Connect Autobahn Security to Microsoft 365 Copilot

Overview

Use Autobahn Security inside Microsoft 365 Copilot through a Copilot Studio agent. One person sets the agent up once. After that, everyone in the organization chats with Autobahn in Copilot Chat, each signed in with their own Autobahn API token.

💡For creating an API token, general troubleshooting, or other assistant tutorials, see Connect Autobahn Security to your AI assistant.

How it works

Who	What	How often
The person who builds the agent	Creates the agent, adds Autobahn as a tool, publishes it to Microsoft 365, and shares it (Parts 1–4)	Once per organization
Every user	Adds the agent and connects it with their own Autobahn API token (Part 5)	Once per user
Every user	Asks questions in Copilot Chat	Daily

Each user only ever sees the Autobahn organization of their own API token. Nobody shares the token of the person who built the agent.

Prerequisites

Copilot Studio access in your Microsoft tenant for the person who builds the agent.
Copilot Studio capacity (Copilot Credits) in the environment, either prepaid or pay-as-you-go. Without it the agent replies “This environment is out of credits” or “It has reached its usage limit”. Your Microsoft 365 administrator sets this up in the Power Platform admin center.
Access to Power Apps (make.powerapps.com) to share the agent’s connector. The person who builds the agent already has this.
For every user: Microsoft 365 Copilot Chat and an Autobahn API token. Create the token in Autobahn under Settings → Developer → API Token.

Part 1: Create the agent

1. Open Copilot Studio. Either go to https://copilotstudio.microsoft.com, or in Microsoft 365 Copilot open the app launcher (the grid icon at the top left), search for Copilot Studio, and select it.

2. Select Agents in the left menu, then select New agent.

3. Give the agent a name, for example Autobahn MCP. Optionally, replace the example text under Instructions with the recommended instructions below.

💡Recommended agent instructions
You help users look up their Autobahn Security data: scans, issues, assets, workouts and hackability scores. Always use the Autobahn tools for questions about this data. Never answer from general knowledge or the web. Keep answers short and list the key facts.

Part 2: Add Autobahn as a tool

1. In the panel on the right, select + next to Tools.

2. In Add a tool, select + Add at the top right and choose Model Context Protocol (MCP). The MCP tab only lists Microsoft’s built-in servers, so Autobahn is added this way.

3. Fill in Add MCP server, then select Add:

Server name: Autobahn Security
Server description: Query assets, issues, scans, workouts and hackability scores in Autobahn Security.
Server URL: https://mcp.app.autobahn-security.com/mcp
Authentication: OAuth 2.0
Configuration type: Dynamic (with discovery)

💡Copilot reads the server description to decide when to use Autobahn, so keep it specific. The server name must be unique in your Microsoft environment. If someone in your organization already added Autobahn, you’ll see “Can’t create MCP server. Try again.” Use a different name, or share the existing agent (Part 4) instead of building a second one.

4. In Select a connection, open the Connection menu and choose Create new connection.

5. Optionally enter a display name, then select Create.

6. The Connect to Autobahn Security sign-in page opens. Choose API key, paste your Autobahn API token, and select Connect. If you use an external API user ID and secret key instead, choose External API user ID + Secret key. Copilot never sees these values; you enter them on Autobahn’s own page.

7. Back in Select a connection, the connection shows Autobahn Security with a green check. Select Add.

8. Autobahn Security now appears under Tools. You can try it on the Preview tab before you publish.

💡Keep the tool’s credentials set to End user, so each person signs in with their own Autobahn token. This is the default. If the tool’s settings offer maker-provided credentials, don’t use them: every user would then act with your token and see your organization’s data.

Part 3: Publish to Microsoft 365 Copilot

1. Select Publish at the top right.

2. In the Publish dialog, select + Add channel.

3. Choose Teams + Microsoft 365.

4. Under Availability, keep Microsoft Copilot and Microsoft Teams selected, then select Add channel. You can’t change this setting after publishing.

