Connect Copilot to the R2 Docuo AI connector

This article explains how to connect Microsoft Copilot to the R2 Docuo AI connector, so you can query your repository in natural language, with each user’s own credentials and permissions.

We are in the process of publishing the R2 Docuo connector in the Microsoft 365 Copilot connectors gallery, where other vendors’ connectors are already listed. Once Microsoft approves it, setup will be considerably simpler: the support ticket for credentials and the registration in the Teams Developer Portal will no longer be needed, and an administrator will simply approve the connector from the gallery. We will update this article as soon as that happens.

Before you start, an administrator of your repository must have enabled the connector and granted you access. See Requirements and activation of the AI connector.

Choose your route before you start

There are two ways to bring R2 Docuo into Copilot, and the difference is not a detail: it changes where it shows up, who sets it up and what permissions you need.

If you have administrator permissions, use the first one. The second exists for anyone who wants to try the integration without waiting for their organisation to approve it, and it is described further down.

AI assistants change their menus and their capabilities often. The steps in this article describe the process as of September 2026: in your version, an option may be somewhere else, be called something different, or no longer be needed. If something does not add up, search for “MCP”, “connectors” or “sources” in the settings.

What you need

In Microsoft

• The Global administrator or AI administrator role in the Microsoft 365 admin center. Route A only.
• Access to the Teams Developer Portal, also route A only.
• Microsoft 365 Copilot licences for the people who are going to query the repository.

In R2 Docuo

• A compatible plan and artificial intelligence enabled in the repository.
• MCP access enabled, either for the whole repository or on each user’s record.
• A named user account, with its password. Collaborators cannot use the connector.
• The server address: https://mcp.r2docuo.com

The requirements on the Docuo side are set up by your repository administrator, and it is worth confirming them before you start: if any of them is missing, the sign-in screen will not offer you any repository and the message will not tell you which one it is. They are explained one by one in Requirements and activation of the AI connector.

Check first

One minute that saves many. Check from your network that the server responds before you configure anything:

Invoke-WebRequest https://mcp.r2docuo.com/.well-known/oauth-protected-resource

It must return 200 and a JSON document containing "resource_name":"R2 Docuo". If it does not respond, the problem is in your network or your outbound proxy, and it is worth solving that first.

Route A · The federated connector

A federated connector queries R2 Docuo in real time. It does not copy or index anything in Microsoft: every answer is requested from the repository at that moment, with the identity of whoever is asking.

There are three stretches: preparing the credentials, registering the connector in the organisation, and each person turning it on. An administrator does the first two once; each user does the third.

Preparation: credentials and OAuth registration

Most assistants register themselves with our authorization server and need no configuration at all. The federated connector does not: the Teams Developer Portal requires a client ID and a client secret up front, so this step cannot be self-served.

We issue those credentials at the customer’s request. The request is filed by an administrator, because R2 Docuo support is limited to administrators and advanced users: if you are not one, ask whoever administers your repository to open the ticket.

1. An administrator opens a support ticket from their R2 Docuo account.
2. They state your organisation’s name, that the credentials are for the Copilot federated connector, and which repository will be used.
3. We send back a client ID and a secret the same way, together with the addresses they will need in the next step.

You do not need to supply the return URL: Copilot sets it and the server accepts whichever one it brings. And keep the secret somewhere safe, because it is not shown again: if it is lost, a new one has to be issued.

The client ID and the secret identify the assistant, not a person: they do not replace named authorization. Whoever connects still signs in with their own R2 Docuo account on the sign-in screen and queries with their own permissions.

The client secret is a password for access to the service. Configure it only in the environment it was issued for, safeguard it diligently, and do not enter it in third-party applications or services you do not control. If you suspect it has been compromised, request its rotation through a support ticket. We may also rotate or revoke credentials for security reasons, notifying you as soon as possible.

