Connecting PowerDMARC to Microsoft Copilot Studio

PowerDMARC Support

Modified on: Fri, 26 Jun, 2026 at 7:16 PM

Overview

This guide walks you through connecting your PowerDMARC account to Microsoft Copilot Studio using the Model Context Protocol (MCP). Once connected, a Copilot Studio agent can query live PowerDMARC data including domains, DMARC reports, and threat intelligence directly from within your Microsoft environment using natural language.

NOTE	This integration requires a Power Platform environment with Dataverse enabled. A Microsoft Copilot Studio license is required to publish the agent to end users. The agent is fully functional for internal testing without a publishing license.

1. Generate a PowerDMARC MCP Token

The MCP token controls which PowerDMARC data the Copilot Studio agent can access. You configure permissions per token.

Log in to your PowerDMARC account and navigate to Settings > API Settings.
Click Create Token and give it a descriptive name (e.g. Copilot Studio MCP).
Under Permissions, select the data scopes the agent should access:

For a read-only agent: enable DMARC Aggregate Report, DMARC Forensic Report, Domain Management, and Threat Intelligence
For full access: enable all available permissions

Enable the MCP toggle.
Enable the Primary API Token toggle. Only one token can hold the Primary designation at a time.
Click Save.
Navigate to MCP in the left-hand sidebar.
Select your token from the MCP Token dropdown.
Copy the full MCP Server URL (mcp-dmarc.com) — this includes your authentication token and is used in Section 3.

NOTE	The MCP Server URL contains your API token and grants access to PowerDMARC data. Treat it like a password — do not share it publicly or commit it to source control.

2. Set Up the Microsoft Power Platform Environment

Copilot Studio agents require a Power Platform environment with Dataverse enabled. If you already have a suitable environment, skip to Section 3.

2.1 Create a Power Platform Environment

Go to admin.powerplatform.microsoft.com and sign in.
Navigate to Environments > New.
Enter a name (e.g. PowerDMARC-MCP), set the type to Production, and enable Dataverse.
Select your region and click Save. Environment provisioning takes a few minutes.

NOTE	Dataverse is required for Copilot Studio agents. If Dataverse is not enabled on the environment, the agent cannot be created or saved.

2.2 Link a Billing Plan

In Power Platform Admin Center, navigate to Billing > Licensing > Manage billing plans.
Click New billing plan and link it to your Azure subscription and resource group.
Associate the billing plan with the environment created above and click Save.

NOTE	If the resource group dropdown appears empty, create the resource group first in the Azure portal under Resource Groups > Create, then return to this step.

3. Create the Copilot Studio Agent

Navigate to Copilot Studio using your environment-specific URL:

https://copilotstudio.microsoft.com/environments/{your-environment-id}/home

NOTE	Always use the environment-specific URL — not the default Copilot Studio homepage. The default URL redirects to your personal environment which does not have Dataverse. Find your environment ID in the Power Platform Admin Center under Environments.

Click Create > New agent and give it a name (e.g. PowerDMARC MCP Agent).
Once created, navigate to Tools in the left-hand sidebar.
Click Add a tool > Model Context Protocol (MCP).

4. Configure the MCP Connection

In the MCP tool wizard, paste the MCP Server URL copied in Section 1 Step 9.
Under Authentication type, select API key.
Set the Header name to Authorization.
Set the Header value to Bearer {your-token}, replacing {your-token} with the JWT portion of your MCP Server URL.
Click Connect. Copilot Studio contacts the MCP server and loads the available tools.
Review the list of tools returned — these reflect the permissions on your API token. Enable or disable tools as needed.
Click Save.

NOTE	If the connection fails with an authentication error, confirm that the MCP toggle and Primary API Token toggle are both enabled on your token in PowerDMARC. If the connection times out, verify that mcp-dmarc.com is reachable from your network.

5. Test the Connection

In your Copilot Studio agent, open the Test panel on the right side of the screen.
Enter a test query such as:

List my domains
Show me DMARC data for the last 7 days
How many emails failed DMARC this week?

The agent calls the relevant MCP tools and returns live data from your PowerDMARC account.

NOTE	The list_domains tool is the most reliable first test. A successful response confirms the MCP connection, authentication, and permissions are all working correctly.

6. Publishing the Agent

WARNING

Publishing a Copilot Studio agent to end users requires a full Microsoft Copilot Studio license. Without this license, the agent is functional for internal testing only and cannot be deployed to a channel such as Teams or web.

To publish once you have the required license:

In the agent, click Publish in the top navigation bar.
Select your target channel (e.g. Microsoft Teams, Web).
Follow the channel-specific deployment steps provided by Copilot Studio.

7. Access Control

Setting	Details
Who can set up the integration	Any PowerDMARC user with API Settings access
Token permissions	Configured per API token — use read-only scopes for shared agent deployments
Primary API Token limit	Only one token can be designated Primary at a time per account
MCP Server URL sensitivity	Contains embedded auth token — treat as a secret credential
Agent publishing	Requires Microsoft Copilot Studio license on the Microsoft tenant
MSSP accounts	Each MSSP can configure their own token and Copilot Studio agent independently

For further assistance, visit support.powerdmarc.com