How to Connect Salesforce to Microsoft Copilot with the Salesforce Hosted MCP Server

More of the financial services firms we work with have standardized on Microsoft 365 Copilot, and the first request we hear afterward is predictable: "Can I ask Copilot about our Salesforce data?" The answer is yes. Salesforce now offers hosted MCP (Model Context Protocol) servers, and Copilot Studio can connect to them. The setup has a few places where it stalls, though, mostly around authentication. This guide walks through the steps in the order we run them with clients.

What do you need before connecting Salesforce to Copilot?

Line up four things before anyone opens a wizard:

• A Salesforce hosted MCP server, configured in your org. Salesforce provides standard servers, including a read-only server for querying records and a broader server that adds create, update and delete tools. Your Salesforce admin enables and configures these in Setup.
• An External Client App (ECA) in Salesforce. This is the OAuth app the MCP client signs in through.
• A Copilot Studio license and a maker in your Microsoft tenant who can build and publish an agent.
• A test user whose Salesforce login works through your normal single sign-on, with the permissions you want the agent to have.

Salesforce's documentation also notes that hosted MCP usage is tied to Flex Credits, so confirm with your account team how usage will be counted before you roll it out widely.

Which Copilot surface should you connect Salesforce to?

There are two supported routes inside a Microsoft 365 tenant, and they behave differently.

1. A Copilot Studio agent (what we recommend for most firms). You add the Salesforce MCP server as a tool on an agent, choose OAuth 2.0, and Copilot Studio discovers the server's tools automatically. When Salesforce adds or changes tools, the agent picks them up without a redeploy. You can then publish the agent to Microsoft 365 Copilot and Teams.
2. A custom federated connector in the Microsoft 365 admin center. This puts Salesforce data directly into Copilot in Word, Outlook and Teams. Microsoft positions this route for read-only tools, which suits a reporting-first rollout but won't let users create or update records.

The consumer Copilot app can't connect to MCP servers. This work happens in your organization's Microsoft 365 tenant.

How do you set up the Salesforce side?

1. Copy the MCP server URL for the server you want to expose. It is a different address from your org's instance URL (the yourdomain.my.salesforce.com address). If someone hands Copilot the instance URL, you get generic API access with no business-friendly tools on top.
2. Create or edit the External Client App. Enable OAuth, add the scopes mcp_api and refresh_token, and turn on JWT-based access tokens for named users.
3. Add the callback URLs. Add the callback URL that Copilot Studio generates in its MCP wizard, plus Microsoft's Teams OAuth redirect (https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect) if you plan to publish to Teams and Microsoft 365 Copilot.
4. Harden the app for production. Salesforce recommends a refresh token lifetime of 30 days or less, refresh token rotation, and an optional permission set so only approved users can authorize the app.
5. Record the consumer key and secret and share them with your Copilot Studio maker through a secure channel.

How do you add the Salesforce MCP server in Copilot Studio?

1. Open the agent, go to Tools, select Add a tool, then New tool, then Model Context Protocol.
2. Enter a server name, a clear description (the orchestrator reads it to decide when to call Salesforce), and the MCP server URL.
3. Choose OAuth 2.0, then Manual. Enter the ECA consumer key and secret, your org's authorization URL (https://yourdomain.my.salesforce.com/services/oauth2/authorize), the token URL and refresh URL (/services/oauth2/token), and the scopes mcp_api refresh_token.
4. Copy the callback URL Copilot Studio shows you back into the External Client App.
5. Select Create, create a new connection, and add the tool to the agent.

Copilot Studio only supports the Streamable HTTP transport for MCP. Salesforce's hosted servers use it, so there is nothing extra to configure there.

Why does the Salesforce sign-in fail with SSO, and how do you fix it?

This is the step where most projects stall. If your Salesforce org uses Microsoft Entra ID for single sign-on, the OAuth sign-in goes back to Entra to authenticate. When the person creating the connection signs in with an account that has no matching Salesforce identity (an elevated admin account is the usual culprit), the round trip fails and the connection never completes.

Two fixes work:

• Have a regular SSO user complete the sign-in. An IT admin can build the agent and the tool, then a business user whose Salesforce login already works through SSO creates the connection.
• Match the identities. If the admin must authenticate, set the Federation ID on their Salesforce user to the Entra identity they sign in with.

How do you test and roll out the connection?

1. Make sure generative orchestration is turned on for the agent. If the Salesforce tools don't appear, this setting is the first thing to check.
2. Test with plain questions that have known answers, such as "List the leads created last week" or "Show open opportunities over $250,000 by stage." Compare the results to a Salesforce report.
3. Publish the agent to Microsoft 365 Copilot and Teams for a pilot group.
4. Repeat the same pattern for other MCP-enabled tools. A second data source is one more MCP tool on the same agent, with its own server URL and authentication.

Frequently asked questions

Can Copilot update Salesforce records, or only read them?

Both are possible. What Copilot can do depends on which MCP server and tools you connect. A read-only server limits it to queries. A server with create and update tools lets users change records in plain language, within their own Salesforce permissions.

Does Copilot see data the user can't see in Salesforce?

No. The connection uses per-user OAuth, and Salesforce documents that its SObject tools respect field-level security and sharing rules. Users see what their Salesforce access already allows.

Is the instance URL enough to connect Copilot to Salesforce?

It technically gives API access, but users have to be very prescriptive in their prompts because there are no business-friendly tools on top of the API. The MCP server URL is the address to use.

Do we need Copilot Studio, or can we use Microsoft 365 Copilot alone?

For read and write access, use a Copilot Studio agent and publish it to Microsoft 365 Copilot. The admin-center federated connector route is designed for read-only scenarios.

What does the Salesforce hosted MCP server cost?

Salesforce ties hosted MCP usage to Flex Credits. Ask your Salesforce account team how your agreement counts usage before a broad rollout.

If we move off Copilot later, do we have to redo the Salesforce work?

No. The MCP server, External Client App and permission model live in Salesforce. Claude, ChatGPT and other MCP clients connect to the same server with their own callback URL.

Need help connecting Copilot to Salesforce?

Vantage Point sets up Salesforce MCP connections for financial services firms, including the identity, permissions and phased rollout that compliance teams ask about. Book a working session with our team.