Microsoft 365 Copilot

Bring your PlaidCloud data into Microsoft 365 Copilot. Once the PlaidCloud agent is installed and a person is granted access, they can ask Copilot about their projects, tables, dimensions, and allocation models in plain language — no separate login, no PlaidCloud window, no SQL.

“List my PlaidCloud projects.” “What tables are in Enterprise Profitability, and show me the first rows of one.” “Why did the allocated IT cost for the Atlanta cost center go up last quarter?”

Note

This is different from GitHub Copilot, which connects a developer’s IDE to PlaidCloud. This page is about Microsoft 365 Copilot — the assistant in Teams, Outlook, and the Microsoft 365 app that your whole team already uses.

How It Works

PlaidCloud publishes a small agent that plugs into Microsoft 365 Copilot. When someone asks Copilot a question about their data, the agent securely connects to your PlaidCloud workspace, runs the request under that person’s own permissions, and Copilot explains the answer.

• Read-only for most people. The common access level is read-only — list and describe projects and tables, read table data, list dimension members, and explain allocation results. It never invents numbers; every answer comes from a real query against your data.
• Each person sees only their own data. Requests run as the signed-in user, bounded by the same PlaidCloud roles and access controls they already have. The agent can never reach credential, identity, or access-control settings.
• No access until granted. Installing the agent is not the same as granting access. A signed-in person gets a clear “no access has been granted” message until a PlaidCloud administrator gives them an access level. This is deliberate — see Access Levels.

Setup at a Glance

The full path, in order. Up to three roles are involved — often the same person wears more than one hat. Steps 1–5 install the agent; step 6 is what actually lets data flow.

#	Step	Who	Where
1	Download the agent package (.zip)	PlaidCloud workspace admin	PlaidCloud control plane → Workspaces
2	Allow custom apps	Microsoft 365 / Teams admin	Teams admin center → Setup policies
3	Upload the package	Microsoft 365 / Teams admin	Teams admin center → Manage apps → Actions
4	Add the agent in Copilot	Each user	Microsoft 365 Copilot → More agents
5	Sign in	Each user	Copilot (one time)
6	Grant an access level	PlaidCloud administrator	PlaidCloud

Caution

Until step 6, the agent connects but returns no data. A successful sign-in followed by a “no access has been granted” answer means everything is working — the person just needs an access level. It is not an error.

Step 1 — Download the Agent Package

Your organization’s agent package is a single .zip, ready to download yourself from the PlaidCloud control plane — nothing to request and no file to wait for.

1. Sign in to the PlaidCloud control plane and open Workspaces from the left navigation.

2. Open the workspace that holds your data (the Edit or View action).

3. At the bottom of the workspace dialog, click Download Copilot Package and save the .zip.

Note

The Download Copilot Package button appears only after PlaidCloud has set up the workspace’s Copilot connection. If you don’t see it, the connection isn’t ready yet — contact your PlaidCloud representative. (The button is on the Workspaces screen, not the admin-only Tenants screen.)

Step 2 — Allow Custom Apps

Microsoft 365 / Teams administrator. By default, Microsoft 365 blocks apps that aren’t from the public store, so the PlaidCloud agent can’t be installed until you turn this on.

1. In the Teams admin center, go to Teams apps → Setup policies → Global (Org-wide default).

2. Set Upload custom apps to On, then Save.

Caution

Being a global administrator is not the same as having this setting on — it’s a separate policy. Skip it and the upload fails with “Uploading custom apps is not allowed.” Policy changes can take up to about 24 hours to propagate (often much less). To limit it to a pilot group instead of org-wide, create a separate setup policy and assign it to those users.

Step 3 — Upload the Package

Microsoft 365 / Teams administrator. Add the .zip to your organization’s app catalog.

1. In the Teams admin center, go to Teams apps → Manage apps.

2. Click the Actions menu at the top-right of the page, then Upload new app.

   Note

   “Upload new app” is in the Actions menu in the top-right corner — not in the grey toolbar (Edit installs / Edit availability / …), which acts on an already-selected app.

3. Choose the .zip you downloaded. The app uploads and publishes (you’ll see Published version 1.0.0), supported across Teams, Outlook, and Copilot.

4. On the app’s page, set Availability — Everyone (org-wide default) for general rollout, or a specific group for a pilot.

Tip

Want to test it on yourself immediately, without org-wide rollout? Skip the admin center: open Microsoft 365 Copilot, and under Agents choose to upload a custom app, then select the .zip. It sideloads just for you and appears right away.

