# PALO with Microsoft Copilot Studio and Azure: pilot development record

Updated 27 October 2026. Independent private technical preview, using a synthetic catalogue. Operational evidence cut-off: 27 October 2026, 03:52:38 UTC. This record supersedes the earlier local-only status on this page. It documents completed work and open qualification gates; it is not the finished production configuration guide.

[Open the illustrated pilot overview](../PALO_CopilotPilot.html) · [Public evidence summary](../media/copilot-pilot/evidence-summary.json) · [Two-minute overview](../media/copilot-pilot/paloconnector.mp4)

## Executive brief: the five Ws

| Question | Answer |
| --- | --- |
| What? | A private custom MCP connector linking a Copilot Studio test agent to a PALO governance runtime and a persistent synthetic catalogue on Azure. |
| Why? | Make the authority for a specific action explicit, constrain the request, route selected actions to review, and preserve evidence of what actually happened. |
| Who? | Built by Fabrizio Degni for discussion with enterprise platform, security and governance teams. Two pilot identities are operated by the same person; this is technical role separation, not independent human review. |
| Where? | Microsoft Copilot Studio and Power Platform, Microsoft Entra identity, an HTTPS PALO runtime, and a synthetic target hosted on Azure. |
| When? | Development and qualification work on 24–27 October 2026. The connector remains a private preview, without a public Marketplace listing or Microsoft certification. |

## Current results

| Case | Observed result | What it establishes |
| --- | --- | --- |
| Copilot catalogue read | The actual test agent invoked the tool and returned price 100, version 1 | The intended agent-to-connector path worked for this read at that time |
| Price proposal 151, expected version 1 | Denied; executed false; independent server check confirmed zero target writes | The configured upper-price boundary rejected this request |
| Price proposal 120, expected version 1 | Review required; later expired without execution | Review routing and expiry were observed; approval and mutation were not completed |
| Expired-request recovery | A defect was corrected; reviewer withdrawal was confirmed in UI and independently in persistent records | The old request could be closed through the governed recovery path without changing the target |
| Regression suite | 89 tests passed locally and the same 89 passed on Azure Linux | One test suite, two environments; not 178 independent scenarios |
| Catalogue after these cases | Price 100, version 1; zero recorded target writes; zero executions | No successful mutative end-to-end run is claimed |

A connector marked connected is configuration state, not proof that the consuming agent can use it. The real tool call and independently checked target state are the qualification evidence. These observations do not imply continuously valid sessions or mandates.

## Work completed, 24–27 October

### 24 October: clarify the workspace

The selected local interface prototype organizes work into My work, AI systems, Activity, Connections and Library. System dossiers separate overview, controls, activity and evidence. Summary and technical presentation modes change the amount of detail, not permissions.

Demo, preparation and operational activation are explicit states. A configured connection is not shown as proof of usable authorization. The local evidence view reads archived reports; it cannot approve or execute catalogue actions. This prototype is distinct from the previously published illustrative Governance Hub and is not silently promoted by this documentation update.

### 25 October: prepare an evidence-led pilot

A synthetic catalogue, local acceptance harness, evidence collection, recovery scenarios and a native-control comparison candidate were prepared. Local simulations established development behaviour, not Microsoft cloud qualification. The evaluation design separates model intent, policy decision, approval, execution and independently observed outcome.

### 26 October: qualify the real Microsoft path

The work configured separate Entra applications for the API, connector and reviewer, delegated API permissions, token-v2 admission, a reviewer sign-in flow, an HTTPS-hosted runtime, and the Power Platform custom MCP connector. The connector uses federation without a client secret.

A real reviewer login and catalogue read were qualified. The connector then completed an authenticated read, followed by an actual read orchestrated by the Copilot Studio test agent. The agent remained private and was not published. A denied 151 proposal and a review-required 120 proposal followed under the approved synthetic-case boundary.

### 27 October: repair recovery and preserve evidence

The 120 request expired without execution. The withdrawal predicate did not admit the runtime expired-approval state. The correction admits that state only when the action claim has also expired, preserving the other authorization, request, version and unresolved-effect checks. The same 89-test suite passed locally and on Azure Linux before the corrected flow was verified.

