Introduction
Microsoft has two different Copilot products, and they connect to ComplyFlow in different ways:
Product | Who uses it | How it connects to ComplyFlow | Available |
Microsoft Copilot Studio | A "maker" who builds a custom agent for their team | A Personal API Token | Now |
Microsoft 365 Copilot (in Teams, Outlook and Office) | Everyday staff | The ComplyFlow agent, where you sign in with your ComplyFlow account | Coming soon |
Copilot Studio
Before you start
A Microsoft Copilot Studio licence, and permission to create agents in your Power Platform environment. Your IT team can confirm this.
Your organisation's data policies must allow connectors to external services. Copilot Studio treats an MCP server as a Power Platform connector.
The MCP / API token access permission (or Edit Organisation Details) in ComplyFlow, and a Personal API Token with the scopes the agent needs. Refer to Creating and managing Personal API Tokens.
Important: everyone who uses the agent acts as the person who created the token. They can see and change whatever that token allows, even if their own ComplyFlow access is narrower. Use the narrowest scopes you can, and consider read-only scopes for an agent shared with a team. Write access is available on request, so the agent can only read data until your organisation has had it turned on.
Add ComplyFlow to your agent
1. In Copilot Studio, open your agent and go to the Tools page.
2. Select Add a tool > New tool > Model Context Protocol.
3. Fill in:
Server name:
ComplyFlowServer description:
Reads and updates ComplyFlow compliance data: sites, suppliers, workers, incidents, inspections, training, plant, permits, forms and risks.Server URL:
https://mcp.complyflow.com.au/mcp
4. Under authentication, select API key.
5. Set Type to Header, and enter Authorization as the header name.
6. Select Create.
7. On Add tool, select Create a new connection. When asked for the API key, enter Bearer followed by a space and your token, for example Bearer cf_pat_….
8. Select Add to agent.
9. Test the agent: "Using ComplyFlow, which sites can I access?"
Change or remove the connection
To use a different token, edit the connection in Power Apps or Power Automate under Connections.
To cut off access straight away, revoke the token in ComplyFlow under API Tokens. The agent stops working until you give it a new token.
Microsoft 365 Copilot
Coming soon. A ComplyFlow agent for Microsoft 365 Copilot will let staff use ComplyFlow in Teams, Outlook and Office. Each person will sign in with their own ComplyFlow account, so they only see what they can see in ComplyFlow. We'll update this guide when it's available.