Step 4 — Add the Agent in Copilot

The agent now needs to be added to each person’s Copilot.

1. Open Microsoft 365 Copilot (m365.cloud.microsoft/chat or in Teams) and click More agents in the Agents list.

2. Find your organization’s agent (it’s named after your workspace) and click Add. It then appears in the Agents list, ready to open.

Note

A newly org-wide-published agent can take a while to appear under More agents — minutes, occasionally a few hours, as Microsoft propagates it. A sideloaded app (the tip in step 3) appears immediately. To pre-install the agent for everyone so they don’t have to add it themselves, pin it through a Teams setup policy.

Step 5 — Sign In

The first time a person opens the agent and asks a question, Copilot prompts them to sign in. This is a normal, one-time step.

1. Open the agent and ask a question, for example “List my PlaidCloud projects.”

2. When prompted, choose Sign in and complete the PlaidCloud sign-in.

After that the connection is remembered — people don’t sign in every time, or every day. A fresh sign-in is only needed occasionally (roughly monthly) or if access changes.

Note

The sign-in is interactive even though you’re already in Microsoft 365 — Copilot opens its own sign-in window that doesn’t carry your existing session. This is expected.

Step 6 — Grant an Access Level

This is the step that turns “no access has been granted” into real answers. After a person has signed in, a PlaidCloud administrator grants them an access level (see Access Levels below). Access is deny-by-default: with no level assigned, the agent connects but returns no data.

Once a level is granted, the person simply asks again — there’s no need to sign out or reinstall. Access is checked live on every request, so the next message returns data.

Note

Access levels are managed on the PlaidCloud side. Contact your PlaidCloud representative or support@plaidcloud.com to have people granted (or changed), or — if your PlaidCloud administrator manages identity directly — assign the level in PlaidCloud’s identity management.

Access Levels

Every PlaidCloud Copilot user holds one of three levels. The level is a ceiling on what the agent may do; within it, the person’s own PlaidCloud permissions still apply, so the agent can never show or change data they couldn’t already reach themselves.

Level	The agent can…	Typical use
Read-only	List and describe projects and tables, read table data, list dimension members, explain allocations. No changes.	Most people. The safe default.
Read/Write	Everything in read-only, plus structured writes the person is permitted to make (e.g. updating table data).	Analysts who maintain data.
Full	The person’s complete PlaidCloud tool set, including running raw SQL that writes.	Power users and builders.

A few rules apply at every level:

• Deny-by-default. No level assigned ⇒ no access. Nothing is exposed until someone is granted a level.
• Most permissive wins. If a person somehow holds more than one level, the highest applies.
• Sensitive actions are always off-limits to the agent. Credential, identity, and access-control tools — and raw write SQL below the Full level — are never callable through Copilot, regardless of the person’s own PlaidCloud permissions.

Using the Agent

Open Copilot, select your PlaidCloud agent, and ask in plain language. Good starting points:

• Find your work: “List my PlaidCloud projects.” / “What tables are in project X?”
• Read data: “Show me the first 20 rows of the customers table.” / “What values are in the Region dimension?”
• Explain results: “Why did the allocated cost for the Atlanta cost center change between Q1 and Q2?”

The agent picks the right tool, runs the query against your data, and Copilot answers — leading with the result, then a short table or summary. If a request needs data you don’t have access to, or a change above your level, it says so rather than guessing.

Troubleshooting

Symptom	Cause and fix
Can’t find Upload new app in Manage apps	It’s in the Actions menu at the top-right of the page, not the grey toolbar. If it’s missing entirely, Allow custom apps isn’t on yet.
”Uploading custom apps is not allowed” on install	The Upload custom apps policy is off. Turn it on (step 2), wait for it to propagate, and retry.
The agent isn’t in Copilot’s Agents list	Look under More agents and click Add. An org-wide-published agent can take time to appear; to test now, sideload the .zip to yourself.
”No Microsoft 365 Copilot access has been granted to this user”	Expected until an access level is granted. The person is signed in and connected — they just need a level. Ask again right after it’s granted.
A request to change data is refused	The person’s access level (or their own PlaidCloud permissions) doesn’t allow that write. Raise their access level if appropriate.
Asked to sign in again after it was working	Normal — the saved connection is refreshed periodically (roughly monthly). Sign in once more and continue.
Answers seem to need data the person can’t reach	Expected — the agent only ever returns data the signed-in user is already permitted to see.

Need Help?

You download the agent package yourself from the control plane — see Step 1. For access levels, or anything that isn’t behaving as described here, contact your PlaidCloud representative or support@plaidcloud.com.