With the credentials in hand, register the OAuth connection. Go to dev.teams.microsoft.com and open Tools → OAuth Client Registration → + New OAuth connection. Fill in:

Field	Value
Name	R2 Docuo
Client ID	The one R2 Docuo gave you
Client secret	The one R2 Docuo gave you
Authorization endpoint	https://mcp.r2docuo.com/authorize
Token endpoint	https://mcp.r2docuo.com/token
Refresh endpoint	https://mcp.r2docuo.com/token
Scopes	r2docuo.mcp

Under Restrict usage by organization leave Only my organization. Under Restrict usage by Teams app leave Any Teams app: a federated connector is not a Teams app, so there is none to tie it to. Also tick the PKCE box, which R2 Docuo supports.

When you save, the portal shows an OAuth client registration ID. Keep it: it is the only piece that travels from the Teams portal to the admin center, without it the connector cannot be created, and looking it up again means redoing the registration.

Do not confuse the registration ID with the client ID. The client ID was issued by R2 Docuo and you have just typed it into this form; the registration ID is minted by Microsoft when you save. Putting one where the other goes is the most common mistake in the whole process, and the error message does not make it clear.

Registering the connector, once

1. In admin.microsoft.com, go to Copilot → Connectors and open the Gallery tab. Under Created by your org, find the Create a new connector box and click Add.
2. On the custom connector page, under Connect to MCP server, click Add.
3. For Display name, enter R2 Docuo exactly: it is the name your users will see in the list of sources.
4. For Base URL, https://mcp.r2docuo.com
5. For Registration ID, the OAuth client registration ID you saved when you registered the OAuth connection.
6. Click Save. The connector moves to the Your connections list, alongside the tenant’s other connectors.

The address is the root, without adding /mcp or any other path. With a path after it, Copilot looks for the access configuration at an address that does not exist and the connection fails.

Registering the connector does not show it to anyone yet. Select it in Your connections and use Staged rollout to enable it first for a few people or for a Microsoft Entra group. When you are happy with it, click Deploy to all users.

Changes take up to 15 minutes to take effect. If something does not appear straight away, wait before touching the configuration. From that same list you can later disable the connector without losing its configuration, or delete it entirely.

Each person turning it on, once

The connector does not carry administrator credentials along with it: even if it has been deployed to the whole organisation, each person has to connect with their own. It is a one-off, and it is done from the chat itself.

1. In Microsoft 365 Copilot Chat, open the … menu and go to Settings → Sources.
2. Find R2 Docuo in the list and click Connect.
3. The R2 Docuo sign-in screen opens, in two steps: first your email and password; then the repository —the list only appears if you have access to more than one— and the authorization.
4. When you finish you return to the chat and the source is marked as connected.

Your password is typed only on the R2 Docuo screen; Copilot neither sees it nor stores it.

You can now ask questions in the chat as usual. If Copilot does not turn to Docuo on its own, name it in your question: “search R2 Docuo for August’s invoices”. In the Researcher agent, R2 Docuo appears in the sources menu and is selected explicitly for a piece of research. There are more example questions in What you can ask the AI connector.

To stop using it, turn the source off in those same settings. That is also how you change repository: disconnect and connect again.

What you can query

A federated connector is read-only by Microsoft’s design, so what remains available in it are the query tools from the AI connector’s catalogue: searching, listing, running saved queries, summarising, reading documents and their text, and going through categories, fields, folders and workflows. They are described one by one in What you can ask the AI connector.

Your repository may also have query tools of its own, defined by your organisation, which will appear alongside these. Write operations —creating documents, advancing workflows— are still done from R2 Docuo.

What is worth knowing

Aspect	What it means in practice
Nothing is indexed	Copilot neither stores nor copies the repository’s content. Every answer is queried at that moment and disappears with the conversation. Documents do not leave R2 Docuo.
The permissions are yours	Each person sees exactly what they would see in the application. Nobody reaches anything through Copilot that they could not open themselves.
One repository per connection	The repository is chosen when you connect. To change it, turn the source off in your Copilot settings and connect again.
Revocation is immediate	If an administrator withdraws your access in R2 Docuo, your next query fails instantly. Nothing has to be touched in Microsoft.
It is audited	Federated connector activity can be audited from Microsoft Purview.