The reviewer then withdrew the expired request. Independent records confirmed one withdrawal, zero executions and zero target writes. A successor request was prepared but had not been submitted at the evidence cut-off. No automatic mandate renewal or automatic resubmission was performed.

Two rounds of Gemini and GLM editorial challenge also refined the public account, particularly role separation, the defect/fix/withdrawal sequence and the distinction between preview goals and proven results. Those model responses are analysis of supplied facts, not independent runtime tests or security certification.

## Integration architecture

1. The Copilot Studio test agent invokes an explicitly enabled catalogue tool through the custom MCP connector.
2. The connector makes an HTTPS request to the PALO MCP route using delegated Microsoft Entra authentication.
3. The runtime checks the request boundary, token admission, approved caller and delegated scope, and the time-bound PALO mandate.
4. The requested operation is bound to a specific catalogue item, proposed price and expected resource version.
5. Policy can deny the proposal or require a reviewer decision. Review and execution are distinct operations.
6. The intended execution path must revalidate authority, perform the exact permitted action, and compare the resulting target state with the declared effect. This final live mutative cycle remains to be qualified.

The reviewer uses a separate authenticated interface. Approval allows the agent to resume the precise request; it does not itself write the catalogue. The connector's federated client identity is not cryptographic proof of which originating Copilot agent made a call. The observed Copilot tool trace establishes orchestration in the recorded test.

## Configuration implemented in this pilot

| Layer | Configuration boundary |
| --- | --- |
| API registration | Dedicated PALO API, token v2, delegated Catalog.Update and Catalog.Review scopes with administrator consent |
| Connector registration | Delegated Catalog.Update, exact generated Web callback and exact federated credential; no client secret |
| Reviewer registration | Delegated Catalog.Review and a separately admitted reviewer identity |
| Microsoft identity admission | Expected issuer, audience, tenant, client, principal, token version, signature, validity, scope and authentication freshness |
| Network | HTTPS on TCP 443; internal service ports and SSH were not opened by the pilot exposure change |
| MCP definition | POST /mcp, OpenAPI operation extension x-ms-agentic-protocol=mcp-streamable-1.0 |
| Media negotiation | Connector request Accept policy includes application/json and text/event-stream for the MCP operation |
| Origin boundary | One exact Power Automate maker origin admitted on POST /mcp; no generic CORS or wildcard origin |
| Agent tools | Explicit per-tool enablement, with Allow all off; agent not published |
| Mandates | Separate caller/reviewer authority, bounded to the synthetic target and an expiry; no automatic renewal |

These are a configuration record, not reusable tenant identifiers or a ready-to-import deployment recipe. The publication omits tenant/client IDs, personal accounts, private service URLs, credentials, raw tokens, account balances and raw operator logs. No Graph permission was added for this catalogue connector. This pilot is separate from the PALO Knowledge Reader and the ChatGPT plugin candidate.

The pilot parameters distinguish action-claim expiry, approval-record lifetime and authentication freshness. The recorded action claim lasts five minutes, while the runtime approval default is fifteen minutes and authentication freshness is capped at one hour. A still-existing approval record does not extend an expired claim. An expired request requires an explicit governed recovery path and a fresh decision for any successor; refreshing a page cannot renew authority.

## Operational lessons from the integration

| Observation | Engineering lesson |
| --- | --- |
| Token admission rejected an otherwise completed Microsoft sign-in | Browser authentication and API admission must be diagnosed separately. Preserve checks and log bounded categories rather than raw credentials. |
| The maker connection and test-user connection differed | Confirm the connection actually used by the consuming host; a saved maker configuration alone is insufficient. |
| An earlier connection retained stale authentication context | A new usable connection must be qualified; successful browser MFA alone does not prove the connector's credential is fresh. |
| The MCP handler returned 406 | Correct protocol media negotiation at the connector; this does not justify weakening authorization. |
| Copilot Studio initially showed a blank page | Network/browser availability is distinct from connector permission. A later network change restored loading, without establishing a universal root cause. |
| The proposal expired before a successful mutative cycle was recorded | Preserve the terminal state and target evidence. Do not infer the timing or cause of a person's click from the database outcome. |
| Withdrawal was unavailable for an expired approval state | Reproduce the defect, preserve security predicates, add regressions, verify deployment and then verify the real recovery outcome. |

