Skip to main content
Hosted by a third party. This MCP server is built and hosted by the vendor, not Runlayer. This guide covers connecting it through Runlayer for governance, policies, and audit.
Microsoft Agent 365 vs. Microsoft 365 — This page covers Microsoft’s hosted Work IQ MCP servers: no Entra app registration, and access to Microsoft 365 Copilot. If you’d rather run Runlayer’s first-party Microsoft Graph servers with your own Entra app and granular scope control, use Microsoft 365 instead.
Microsoft 365 (Work IQ) connects to Microsoft’s Work IQ MCP endpoint, https://workiq.svc.cloud.microsoft/mcp. One connector covers mail, calendar, OneDrive and SharePoint files, Teams, and people, and can ask Microsoft 365 Copilot questions about your work data. Its tools take Microsoft Graph resource paths, so they reach any data the signed-in user can already see. See Microsoft’s tool reference.

​
Prerequisites

  • A usage-based billing plan for Copilot Credits in Copilot Studio, with an Azure subscription and resource group assigned, and your users assigned to the plan. See usage-based billing for Copilot Credits.
  • A Global Administrator for the one-time Work IQ setup below.
  • Access to your Runlayer instance.
Frontier enrollment is not required.

​
Setup Steps

1

Enable Work IQ in your tenant (one time)

A Global Administrator creates the Work IQ service principal in your Microsoft Entra tenant:
A conflict error means the service principal already exists. To use Graph Explorer instead of the Azure CLI, follow Enable your tenant for Work IQ.
2

Add the connector in Runlayer

  1. In Runlayer, go to Connectors and click Add connector
  2. Find Microsoft 365 (Work IQ)
  3. Click Create Hosted MCP
  4. Sign in with your Microsoft 365 account to authorize access. The first sign-in must be by an admin, who checks Consent on behalf of your organization. Until then, other users’ sign-in stops at Need admin approval. If the Runlayer application already appears under Enterprise applications in the Microsoft Entra admin center (for example, from the legacy connectors), an admin can grant consent there instead.
No Azure AD app registration is required. Runlayer handles OAuth automatically using a shared multitenant application. Once an admin has granted consent (step 2), users just sign in.

​
Read-only by default

Work IQ blocks create, update, delete, and action requests (such as sending email) by default, so the connector starts out read-only. An admin can allow writes through tenant policy. See Policy governance for Work IQ MCP.

​
Managing MCP servers in Microsoft 365

Admins view, block, and set policy on Microsoft’s MCP servers in the Microsoft 365 admin center (admin.cloud.microsoft) under Agents > Tools > Registry. This is not the Microsoft Entra admin center, whose Agents section only covers agent identities. See Overview of the Tools page.

​
Legacy per-service servers

The catalog also lists Microsoft’s per-service Agent 365 servers: Teams, Outlook Mail, Outlook Calendar, SharePoint and OneDrive, SharePoint Lists, User Profile, Word, Copilot Search, and Admin Center, each titled ”… (Work IQ)”. Microsoft keeps these for backward compatibility only and recommends Work IQ MCP for new work. See MCP server options in Agent 365. The legacy servers differ from the Work IQ connector in two ways:
  • Environment ID: each server URL contains {ENVIRONMENT_ID}. Replace it with your Power Platform environment ID when you add the server. See Find your environment and organization ID.
  • License: Microsoft 365 Copilot Search (Work IQ) needs a Microsoft 365 Copilot license per user, and other legacy servers may too. Without one, calls fail with WorkIQ license check failed. Required service plan(s): [M365_COPILOT_BUSINESS_CHAT].

​
Troubleshooting

The one-time Work IQ setup hasn’t run in your tenant. Ask a Global Administrator to create the Work IQ service principal (Step 1).
Your tenant has no Copilot Credits billing plan yet, or the user isn’t assigned to it. Tools that only describe the API (search_paths, get_schema) still work, but tools that read or change data fail until billing is set up. See Prerequisites.
Work IQ is read-only until an admin allows writes. See Read-only by default.
If a legacy server returns connection errors:
  • Double-check your Power Platform environment ID
  • Ensure you’re using the environment ID, not the tenant ID

​
Next Steps

OAuth Broker Guide

Learn more about OAuth Broker

MCP Custom Servers

Create other custom MCP servers