Connect Microsoft 365 Copilot to Access360

Add Access360 to Microsoft 365 Copilot as a custom federated connector. People in your Microsoft 365 organization can then ask Copilot Chat about your Process Design content, each signed in with their own iGrafx account.

Prerequisites

Requires Access360 to be set up for your platform, and your platform's MCP Server URL. Your iGrafx administrator copies the URL from Admin → Server Settings → AI Settings. See step 6 of Set up Access360.
Requires the Global Administrator or AI Administrator role in Microsoft 365, and access to the Teams Developer Portal.
Every person who uses the connector needs the Access MCP server permission on their iGrafx account.
If your platform still uses the classic iGrafx Login, each person needs an API key for their account until the platform moves to the iGrafx Identity Solution. See How Access360 signs in.

Supported versions

Custom federated connectors are set up in the Microsoft 365 admin center. The menu names below follow Microsoft's article Set up custom federated connectors. If your screens differ, follow that article for where things are, and use the values on this page.

Microsoft's connector form offers None, OAuth 2.0, and Entra SSO as the authentication type. Access360 works with OAuth 2.0 only. It doesn't accept Microsoft Entra sign-ins, and it rejects requests without a sign-in.

Configuration

In the steps below, <MCP Server URL> stands for your platform's MCP Server URL, which has this shape:

https://process-design-mcp.svc.igrafxcloud.<region>/<tenant-id>

Part 1: Register Microsoft 365 Copilot with Access360

Microsoft's form asks for a client ID, so register Microsoft 365 Copilot with Access360 once to get one. The registration needs no iGrafx credentials.

Send this registration request. In Windows PowerShell:

$body = @{
  client_name = "Microsoft 365 Copilot"
  redirect_uris = @("https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect")
  grant_types = @("authorization_code", "refresh_token")
  response_types = @("code")
  token_endpoint_auth_method = "none"
} | ConvertTo-Json
Invoke-RestMethod -Method Post -Uri "<MCP Server URL>/register" -ContentType "application/json" -Body $body

Or with curl:

curl -X POST "<MCP Server URL>/register" \
  -H "Content-Type: application/json" \
  -d '{"client_name":"Microsoft 365 Copilot","redirect_uris":["https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect"],"grant_types":["authorization_code","refresh_token"],"response_types":["code"],"token_endpoint_auth_method":"none"}'

Copy the client_id from the response. Keep it with the connector's other settings: you need it again if you recreate the connector.

The request registers Microsoft 365 Copilot without a client secret, so the registration doesn't expire. The redirect address must match exactly, or Access360 rejects the sign-in.

Part 2: Register the OAuth client in the Teams Developer Portal

Click New OAuth connection and fill in the form:

Field	Value
Registration name	A name you'll recognize, such as `iGrafx Access360`
Base URL	`<MCP Server URL>`
Restrict usage by organization	Your Microsoft 365 organization
Restrict usage by app	Any Teams app
Client ID	The `client_id` from part 1
Client secret	Any text, such as `not-used`. The form requires a value, but Access360 doesn't check it for this registration.
Authorization endpoint	`<MCP Server URL>/authorize`
Token endpoint	`<MCP Server URL>/token`
Refresh endpoint	`<MCP Server URL>/token`
Scope	`read`
Enable PKCE	On. Access360 rejects sign-ins without it.
Client password authentication method	Request body parameters. Access360 doesn't support HTTP Basic.

Click Save, then copy the OAuth client registration ID that the portal shows.

Part 3: Create the connector in the Microsoft 365 admin center

Sign in to the Microsoft 365 admin center and go to Copilot → Connectors.
On the Gallery tab, under Created by your org, select Create a new connector, then Add.

On the Custom connector page, under Connect to MCP server, select Add, and fill in the form:

Field	Value
Display name	The name people see in Copilot, such as `iGrafx Process Design`
Description	What the connector is for. Copilot reads it to decide when to use the connector. For example: "Processes, risks, controls, and other content in our iGrafx process repository."
MCP endpoint URL	`<MCP Server URL>`
Developer name	`iGrafx`
Website URL	`https://doc.igrafx.com/docs/access360/`
Privacy policy URL	`https://www.igrafx.com/company/legal/privacy`
Terms of use URL	`https://www.igrafx.com/legal/`
Authentication type	OAuth 2.0
Registration ID	The OAuth client registration ID from part 2

If the form asks you to authorize the connection, the iGrafx authorization page opens. Sign in with your iGrafx account, or connect with an API key if your platform uses the classic iGrafx Login.
Click Save to create the connector.

Part 4: Roll out the connector

Select the connector, then Staged rollout, and add yourself or a test group under Users or Groups.
When the test succeeds, click Deploy to all users. The connector becomes available to everyone your Microsoft 365 User access settings include. It can take several minutes to appear.

Each person then turns the connector on in Copilot Chat under Settings → Sources. The first time, the iGrafx authorization page opens and they sign in with their own iGrafx account. Copilot uses that account's permissions for every request.

Verify

In Copilot Chat, turn on the connector under Sources and ask: "Using iGrafx Process Design, which iGrafx user am I connected as?" Copilot answers with your iGrafx account's name. Naming the connector in the request makes Copilot more likely to use it.

Troubleshooting

The sign-in page shows Unregistered redirect_uri: the redirect address in part 1 doesn't match. Register again with exactly https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect, and update the client ID in part 2.
The sign-in page shows Invalid client_id: the client ID in part 2 doesn't belong to this MCP Server URL. Check that both parts use the same address, including the tenant ID.
The authorization fails with an error that mentions code_challenge and S256: Microsoft didn't send PKCE with the sign-in. Turn on Enable PKCE in the OAuth client registration from part 2, save it, and try again.
The sign-in completes but the connection fails: check that the client password authentication method is Request body parameters.
Copilot reports that MCP connectivity is disabled, or that the account doesn't have permission: compare the message with Messages an assistant reports.

Prerequisites​

Supported versions​

Configuration​

Part 1: Register Microsoft 365 Copilot with Access360​

Part 2: Register the OAuth client in the Teams Developer Portal​

Part 3: Create the connector in the Microsoft 365 admin center​

Part 4: Roll out the connector​

Verify​

Troubleshooting​

Related​