How do I connect Copilot Studio to the NIS2 walkthrough over MCP?

How do I add the MCP server in Copilot Studio?

Copilot Studio is Microsoft's tool for an IT team to build its own agents, meaning assistants for particular tasks. Through MCP (Model Context Protocol), the protocol for such connections, the NIS 2 walkthrough becomes one of their tools.

Beforehand, an admin has turned on "Allow AI assistants for this company" in the nisd2.eu Settings. We have not tested Copilot Studio yet; the steps follow Microsoft's guide as of 15.10.2026.

In the agent, open the Tools page, then "Add a tool", "New tool" and "Model Context Protocol". The MCP onboarding wizard opens. According to Microsoft, Copilot Studio supports Streamable HTTP, and has not supported the older SSE since August 2025; the walkthrough answers over Streamable HTTP.

Fill in Server name, Server description and Server URL, with the address below. The agent reads the description to decide when to call the server, for example: Reads and fills in the company's NIS 2 walkthrough.

https://nisd2.eu/api/mcp

Which authentication do I choose?

OAuth is the usual way for software to sign in on your behalf without knowing your password. Choose OAuth 2.0 as the authentication type and "Dynamic discovery" as its type.

Copilot Studio then finds the sign-in addresses itself and registers with the sign-in service that every instance runs itself.

Select "Create", then "Next". On "Add tool", create a connection with "Create a new connection" and add the server with "Add to agent". Connecting opens the nisd2.eu sign-in page: sign in, check the return address, "Allow".

According to Microsoft, with OAuth 2.0 the individual users of the agent sign in themselves and grant it permission. In the walkthrough the agent then works with the rights of the person who signed in.

Does an API key work too?

Copilot Studio also offers an API key, in a header or as a query in the address. The walkthrough expects the key in the Authorization header, as "Bearer", a space, then the key.

It does not accept the key in the address. We have not checked whether Copilot Studio sends the header in that form, so use OAuth 2.0.

Does the instance have to be reachable from the internet?

Copilot Studio is a service in Microsoft's cloud. So we assume that Microsoft opens the connection and that the instance has to be reachable from the internet over https. Microsoft's guide does not say so explicitly.

nisd2.eu is reachable that way. A self-hosted instance only inside the company network would then not be reachable along this route; we have not checked whether Microsoft offers a way in. Inside the company network, software that runs on the computer works, such as Claude Code.

In Copilot Studio, access to MCP servers runs through the Power Platform: according to Microsoft, a data policy for connectors also governs the MCP server and its tools. Ask whoever manages the Power Platform at your company whether a policy allows the server.

What may the agent do in the walkthrough?

The agent reads the items and fills in fields, lists and screens, with the signed-in person's rights.

It cannot finish an item, decide it is not applicable, delete a supplier, an asset or a training, or sign. The server offers those functions to no assistant.

What the agent reads goes to Microsoft, under your company's agreement with Microsoft. We did not check Microsoft's terms on this for this article.