Skip to main content
You can bring MerchantOps catalog data into Microsoft Teams by adding the MerchantOps MCP server as a tool in a Copilot Studio agent, then publishing that agent to Teams.
Everyone the published agent reaches shares one credential. The key you create authenticates the agent, not each person talking to it. Anyone who can reach the published Teams agent can read whatever that key can read. See What the agent can see below before publishing it broadly.

​
Prerequisites

  • Access to Copilot Studio for your Microsoft 365 tenant, with permission to add tools and publish agents to Teams.
  • A MerchantOps account with the Owner role — only Owners can create server API keys. See Team & roles.

​
Set it up

1

Create the server API key

Sign in as an Owner and go to Settings › API Keys › Create API Key. Name it for the agent it will serve (for example Teams catalog agent), and assign it the channel_agent_reader role only. Copy the key — it’s shown once. See Server API keys for the full key-creation flow.
If you don’t see channel_agent_reader in the role list, ask your MerchantOps admin to add it rather than assigning a broader role instead.
2

Add the MCP tool in Copilot Studio

In your Copilot Studio agent, add an MCP tool using Streamable HTTP transport, pointed at:
Configure its authentication as an API key, sent as:
using the key you copied.
3

Choose maker-provided credentials

Set the tool’s credential mode to maker-provided credentials so the key you entered is used for every user of the agent, rather than asking each person to supply their own.
A tenant admin can block maker-provided credentials tenant-wide. If the option isn’t available, ask your Microsoft 365 admin before assuming the setup is broken.
4

Publish to Teams

Publish the agent to the Teams channel(s) where you want catalog access. Scope publishing to the audience that should see this data — publishing more broadly extends what that shared credential’s data reaches.

​
What the agent can see

The channel_agent_reader role is read-only, scoped to your organization, covering products, product types, property definitions, pricing, MAP pricing, catalog batches, jobs, lakehouse data, and documents. Anything the key can read, the published agent can surface to anyone who reaches it in Teams — there’s no per-person filtering within that audience. If someone asks the agent to change a price, update a product, or run any other write, the request is declined: this role carries no write permissions on the MerchantOps side.
Because the key represents the agent rather than a person, whoami and usage history show the organization and key identity — not which Teams user asked the question.

​
Revoking access

Revoke the key from Settings › API Keys at any time. The API refuses the key immediately, but a published agent that’s still connected can keep working against the MCP server for up to about a minute afterward, since auth lookups are cached briefly. Remove or reconfigure the tool in Copilot Studio as well to fully stop the agent from calling it.

Server API keys

Create, scope, rotate, and revoke keys — including channel_agent_reader.

MerchantOps in Slack

The same read-only pattern through Claude Tag.