> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft

> Discover Copilot Studio, Azure AI Foundry and Entra Agent ID agents in your Microsoft tenant

Connect your Microsoft tenant once, then turn on each Microsoft service you want Runlayer to read. Every service is read-only.

| Service | What Runlayer reads | Who has to approve it |
| - | - | - |
| **Copilot Studio** | Copilot Studio agents, the connectors they use, and each agent's skills and custom MCP tools (through Power Platform and, where present, Dataverse) | The person connecting. What they see depends on their Power Platform role: a Global Administrator, Power Platform administrator, Dynamics 365 administrator or Global Reader sees every agent; an AI administrator or AI reader sees agents only |
| **Foundry** | Azure AI Foundry projects with their agents, tools and skills | The person connecting. Runlayer reads what their Azure role-based access lets them read |
| **Entra Agent ID** | Agent identities across the tenant, and who owns them | A Global Administrator or Privileged Role Administrator, once, for the whole organization |

Runlayer reads names, configuration and ownership metadata. It doesn't read conversations, transcripts or secrets.

## Connect your tenant

**1. Open Sources**

In **AI Inventory**, click **Sources**. Under **Microsoft**, click **Connect**.

**2. Sign in**

Sign in with a work account in the tenant you want to connect. This identifies the tenant; it grants no data access yet.

**3. Approve each service**

Back in Runlayer, click **Connect** next to each service. Microsoft shows a consent page for the **Runlayer Cloud Discovery** app. Approve it, and Runlayer starts syncing that service.

For **Entra Agent ID**, the approver must be a Global Administrator or Privileged Role Administrator, and the consent page applies to the whole organization. If you don't hold that role, a Runlayer admin who does can click **Connect** on just that service.

A service that doesn't exist in your tenant shows **Not available** instead of failing the connection. For example, a tenant without Dataverse still syncs Copilot Studio agents through Power Platform.

## Common errors

| What you see | What it means |
| - | - |
| **Not authorized** on a service | Its consent was declined, or the person who approved it lost access. Click **Reconnect** on that service and approve again |
| Microsoft says you need an administrator to approve | The service needs admin consent. Ask a Global Administrator or Privileged Role Administrator to approve it |
| Microsoft blocks sign-in with a Conditional Access message | A Conditional Access policy in your tenant blocks the app or the device. Ask your Entra administrator to allow the **Runlayer Cloud Discovery** app |

## Remove the Runlayer app from your tenant

Disconnecting in Runlayer deletes the grants Runlayer stored and stops the sync. It doesn't remove the **Runlayer Cloud Discovery** enterprise application, its admin consent, or tokens Microsoft has already issued. To remove those too:

1. In the Microsoft Entra admin center, go to **Enterprise applications** and search for **Runlayer Cloud Discovery**.
2. Open **Properties** and click **Delete**.
3. Optionally, permanently delete it from **Deleted applications**.

With PowerShell, `Remove-MgServicePrincipal` does the same.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.