## Benefits and measurement plan

The intended enterprise value is bounded delegation, request-specific review, traceable decisions and clearer recovery when execution cannot proceed. Incremental benefit over competent native identity, workflow and logging controls is not yet measured.

| Measure | Current evidence or future measurement |
| --- | --- |
| Successful mutative end-to-end cases | 0 in this cloud run; completion requires approval, execution, independently verified effect and replay |
| Unintended target changes | 0 recorded writes in the observed synthetic cases; not a general production failure rate |
| Recovery outcome | 1 confirmed withdrawal after the correction; no automatic resubmission |
| Regression results | 89/89 locally and 89/89 on Azure Linux, same suite |
| Review time | To measure from eligible proposal to a recorded decision, retaining expiry and abandonment separately |
| Verification coverage | To measure independently verified effects divided by eligible completed executions; currently no completed cloud mutation denominator |
| Duplicate-effect prevention | Pending real replay test; distinguish a retry response from independently confirmed absence of a second target effect |
| Operational burden | To measure connection refreshes, reviewer effort, blocked legitimate requests and recovery time |
| Incremental benefit and cost | Use matched cases against native IAM/workflow/logging controls, including setup, maintenance and reviewer effort; no ROI estimate is published |

## Next qualification gate

A future governed-case window must first confirm fresh caller and reviewer access and valid mandates. Then:

1. Establish the current catalogue version independently.
2. Create a single successor linked to the withdrawn request, using the approved price/version only if still applicable.
3. Obtain a new, explicit reviewer decision for that exact request within its validity window.
4. Execute the same request, without substituting a new identifier after approval.
5. Verify the target price/version and the single effect independently.
6. Replay the same request and prove that no second target effect occurred.
7. Preserve failures, denials, expiry and inconclusive outcomes alongside successes.

This publication grants no new operational permissions, does not renew a mandate and does not enable a billing plan. The full operational configuration guide and measured benefit claims remain gated on the required evidence.

## Preview availability and supporting material

The illustrated page, video, transcript, public evidence summary and this development record are available for review. The custom connector itself is a private pilot. There is no self-service production endpoint or Marketplace package announced here. Contact [PALO](mailto:info@paloframework.org) to discuss the design or a future controlled evaluation.

The two-minute English film uses Fabrizio Degni's own recorded voice in the author-supplied dubbed edition, authentic pilot captures and original diagrams. Screenshots retain their source interface language. It is an account of observed progress, not a demonstration of the uncompleted execution/replay path.

The dated public evidence summary lists source-artifact digests. Raw operator records remain private; a digest is an integrity reference, not independent certification. No social-media publication or outreach is implied by this site update.

## Primary platform references

- [Microsoft: remote MCP server and Copilot Studio custom connector](https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/how-to/deploy-remote-mcp-server-copilot-studio)
- [Microsoft: access-token claims reference](https://learn.microsoft.com/en-us/entra/identity-platform/access-token-claims-reference)
- [Microsoft: Copilot Studio support and feedback](https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-support)

The Microsoft documentation describes platform mechanisms. The observations in this record come from the PALO pilot's separately retained execution evidence. PALO is an independent project; no Microsoft endorsement is implied.

## Published video and technical discussion

The author-supplied dubbed edition is published with Fabrizio Degni's own recorded voice. The original file is preserved byte-for-byte on the website; it is approximately two minutes long (120.12 seconds), in HD 720p.

- [YouTube (English)](https://www.youtube.com/watch?v=cfkms-cWp-I)
- [Facebook (Italian post)](https://www.facebook.com/reel/2223829614861589)
- [Microsoft Copilot Studio community (English)](https://techcommunity.microsoft.com/discussions/copilot-studio/mcp-action-approvals-after-expiry-review-and-replay-tests-from-a-copilot-studio-/4567917)

The community post asks for engineering feedback. Publication does not constitute platform endorsement, certification or completion of the open execution/replay qualification. LinkedIn and X distribution is managed separately by the author.