Skip to main content

​
Overview

The Microsoft Copilot integration connects Microsoft 365 Copilot usage data to G360. It authenticates as a Microsoft Entra application (a daemon app with no user sign-in), so you first register that application in your tenant. Using this integration, organizations can:
  • Register an Entra application with Microsoft Graph application permissions
  • Collect Copilot usage and user-count reports
  • Enrich usage data with directory details such as department, job title, and account status
  • Synchronize and monitor Copilot adoption data

​
Prerequisites

Before configuring the integration, ensure you have:
  • Access to the Engineering Metrics dashboard in G360
  • Access to the Azure portal for the tenant you want to connect
  • An admin who can grant tenant-wide consent: Cloud Application Administrator, Application Administrator, or Global Administrator
Global Administrator is only needed for permissions that enable privilege escalation, such as RoleManagement.ReadWrite.Directory and AppRoleAssignment.ReadWrite.All. This integration uses neither.

​
Set up the Entra application

1

Switch to the right directory

This is the step most setups get wrong, and it fails silently. Consent granted in the wrong directory succeeds there and changes nothing in the tenant you need.
  1. In the Azure portal, click your avatar (top right) → Switch directory.
  2. Select the tenant you intend to connect.
  3. Go to Microsoft Entra ID → Overview and confirm the Tenant ID matches the one you will enter in G360.
2

Open or create the app registration

  1. In the portal search, open App registrations.
  2. Open the All applications tab. The default view lists only apps you own, so an app created by a colleague does not appear under Owned applications.
  3. Search for the Client ID, or click + New registration and enter:
  4. On Overview, confirm Directory (tenant) ID matches the tenant from the previous step.
If Directory (tenant) ID does not match the tenant you want data from, the app lives in another tenant. Either register a new app in the correct tenant, or make this one multi-tenant and consent into the target tenant explicitly.
3

Add the permissions

  1. In the left nav, go to API permissions.
  2. Click + Add a permission → Microsoft Graph.
  3. Choose Application permissions, not Delegated.
  4. Select both permissions below, then click Add permissions.
Delegated permissions act on behalf of a signed-in user. This integration authenticates as itself with no user present, so delegated permissions have no effect. This is the second most common setup mistake.
You can leave the User.Read (Delegated) entry that Azure adds to every new registration. It is unused and harmless. It is not the same as User.Read.All: it reads only the signed-in user’s own profile.
4

Grant admin consent

  1. On API permissions, click Grant admin consent for <Tenant Name>.
  2. Click Yes to confirm.
  3. Confirm every row’s Status shows a green ✅ Granted for <Tenant>.
Read the tenant name in the button. It names the directory that receives the consent. If it is not the tenant you expect, stop: you are in the wrong directory and missed the first step.
Granting consent also creates the service principal. Until it exists, Entra issues no token and fails with AADSTS7000229. See Troubleshooting.If the button is grayed out, your account lacks the required role. Ask an admin to grant consent, or have them open this URL:
5

Create a client secret

  1. In the left nav, go to Certificates & secrets → Client secrets → + New client secret.
  2. Set a description and expiry.
  3. Copy the Value column immediately.
The table shows two columns. Value is the secret. Secret ID is only an identifier and does not authenticate: pasting it produces AADSTS7000215. Azure shows the Value only once. After you navigate away, you cannot retrieve it and must create a new secret.
6

Verify the service principal exists

  1. Go to Microsoft Entra ID → Enterprise applications → All applications.
  2. Search for the Client ID.
The app must appear here. App registrations lists application definitions; Enterprise applications lists the service principals that can actually authenticate. A row in the first without a row in the second is exactly the AADSTS7000229 state.

​
Connect in G360

1

Open Microsoft 365 Copilot

In G360, go to Integration → LLM → Microsoft 365 Copilot → Connect.
2

Enter connection details

3

Test and save

Click Test, then save the connection.
4

Assign the connection to a project

Assign the connection to a project.
The analytics endpoints resolve connections by project and return 404 without one.

​
Synchronization and metrics

Run a sync with:
--inline runs the sync in-process, so failures appear in your terminal rather than a worker log.
If the tenant holds no Copilot licenses, the connection succeeds but the sync reports skipped and returns no data. This is expected.

​
Troubleshooting

Possible causes
  • You pasted the secret ID instead of the Value
Actions
  • Copy the Value column of the client secret. If you no longer have it, create a new secret (see Create a client secret).
Possible causes
  • Admin consent was never granted, so no service principal exists
Actions
  • Grant admin consent (see Grant admin consent).
  • Confirm the app appears under Enterprise applications (see Verify the service principal exists).
Possible causes
  • The client secret has expired
Actions
  • Create a new client secret (see Create a client secret) and update the Client Secret in the G360 connection.
Possible causes
  • The Client ID is not in this tenant
Actions
  • Check Directory (tenant) ID on the app registration (see Open or create the app registration).
Possible causes
  • The Tenant ID is wrong
Actions
  • Confirm the Tenant ID under Microsoft Entra ID → Overview (see Switch to the right directory).
Possible causes
  • Reports.Read.All is missing or not consented
Actions
  • Add Reports.Read.All as an Application permission and grant admin consent (see Add the permissions and Grant admin consent).
Possible causes
  • The tenant holds no Copilot licenses
Actions
  • None needed. This is expected, and the sync reports skipped.
Possible causes
  • The tenant conceals user names in reports. Microsoft 365 can anonymize user names in all admin reports. When enabled, Graph returns hex digests instead of UPNs, so per-user Copilot attribution is impossible. The integration detects this and reports it rather than showing an empty leaderboard. Seat and adoption figures are unaffected.
Actions
  • In the Microsoft 365 admin center, go to Settings → Org settings → Reports and clear Display concealed user, group, and site names in all reports.

​
Best practices

  • Confirm you are in the correct directory before granting consent.
  • Use Application permissions, never Delegated.
  • Copy the secret Value immediately, and note its expiry so you can renew it before sync stops working.
  • Assign every connection to a project.
  • Run the first sync with --inline so failures appear in your terminal.

​
Summary

The Microsoft Copilot integration connects Microsoft 365 Copilot usage data to G360 through an Entra application with Reports.Read.All (mandatory) and User.Read.All (enrichment) application permissions. Get the directory, consent, and client secret right, and the connection, project assignment, and sync follow.