5. Select Publish agent.

6. When Your agent published successfully appears, select Close. On the Agents page, the agent’s status is now Published.

Part 4: Share with your organization

Sharing has two parts. You share the agent so people can open it, and you share its connector so people can connect their own Autobahn token. Both are needed.

1. Share the agent. In Copilot Studio, open the agent and select the Share icon at the top right. Under Organization, set Everyone in your organization to End user access, or add specific people or groups. Then select Share.

2. Copy the agent link. In the same dialog, open the menu next to Copy link and choose Microsoft Copilot. Send this link to your users. It’s the only link they need.

3. Share the connector. Go to make.powerapps.com, select the same environment, then Custom connectors. Open the connector named after your MCP server (Autobahn Security) and go to the Share tab. Select Share with org (or add the same people or groups), choose Can view, and select Save.

💡To list the agent for everyone under Built for your org in the agent store, the person who built the agent can instead submit it for approval: Channels → Teams + Microsoft 365 → Availability options → Show to everyone in my org. A Teams or Microsoft 365 administrator then approves it.

💡Choose Can view, never Can edit. Can view only shares the connector’s definition (server URL and sign-in settings), never your Autobahn token. Without this step, users get “Connector information unavailable” when they try to connect.

Part 5: Use the agent

1. Open the agent link you received and select Add.

2. In Microsoft 365 Copilot Chat, select + in the message box, then Chat with an agent, and pick Autobahn MCP. The message box now says Message Autobahn MCP.

3. The first time you ask something, the agent replies “Let’s get you connected first”. Select Open connection manager, then Connect next to Autobahn Security. Sign in on the Autobahn page with your own API token, as in Part 2 step 6. Then select Submit, and select Retry in the chat. You’ll be asked to connect again about every 3 days.

4. Ask your question, for example: “Give me my 5 latest scans.”

💡To connect before the first chat, the person who built the agent can also send the Copy link → Set up connections link from the Share dialog. It opens the same connection page, where the status shows End user credential, meaning each user signs in with their own account.

Example prompts

Scans: “Show me my 5 most recent scans and whether they finished.”
Issues: “List my critical issues and group them by asset.”
Assets: “Which of my assets are most hackable right now?”
Overview: “Summarise my hackability score and what is dragging it down.”
Changes: “Tag these issues as urgent.” Write actions always ask for your approval first.

Troubleshooting

What you see	Cause	What to do
“This environment is out of credits” or “It has reached its usage limit”	No Copilot Studio capacity left. This message comes from Microsoft, not Autobahn.	Ask your Microsoft 365 administrator to add Copilot Credits or turn on pay-as-you-go in the Power Platform admin center.
Model Context Protocol is missing under Add a tool	The MCP option isn’t enabled for your tenant or environment yet.	Ask your Power Platform administrator. If needed, they can raise a Microsoft support request.
The connector is blocked, or tool calls fail with a data policy message	A Power Platform data loss prevention (DLP) policy blocks custom connectors.	Ask your Power Platform administrator to allow the Autobahn Security connector in the environment’s data policy.
“Can’t create MCP server. Try again.”	The server name is already used in your environment.	Use a different server name, or share the existing agent instead.
“Connector information unavailable” when connecting	The connector isn’t shared with you.	The person who built the agent completes Part 4 step 3 (Can view).
The agent isn’t listed under Chat with an agent	The agent hasn’t been added yet.	Open the agent link and select Add.
“Let’s get you connected first”	You haven’t connected your Autobahn token yet.	Follow Part 5 step 3.
Banner “Connection bindings unavailable” on the connections page	A Microsoft-side warning. It doesn’t block connecting.	Ignore it, or select Retry.
The answer comes from the web instead of Autobahn	The question didn’t trigger the Autobahn tool.	Mention Autobahn in the question, use the recommended instructions, and remove Search all websites from the agent’s Knowledge.

How Can We Help you?