> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365-copilot.md).
# Microsoft 365 Copilot
Use Microsoft 365 Copilot data with Cortex XSIAM.
The capabilities and sub-capabilities listed for this connector are available with any active Cortex Cloud Posture Security license.
This connector includes the following capabilities and sub-capabilities (if applicable):
* Agent Security Scanning
### How to configure the Microsoft 365 Copilot connector
{% hint style="info" %}
* To access M365 Copilot and start building custom agents, your organization must have a Microsoft 365 Copilot license.
* To manage Microsoft 365 Copilot agents and settings, your account must be assigned an appropriate administrative role in Microsoft Entra ID. You can verify your current access level by viewing the agent list. Microsoft recommends using the AI Administrator role. This is a dedicated persona designed specifically for managing Copilot features and agent governance without granting unnecessary access to other parts of your system. \
\
The Global Reader role provides "view-only" access, allowing you to see agent status and availability without the ability to make changes or upload new packages. If you encounter permission errors or need role elevation, contact your organization's IT department to request assignment of the AI Administrator or Global Reader role.
* Under Settings, select **Active** for assignment type and **Permanently assigned** for assignment duration. Add a justification for your settings and **Assign**.
{% endhint %}
To access Microsoft 365 Copilot, Cortex XSIAM requires the following information, which you will specify during the connection process:
* Instance URL
* Administrator Account Credentials
* Open Authentication (OATH) Time-based One-Time Password (TOTP) Secret
{% hint style="info" %}
To avoid a misconfiguration, ensure that you complete the following steps EXACTLY in the sequence provided. Deviating from this order can lead to authentication errors or service disruption.
{% endhint %}
{% stepper %}
{% step %}
#### Task 1: Configure OATH Token Authentication Methods in Microsoft
To ensure a standardized login experience and support automated data extraction, configure Microsoft Entra ID to use Open Authentication (OATH) Time-based One-Time Password (TOTP) methods for the dedicated administrative account.
{% endstep %}
{% step %}
#### Task 2: Extract the Secret Key
1. During the multi-factor authentication (MFA) setup for your service/admin account on the Scan the QR code page, select the **Can't scan QR code?** link.
2. Record the Account name and the Secret key.
3. Store the Secret key in a secure location, such as a password manager, for later use during onboarding or recovery (this acts as your TOTP Secret).
4. Click **Next**.
{% endstep %}
{% step %}
#### Task 3: **Verify the Token**
1. Enter the secret key into your preferred OATH-compliant application (e.g., Google Authenticator, Authy, or a hardware token).
2. Click **Next** in the Microsoft portal.
3. Enter the 6-digit verification code generated by your application to verify the sync.
4. Click **Next** and then click **Done** to complete the initial token setup.
{% endstep %}
{% step %}
#### Task 4: **Register the Microsoft Authenticator App**
Ensure you have the Microsoft Authenticator app installed on your mobile device.
1. Log in to your account's security overview portal. If the setup screen does not appear automatically, proceed to the following steps:
2. Navigate to Security Info: Select your profile icon in the top-right corner and click **View Account**. You will be redirected to the mysignins.microsoft.com/security-info page (or you can navigate to the Security Info page from the left navigation section).
3. Access Sign-in Methods: In the left navigation pane, select **Security Info**.
4. Click **+ Add sign-in** method. From the drop-down menu, select Microsoft Authenticator app and click **Add**.
5. Initialize App Setup: When the Start by getting the app screen appears, click **Next**. On the Set up your account in app screen, click Next again to reveal the setup QR code.
6. Scan the QR Code: Open the Microsoft Authenticator app on your mobile device, add a new account, and scan the QR code displayed on your computer screen. Once scanned, click **Next**.
7. Verify the Connection: The portal will display a two-digit number. Enter this number into the prompt on your mobile device to complete the test notification.
8. Finalize Registration: Once the Notification approved message appears, click **Next**, then click **Done**.
9. Verification: Confirm that Microsoft Authenticator now appears in your list of registered Sign-in methods.
{% endstep %}
{% step %}
#### Task 5: **Confirm the Default Sign-in Method**
1. Return to the Microsoft Entra admin center and select Users > Authentication methods.
2. Verify that the Software OATH token is listed under the authentication records.
3. Select Add authentication method or Change default manual method (if available) to ensure that the third-party software OATH token option is configured as the primary requirement for compliance.
{% endstep %}
{% step %}
#### Task 6: Connect Microsoft 365 Copilot to Cortex XSIAM
1. In Cortex XSIAM, navigate to **Settings** → **Data Sources & Integrations**.
2. Click **+ Add new**.
3. In the **Add Data Sources or Integrations** page, search for Microsoft 365 Copilot.
4. Under **Recommended**, hover over the new Microsoft 365 Copilot integration and click **Add Instance** to launch the configuration wizard.
5. Under the **Capabilities** tab, Enter a Name for your application.
6. Select Security Posture under **Default Capabilities**.
7. Click **Next**.
8. Under **Connection**, enter your Instance URL, Admin Account Credentials, and provide the Secret Key (OATH TOTP Secret).
9. Under **Configuration** tab, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments.
10. A confirmation message indicates that Microsoft 365 Copilot is successfully connected. Confirm the Summary details and click **Save instance**.
{% endstep %}
{% endstepper %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/microsoft-365-copilot.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.