Personal blog. This site reflects my own testing and my own opinions. It is not an official Microsoft statement and it is not official Microsoft documentation in any way. For authoritative guidance always refer to Microsoft Learn.
Field notes from building Microsoft 365 Copilot agents and running them in enterprise Azure environments. Everything here was measured in a lab tenant rather than taken from documentation. Where a claim is reasoning rather than measurement, it says so.
Articles
Connecting Microsoft 365 Copilot, Cowork and Copilot Studio to your line-of-business data
18 September 2026
One MCP server, one gateway, three agent surfaces — and the signed-in user’s own permissions applying all the way down to the data. Measured in a live tenant, not taken from documentation.
Does OAuth survive a reverse proxy?
27 August 2026
We put a Microsoft 365 Copilot custom engine agent behind a reverse proxy and measured what survives. The tokens were never the fragile part — the HTTP plumbing was.
By Ondrej Stefka · LinkedIn · About this blog →