Extend Copilot for Microsoft 365 with copilot extensions

Copilot for Microsoft 365 provides default experiences for engaging with content and resources from across an organization. While the default functionality provides many useful capabilities, sometimes end users need to interact with a more focused conversational assistant, accessible directly within Copilot for Microsoft 365.

In Microsoft Copilot Studio, these more focused assistants are called copilot extensions. These copilots are authored by giving natural language instructions that generate prompts to the large language model (LLM) within Copilot for Microsoft 365. Copilot extensions can include references to enterprise data, actions, and suggested prompts.

This article covers:

• The process of authoring a copilot extension
• Adding actions and knowledge to the copilot extension
• Publishing the copilot extension to Copilot for Microsoft 365 and Microsoft Teams

What are copilot extensions, actions, copilot knowledge, and starter prompts?

The following table gives more detailed information about the distinctions between copilot extensions, actions, copilot knowledge, and starter prompts.

Keeping extensions secure

Microsoft 365 customers and partners can build extensions that extend Microsoft 365 Copilot with custom instructions, grounding knowledge, and actions invoked via REST API descriptions configured by the extension. Custom actions grab data that influences the behavior of your Copilot for Microsoft 365, including from untrusted sources like emails and support tickets. Attackers can create payloads in these untrusted sources to manipulate the extension's behavior, such as incorrectly answering questions or invoking custom actions.

To protect your extension from attacks:

• Only enable extensions that use trusted knowledge sources and connect to trusted REST APIs via custom actions.
• Reduce the impact of attacks where untrusted data sources are necessary. Don't give the extension the ability to perform sensitive operations without human intervention.
• Use the extensive controls in Microsoft 365 that govern who can acquire and use integrated apps and the specific apps enabled for groups or individuals within a Microsoft 365 tenant, including apps with extensions.
• Use the controls in Copilot Studio that to configure secure connectors used for knowledge and custom actions.

Prerequisites

• End users and makers must have a license to use Copilot for Microsoft 365.
• Copilot extensions are only available in the English language for this preview.
• Makers must have permissions to create in and have access to a Copilot Studio environment.
• Publishing extensions must not be blocked by Power Platform and Microsoft 365 admins.

Limitations

In this preview, there are some limitations:

• Copilot extensions don't currently support using existing actions in the library. Instead, the maker must author a new action for their copilot extension.
• The ability to mark an action as requiring a consent pop-up for the user isn't available in this preview.

Create a copilot extension

When you create a copilot extension, you're a maker teaching the underlying large language model (LLM) in Copilot for Microsoft 365 how to behave. Unlike traditional authoring where a maker creates each topic with natural language triggers for even simple tasks, an LLM-backed copilot extension has a baseline set of default behaviors. As a maker, you can then add knowledge and actions to make the copilot extension more capable.

To create a copilot extension for Copilot for Microsoft 365:

1. Sign-in to a Copilot Studio account at https://copilotstudio.microsoft.com

2. Navigate to Copilots in the left side navigation panel.

3. Select Microsoft 365 Copilot in the list of copilots.

4. From here, select + Add on the Extensions card. You're sent to the conversational authoring experience.

5. In full sentences, describe what the copilot extension should be able to do and know.

6. When the interaction is completed, select I'm done in the chat.

   Note

   Skip over the conversational interface at any time, by choosing Skip to configure.

7. Try experimenting with the copilot extension in the test chat or select Create to get to the overview page for the extension.

The copilot extension is now created. You can interact with the copilot in the test canvas, or add more richness to it. So far, the copilot has no added knowledge sources. The only information the copilot extension has is the data provided to it in the instructions. The copilot extension doesn't have access to enterprise knowledge or any other actions at this time, so any responses are provided from the LLM's own knowledge.

Add knowledge to a copilot extension

When you first create a copilot extension, it starts out with only the base LLM knowledge. The copilot extension is unaware of any other data sources. To give it more knowledge, select + Add knowledge overview page of the copilot extension or the Knowledge view selected from the top of the page.

There are three primary types of knowledge that can be added to a copilot extension:

To start adding knowledge to the copilot extension:

1. Return to the copilot extension overview page.
2. From the Knowledge card, select + Add Knowledge.
3. Choose a data source.
   • If you're using SharePoint/OneDrive, provide a path to root of the library or site. A single page or file being specified isn't supported at this time.
   • If you're using a copilot connector and the admin configured a graph connector in Microsoft 365, you can choose a graph connector from the configured data sources.
   • Web search can be enabled/disabled from the copilot overview page in the Additional Settings card.

Multiple knowledge sources can be added with a mix of types to a copilot extension. In addition, for SharePoint/OneDrive, up to four paths can be included.

With the knowledge sources configured, the copilot extension with knowledge is immediately available in the test chat. Close the knowledge panel, choose the refresh gesture at the top of the test chat to get a new chat, and then try asking questions that should be present in the data source.

Add an action to a copilot extension

An action is used to enable a copilot extension to retrieve information or to perform a task such as updating a record or completing a transaction. Actions can be created from copilot connectors (also known as Power Platform connectors). Action types include AI Builder prompts, connectors, flows, and custom connectors. To learn more about copilot connectors, see: Learn Content on copilot connectors.

Adding an action requires extra planning on the part of the maker vs adding knowledge. Several considerations come into play:

• Should the action use the end-user's authentication or the maker's authentication?
• Can the maker provide descriptions to inform the LLM when and how to invoke the action?
• Should the parameters to the function always be automatically filled, or should they be filled by the maker at authoring time?

