write, update, and delete actions, the same shift from "look things up" to "change things" that Claude's own connectors already make. Picture the difference in practice. A read-capable connector lets Copilot answer "what's the current status of the Henderson ticket" by looking it up. A connector that also supports actions could let it answer "close the Henderson ticket and note that the fix shipped" by actually making that change in the source system. The first is a lookup with no consequences if it's wrong. The second edits a real record that other people rely on, which is exactly why the underlying judgement call matters here just as much as it does on Claude's side: looking something up is low-risk, changing something in the source system is not, and it deserves more scrutiny before you trust it to an agent running on its own. ## Getting a connector you actually want Since you can't add one yourself, the practical move when you want Copilot to reach a system it doesn't yet cover is to ask, not to look for a settings toggle that doesn't exist. Tell your IT or admin team specifically which system you need, what you'd actually ask Copilot once it's connected, and whether the content should realistically be visible to everyone or only to people who already have access in the source system. That last part matters more than it sounds: you're the person closest to knowing whether "everyone in the org" is the right call for that particular system, and handing the admin that judgement upfront, rather than leaving them to guess, is how you end up with a connector configured the way you actually need it. ## Where this goes next That closes out Part 4. You can manage the context Copilot builds for you automatically (4.1), package a repeatable job into an agent you can share (4.2), lock Copilot to exactly the documents a piece of work needs in a Notebook (4.3), reach for Researcher or Analyst when a question needs real depth (4.4), and now you know how outside systems join the mix and who controls that (4.5). Part 5 goes further still: the more specialised tools, scheduling and automation, and full playbooks that chain everything you've learned so far. ## Try it Think of one external system you use daily that isn't part of Microsoft 365, your ticketing tool, your CRM, a wiki. If Copilot could search it, what's the first real question you'd ask? Then ask yourself the admin's actual question: should everyone in your organisation be able to find that content through Copilot, or only the people who could already open it at the source? That's the exact decision your IT team has to make for every connector they deploy. ## Key terms [Copilot connector](/glossary#copilot-connector), [Microsoft Graph](/glossary#microsoft-graph), [Agent](/glossary#agent), [Researcher](/glossary#researcher), [Copilot](/glossary#copilot)