> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-m365-copilot.md).
# Onboard M365 Copilot
Microsoft 365 Copilot is an AI-powered assistant integrated into Word, Excel, PowerPoint, Outlook, Teams, and other Microsoft 365 apps. It uses Large Language Models (LLMs) and your organization's data to help with tasks like drafting content, analyzing data, summarizing meetings, and generating ideas. It acts as a "copilot" by streamlining workflows, boosting creativity, and increasing productivity by turning natural language prompts into actions and insights within your familiar work environment.
**Prerequisites**
* To access M365 Copilot and start building custom agents, your organization must have a Microsoft 365 Copilot license. If you would like to explore these capabilities, coordinate with your IT Administrator or Microsoft Sales representative to ensure the proper licensing is in place.
**Note**: M365 Copilot is a Microsoft-native product, not a feature developed or managed by Palo Alto Networks.
* To manage Microsoft 365 Copilot agents and settings, your account must be assigned a specific administrative role. You can verify your current access level by viewing the agent list. While a Global Administrator has full control over the entire organization, Microsoft recommends using the AI Administrator role. This is a dedicated persona designed specifically for managing Copilot features and agent governance without granting unnecessary access to other parts of your system. If you only need to monitor the environment, the Global Reader role provides "view-only" access, allowing you to see agent status and availability without the ability to make changes or upload new packages. Consult your internal IT team to ensure one of these roles is assigned to your account and you list agents via the URL mentioned above.
* In the Setting tab, select Active for assignment type and Permanently assigned for assignment duration. Add a justification for your settings and Assign.
1. Configure OATH Token Authentication Methods in Microsoft
To ensure a standardized login experience and support automated data extraction, configure Microsoft Entra ID to use Open Authentication (OATH) Time-based One-Time Password (TOTP) methods for the dedicated administrative account.
Note: To avoid a misconfiguration, ensure that you complete the following steps EXACTLY in the sequence provided. Deviating from this order can lead to authentication errors or service disruption.
**Part A: Extract the Secret Key**
1. During the multi-factor authentication (MFA) setup for your service/admin account on the Scan the QR code page, select the Can't scan QR code? link.
2. Record the Account name and the Secret key.
3. Store the secret key in a secure location, such as a password manager, for later use during onboarding or recovery (this acts as your TOTP Secret).
4. Click Next.
**Part B: Verify the Token**
5. Enter the secret key into your preferred OATH-compliant application (e.g., Google Authenticator, Authy, or a hardware token).
6. Click Next in the Microsoft portal.
7. Enter the 6-digit verification code generated by your application to verify the sync.
8. Click Next and then click Done to complete the initial token setup.
**Part C: Register the Microsoft Authenticator App**
Prerequisite: Ensure you have the Microsoft Authenticator app installed on your mobile device.
9. Log in to your account's security overview portal. If the setup screen does not appear automatically, proceed to the following sub-steps:
10. Navigate to Security Info: Select your profile icon in the top-right corner and click View Account. You will be redirected to the mysignins.microsoft.com/security-info page (or you can navigate to the Security Info page from the left navigation section).
11. Access Sign-in Methods: In the left navigation pane, select Security Info.
12. Click + Add sign-in method. From the drop-down menu, select Microsoft Authenticator app and click Add.
13. Initialize App Setup: When the Start by getting the app screen appears, click Next. On the Set up your account in app screen, click Next again to reveal the setup QR code.
14. Scan the QR Code: Open the Microsoft Authenticator app on your mobile device, add a new account, and scan the QR code displayed on your computer screen. Once scanned, click Next.
15. Verify the Connection: The portal will display a two-digit number. Enter this number into the prompt on your mobile device to complete the test notification.
16. Finalize Registration: Once the Notification approved message appears, click Next, then click Done.
17. Verification: Confirm that Microsoft Authenticator now appears in your list of registered Sign-in methods.
**Part D: Confirm the Default Sign-in Method**
16. Return to the Microsoft Entra admin center and select Users > Authentication methods.
17. Verify that the Software OATH token is listed under the authentication records.
18. Select Add authentication method or Change default manual method (if available) to ensure that the Third-party software OATH token option is configured as the primary requirement for compliance.
2\. Onboard M365 Copilot to AISPM
1. Log in to Cortex.
2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the Microsoft 365 Copilot connector.
3. Click on the Microsoft 365 Copilot tile and select Add Another Instance.
4. On the **Capabilities** page, provide an Instance Name and select Agent Security scanning capability.
5. On the **Connections** page, provide your Instance URL.
6. Under Authentication, the CREDENTIALS authentication method is selected by default. Click Next.
7. On the Onboard Agent Platform page, enter your admin account credentials and provide the Secret Key (OATH TOTP Secret) you recorded during Step 1.
8. Once Cortex validates the credentials and permissions, the onboarding process is complete.
3\. Validation and Scanning:
Cortex immediately establishes a secure backend connection and validates the extracted credentials, administrative scopes, and OATH sync configurations. After validation succeeds, a confirmation window will appear.
Cortex immediately begins to parse and scan your onboarded agentic platform environment. The amount of time required to crawl varies based on your tenant's data volume. At a minimum, expect at least one hour to populate telemetry maps, permissions vectors, and security trends within the AISPM dashboard.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-saas-security/saas-ai-agent-security/onboard-saas-ai-agents/onboard-m365-copilot.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.