Each of these considerations comes in to play when adding actions to an extension.

To add an action:

1. Return to the copilot extension's overview page.
2. From the Actions card, choose + Add Action.
3. Search for the desired copilot connector or choose Create a new flow or Add an API for a custom connector.
4. Assuming a copilot connector is chosen, a UX is presented with Connector and Configure sections.

Connector section

1. End User Authentication: Choose the type of authentication preferred for this action. You have a choice between user authentication and copilot author authentication. Other authentication configuration details are automatically handled by the copilot connector implementation.
2. Usage Description: Instructions that tell the Copilot for Microsoft 365 LLM how to use the action in the copilot extension.

Configure section

1. Plugin Action Name: The name for the action as seen in Copilot for Microsoft 365 in citations. This information also can be influential in helping Copilot for Microsoft 365 choose the action to execute.
2. Display Name: Friendly name for the action as seen in the Copilot for Microsoft 365 user experience.
3. Description for the copilot to know when to use this action: A full conversational description of when the LLM in Copilot for Microsoft 365 should use this action, and the sort of questions that trigger it.

Inputs and outputs

Copilot Studio automatically populates a set of inputs and outputs by inspecting the copilot connector object. The maker can let the Copilot for Microsoft 365 LLM fill in those fields or fill them in manually during authoring.

By default, no customization is needed on this experience unless the maker chooses to manually fill a field, or chooses to override a description.

Finishing and testing

The last tab allows you to review your choices, make any adjustments and then save your changes.

Once saved, the actions are ready to test in the Copilot Studio test chat. Select Refresh at the top of the test chat, and then ask a question that should invoke the action.

In the chat, the first time the user triggers the action, the copilot extension presents a connection card. This card is used to enable the end user to sign in to the action with their own credentials.

Selecting Connect takes the user to an experience where they can choose the connection for the action they're using and sign in or otherwise connect to it. Once the connection is established, it's durable for the session. After that, the user can close the browser and retry the action.

Starter prompts

Often when users first interact with any sort of copilot, they don't know what they can ask, or don't understand the richness of the copilot. As a result they tend to ask simple questions. Copilot for Microsoft 365 addresses this issue by providing a starter prompts experience. Starter prompts present the user with easy prompts to get started.

Copilot Studio automatically creates starter prompts when you use the conversational experience to create your copilot extension. You can also edit or create your own at any time with the Starter prompts experience on the Overview page.

Understanding starter prompts

One way to use the starter prompts is as a shortcut for simple questions you expect users to ask. However, they're also an opportunity to present more sophisticated prompts that the user might not otherwise understand are possible.

Within starter prompts, copilot authors have full access to the capabilities of the Microsoft 365 Copilot large language model, including the actions and knowledge you added. Consider creating sophisticated prompts that help end-users achieve common tasks easily.

Author starter prompts

1. Navigate back to the extension's Overview page.
2. Scroll down to Starter Prompts and select Edit.
3. Add six starter prompts and hit save.

Publishing a copilot extension

Once the copilot extension is working how you want in the Copilot Studio test experience, you're ready to publish. Publishing converts the extension from a draft state to a published state, ready to upload to the organization's catalog. Unlike a standalone copilot, a copilot extension isn't automatically deployed to Copilot for Microsoft 365 and Teams when published.

Publish your extension

1. Navigate back to the extension's Overview page.

2. Choose Publish on the top right.

   The information on the subsequent form is used to populate the catalog entry in the organization's Office and Teams Catalogs and the Microsoft Admin Center Integrated Apps list. It isn't used by the Copilot for Microsoft 365 LLM.

3. Fill in the fields as needed and select Publish.

   When the operation is complete, you're taken to the Availability options page.

Availability Options

The Availability options page is used to distribute the copilot extension to the copilot extensions author's account to use or to small groups of peers governed by distribution lists, or to be published to the organization's catalog by an admin.

More information about managing apps in the Teams catalog can be found here: Manage Power Platform Apps

Using the copilot extension in Microsoft 365 Copilot or Microsoft Teams

The copilot extension should now be available to try out in Copilot for Microsoft 365 or Teams. The user can interact with the extension by either @mentioning the extension in the Copilot for Microsoft 365 chat interface or by selecting the extension from the sidebar. Once selected, the user interacts only with the copilot extension until they end that conversation and return to Microsoft Copilot.

In the screenshot, the user requests information that's in the knowledge included in the copilot extension. The LLM, evaluating the extension's instructions, knowledge, and actions, determines that the best way to resolve the request is by using its knowledge to generate an answer. The LLM also includes references for the sources it uses to generate the answer.

Tips for extension authors

• Copilot for Microsoft 365 caches answers from previously asked questions in a given session, even if it called an action to retrieve data. To break this cache, use the New Chat button.
• To see more information about why the LLM does or doesn't select an action, input -developer on into the Copilot for Microsoft 365 input box and ask the question.
• The results you see at runtime in Copilot for Microsoft 365 might be different from what you see in Copilot Studio's test canvas and Microsoft Teams.
• Unlike a custom copilot, copilot extensions don't collect data in the Copilot Studio Analytics tab. This feature is being evaluated for future releases.
• When using Microsoft 365 Copilot to test your extension, use the thumbs down feedback experience to provide feedback to the Microsoft Copilot team to review and address issues.