Microsoft Copilot Connector Setup

Before You Begin

The Microsoft Copilot connector syncs Copilot-licensed users and interaction history from the Microsoft Graph API, giving you visibility into M365 Copilot adoption across your organization. Setting it up requires registering an application in Microsoft Entra (Azure AD) and granting it permission to read Copilot usage reports and enterprise interactions. This is an IT admin task — you'll need access to both the Entra admin center and a Global Administrator to grant tenant-wide consent.

What you'll need:

• A Microsoft 365 tenant with Copilot licenses assigned to users
• Application Developer role (or higher) in Microsoft Entra to register the app
• A Global Administrator to grant admin consent for the API permissions

Note: Microsoft Graph usage reports have a built-in 48-hour data delay, so newly assigned Copilot users and their activity will appear in Section roughly two days after they begin using Copilot.

Register an Application in Microsoft Entra

Create a new app registration in your tenant — this is the identity Section will use to call the Microsoft Graph API on your behalf.

1. Sign in to the Microsoft Entra admin center with an account that has at least the Application Developer role.
2. If your account has access to multiple tenants, click the Settings icon in the top menu and switch to the tenant where Copilot is licensed.
3. In the left navigation, go to Entra ID → App registrations, then click New registration.
4. Enter a meaningful Name for the app — for example, Section AI Copilot Connector.
5. Under Supported account types, select Accounts in this organizational directory only (Single tenant).
6. Leave Redirect URI blank — it isn't needed for this connector.
7. Click Register to create the application.

Copy the Tenant ID and Client ID

Once the app is registered, the Overview page shows the two identifiers Section needs to authenticate to your tenant.

1. After registering, you'll land on the app's Overview page. If not, go to Entra ID → App registrations and select the app you just created.
2. Locate the Essentials section at the top of the page.
3. Copy the Application (client) ID value.
4. Copy the Directory (tenant) ID value.

Warning: Do not copy the Object ID. It looks similar but is a different identifier and is not used for authentication.

Value to copy: Directory (tenant) ID — found on the app's Overview page under Essentials. Paste into the Tenant ID field.

Value to copy: Application (client) ID — found on the app's Overview page under Essentials. Paste into the Client ID field.

Grant Microsoft Graph API Permissions

Authorize the app to read Copilot usage reports, interaction history, audit logs, and user identities. These are application permissions that require a Global Administrator to consent on behalf of the entire tenant.

1. In your app registration, open API permissions in the left navigation.
2. Click Add a permission, then select Microsoft Graph.
3. Choose Application permissions (not Delegated permissions).
4. Search for and add each of the following permissions:
   • Reports.Read.All — reads Microsoft 365 Copilot usage reports
   • AiEnterpriseInteraction.Read.All — reads Copilot interaction and activity content
   • User.Read.All — resolves user identities
   • AuditLogsQuery.Read.All — reads Copilot audit log records
5. Once all four are listed, click Grant admin consent for {your tenant name}. This action must be performed by a Global Administrator.
6. Confirm that each permission shows a green check under the Status column reading Granted for {tenant}.

Warning: AiEnterpriseInteraction.Read.All only returns data for users with a Copilot license assigned. If no licenses are present, no interaction data will be available.

Warning: Without admin consent, Section's token requests will fail with a 401 Unauthorized error and the sync will not run.

Create a Client Secret

Generate a secret that Section will use to authenticate as the app. The secret value is only displayed once at creation — copy it immediately.

1. In your app registration, open Certificates & secrets in the left navigation.
2. Make sure the Client secrets tab is selected, then click New client secret.
3. Enter a Description — for example, Section AI connector.
4. Set the Expires period. We recommend 24 months to minimize rotation overhead.
5. Click Add.
6. In the Client secrets list, immediately copy the value shown in the Value column (not the Secret ID).

Warning: The secret value is only displayed once. If you navigate away before copying it, you'll need to create a new secret and start over.

Value to copy: The Value column of the newly created client secret — found under Certificates & secrets → Client secrets. Paste into the Client Secret field.

References