Route B · A Copilot Studio agent

This is the alternative for anyone without administrator permissions. R2 Docuo is added as a tool of your own private agent, which nobody else in the organisation sees.

The difference from the federated connector: you can only query it by talking to that specific agent, not from the general Copilot chat, or from Excel or Researcher.

1. In copilotstudio.microsoft.com, check that you are in the right environment and create an agent with Create → New agent.
2. Open the Tools tab and choose Add a tool → New tool → Model Context Protocol.
3. For Server URL, enter https://mcp.r2docuo.com —the root, with no path— and write a specific description of what the repository contains: Copilot reads it to decide when to query it.
4. Under Authentication, choose OAuth 2.0 and, as the type, Dynamic discovery.
5. Click Add tool → Create a new connection, sign in on the R2 Docuo screen, choose a repository and go back to Add to agent. Try it out in the agent’s test panel.

On this route no credentials are needed: the server negotiates them on its own. If the form asks you for a client ID and a secret, you have selected Manual by mistake.

On this route the agent also has the change repository tool available. Do not use it from Copilot: it closes the session, and Copilot cannot ask you for credentials again on its own, so the connection is left unusable without warning and has to be rebuilt from Power Apps.

Who queries with which permissions

Pay attention to this point if you are going to share the agent. In Copilot Studio, the connection you created stays associated with the agent, so queries may run with the R2 Docuo authorization you created, not with that of each person using the agent. Check how the connection is configured in your environment before sharing it, and remember that the access token is a password for access to the service and must not be shared between users.

If you need each person to query with their own permissions, configure the connection so that each user creates their own, or use the federated connector from route A, where authorization is always personal.

If you later want the agent to appear in the Microsoft 365 Copilot chat, publish it from Channels → Microsoft 365 Copilot. It goes to an administrator for approval, who decides whether it is assigned to the whole organisation or only to certain people.

Disconnecting

With the federated connector, each person turns the source off in their own Copilot settings. An administrator can also disable or delete the connector from Your connections in the admin center.

With the Copilot Studio agent, remove the tool from the agent and delete the connection from your Power Platform environment.

On the Docuo side, an administrator can withdraw access at any time without touching anything in Microsoft: the next query will be rejected.

If something does not work

What you see	What to check
The connector will not save	Almost always the registration ID. The field expects the one the Developer Portal returned when you saved the OAuth connection, not the client ID R2 Docuo gave you. Check too that the base address is the root, with no path added.
Users do not see it under Sources	Registering the connector does not deploy it. Review the Staged rollout and wait 15 minutes. If it still does not show up, look at the Allowed agent types setting in Agent 365: with the published connector options deselected, it has to be enabled individually.
Connecting the source fails after clicking Connect	Almost always the OAuth credentials: check that the three endpoints are the ones in the table and that the secret was not copied with trailing spaces.
No repository appears after you sign in correctly	One of the Docuo requirements is missing: a compatible plan, AI enabled, MCP access enabled, or the account is a collaborator’s. Contact your repository administrator.
You cannot sign in	The message is deliberately generic, so as not to reveal which email addresses exist. Check the password and, if it is correct, move on to the previous row.
Copilot does not query Docuo	Ask naming the source —”search R2 Docuo for…”— or select it explicitly in the Researcher sources menu.
The MCP option does not appear when adding a tool in Copilot Studio	Your environment’s version of Copilot Studio, and your permissions to create connectors in Power Platform.
The Copilot Studio form asks for a client ID and a secret	You have chosen Manual instead of Dynamic discovery. Go back and change the type.
The tool is created but has no connection	That you completed the creation of the connection, which is a separate step, and that the R2 Docuo sign-in screen finished properly.
The agent does not call the tool	That it is enabled on the agent, and that the agent’s instructions tell it to query R2 Docuo for this kind of question.
It used to work and has stopped	That access has not been withdrawn, that artificial intelligence has not been switched off in the repository, and that your plan’s usage limit has not run out.

If the problem persists, open a support ticket stating the repository, the user the connection was created with, and the approximate time of the attempt.