Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Use connected agents to let your primary agent delegate specific tasks to specialized agents. This article shows you how to add another published Copilot Studio agent as a connected agent and verify that delegation works as expected.
Note
The harness used to build this agent uses usage-based billing. Using, building, testing, and evaluating agents might consume Copilot Credits. Learn more in Overview of usage-based billing.
You add every connected agent from the same Add a connected agent dialog. This guidance applies regardless of whether the agent is built in Copilot Studio, hosted in Microsoft Foundry, or reached over the Agent2Agent (A2A) protocol. This article covers connecting a Copilot Studio agent. To connect a Microsoft Foundry agent instead, see Add a Foundry agent as a connected agent. To connect a remote agent over the A2A protocol, see Add an A2A agent as a connected agent. To connect an agent built with the Microsoft 365 Agents SDK, see Add a Microsoft 365 Agents SDK agent as a connected agent.
Prerequisites
- An agent created with the Microsoft Copilot harness to be the primary agent. See Create an agent (preview).
- At least one other agent powered by the Microsoft Copilot harness in the same environment. The other agent must be published and configured as available to connect.
- The maker for the primary agent must either be the owner of the connected agent or have the agent shared with them.
Sharing and connector access
For agents powered by the Microsoft Copilot harness, sharing the primary (parent) agent with a user allows that agent to invoke its connected Copilot Studio agents on the user's behalf. You don't need to share each connected agent separately with that user for delegation through the parent to work. The maker still needs the access described in Prerequisites to add a connected agent.
Sharing requirements differ by harness:
| Harness | Sharing requirements for connected-agent delegation |
|---|---|
| Microsoft Copilot harness | Share the parent agent with the intended users or groups. Each connected Copilot Studio agent doesn't need to be shared separately with those users for the parent to invoke it. |
| Standard harness (classic experience) | Depending on the authentication setup, you might need to share the connected agent separately with end users of the parent agent. Learn more in Connect to an existing Copilot Studio agent. |
Permission to invoke a connected agent isn't the same as permission to access the data used by its tools. Access to that data remains governed by the connected agent's connection access control lists (ACLs) and the permissions of the identity used by each connection. Sharing the parent agent doesn't override these controls.
Important
To restrict a connected agent's tool access to data that the calling user is permitted to access, configure its tools to use User authentication. If a tool uses Agent author authentication, it runs with the author-provided credentials and can return data through the parent that the user can't access with their own credentials. Don't rely on leaving a connected agent unshared to restrict that data. Review its authentication settings and connection permissions before sharing the parent. Learn more in Configure user authentication for tools.
Add a Copilot Studio agent
Sign in to Copilot Studio.
Choose and open the agent you want to use as the primary agent.
In the agent navigation bar, select the Build tab.
In the components panel, select Connected agents to open the Add a connected agent dialog.
From the Add a connected agent dialog, browse or search the available Copilot Studio agents and select the agent you want to connect.
Review the agent's capabilities, then add a clear description of when the connected agent should be used.
Select Connect.
Confirm the connected agent appears in the components panel.
How the orchestrator routes to connected agents
After adding a connected agent, the orchestration runtime automatically determines when to delegate to it. The routing decision is based on:
- The connected agent's name and description
- The user's message and conversation context
- Your primary agent's instructions
Tip
Write a clear, specific description for each connected agent so the orchestrator can accurately determine when to route requests to it. Avoid overlapping descriptions between connected agents.
Test delegation
After adding a connected agent:
In the agent navigation bar, select the Preview tab.
Send a message that matches the connected agent's domain.
Verify that the response comes from the connected agent and is appropriate.
Send a message outside the connected agent's domain to confirm your primary agent handles it.
Test sharing and data access
Also test delegation as an intended end user, rather than only as the maker:
Share the published parent agent with a test user without separately sharing the connected agent with that user.
As that user, send a request to the parent that requires the connected agent. Verify that the parent can invoke it.
For connected-agent tools configured to use User authentication, test requests for data the user is permitted to access and data they aren't permitted to access. Verify that the permitted data is returned and restricted data isn't returned.
If any connected-agent tools use Agent author authentication, verify that the data returned with those credentials is appropriate for everyone who can use the parent agent.