> ## Documentation Index > Fetch the complete documentation index at: https://developers.techwolf.ai/llms.txt > Use this file to discover all available pages before exploring further. # How It Works # Overview The TechWolf Analyst Agent is reached through **Microsoft 365 Copilot**. This page explains how that integration connects a user in Copilot to the agent. For what the agent itself does, see [What is the TechWolf Analyst Agent?](../overview). Copilot is a **delivery surface**: it changes where a user reaches the agent, not what the agent is, what data it reasons over, or where that data is processed. The integration has three parts: * A **delivery surface**, Microsoft 365 Copilot, through which the user reaches the agent. * A thin **integration layer** at TechWolf that authenticates the user, routes them to their region, and relays the conversation. It holds no business logic and does not interpret or store agent content. * The **Microsoft transport** that carries Copilot messages to TechWolf (Microsoft Azure Bot Service), operating over TLS 1.2+ in both directions. # Architecture A Copilot turn travels through the following path: ```mermaid theme={null} %%{init: {'flowchart': {'subGraphTitleMargin': {'top': 8, 'bottom': 18}}}%% flowchart LR subgraph CUST["Customer Microsoft 365 tenant"] Copilot["M365 Copilot
where the user works"] end subgraph TWAZ["TechWolf Azure tenant"] Entra["Microsoft Entra ID
SSO app, identity only"] Bot["Azure Bot Service
transport"] FD["Azure Front Door
region routing"] Entra --> Bot --> FD end subgraph TWAWS["TechWolf AWS, EU or US region"] GW["TechWolf integration layer
thin relay"] Agent["TechWolf Analyst Agent
tools + Amazon Bedrock, in-region"] GW --> Agent end Copilot --> Entra FD -->|"TLS 1.2+"| GW ``` The only component in your Microsoft 365 tenant is **Copilot itself**, where the user works. The Microsoft transport that carries the turn (the Entra SSO app, Azure Bot Service, and Azure Front Door) runs in **TechWolf's own Azure tenant**, not yours. TechWolf operates backends in **two regions, EU and US**. Azure Front Door is the only cross-cloud hop: keyed on the tenant identifier, it routes each turn to the correct regional backend. Everything from the integration layer onward is TechWolf on AWS, in the single region your tenant is bound to. ## What each hop does, and what it holds | Hop | Function | What it holds | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Microsoft 365 Copilot** | The surface the user works in, in **your Microsoft 365 tenant**. Enters as an admin-approved application package; no per-user setup. | Copilot chat history, in your tenant under your Microsoft agreement. | | **Microsoft Entra ID** | Single sign-on, through TechWolf's multi-tenant app in **TechWolf's Azure tenant**. Verifies the user against their own Microsoft directory and establishes the identity carried on every turn. | Nothing new. Identity is verified against your existing directory. | | **Azure Bot Service** | Microsoft's managed transport, operated in **TechWolf's Azure tenant**. Delivers Copilot messages to TechWolf and streams the response back, TLS 1.2+ in both directions. | Bot configuration and routing metadata, plus transient message caching under 24 hours. Transcript logging and conversation-state persistence are optional features TechWolf does not enable. | | **Azure Front Door** | TechWolf-operated Azure edge in **TechWolf's Azure tenant**. Inspects the Entra tenant identifier on each inbound message and routes it to the correct regional TechWolf backend (EU or US). | Nothing. Routing only. | | **TechWolf integration layer** (AWS) | Authenticates the user, resolves TechWolf identity and access scopes, selects the regional runtime, and relays the turn. | The user's email address, used to resolve their TechWolf identity. No business logic and no agent content; logs only. | | **TechWolf Analyst Agent** | The agent itself. Reasons over the organization's TechWolf data within its hard-coded tool whitelist, pinned to the tenant's region, and generates the answer. | Conversation history, in-region. | No agent content or business logic is stored outside the region your tenant is bound to. # Identity and access **Two independent checks gate every turn.** The integration does not broaden what any user can see. * **Microsoft authentication.** Every turn carries a verified Entra identity. The inbound message is cryptographically validated before any processing; no anonymous or unauthenticated request reaches the agent. * **TechWolf authorization.** The verified user is resolved through TechWolf's central identity and access service to a canonical TechWolf user and their access scopes, the same roles and entity-level grants that already govern that user's TechWolf access today. The customer tenant is resolved from the Entra tenant identifier. * **The existing data filter still applies.** The agent's per-user, entity-scope data filtering runs downstream on every turn, regardless of how the user reaches the agent. Reaching the agent through Copilot grants no additional access. ## Restricting access to data sources Dataset entitlements are enforced server-side on every endpoint, **default-deny** and applied **per tenant**. A tenant scoped to Market Intelligence receives only Market Intelligence; a request for a dataset outside the subscription returns an explanation of what is not covered rather than a partial answer. Access is **read-only by construction**: the agent cannot execute actions in any HR system. Restricting specific user groups *within* a tenant to a subset of data sources is a roadmap item rather than a capability available today. Entitlements are applied at the tenant level. # Data residency and data flow TechWolf operates regional backends in the **EU** and the **US**. Each tenant is bound to a single region, keyed on its verified Entra tenant identifier, and every turn from that tenant is served there, with model inference served by the in-region Amazon Bedrock inference profile. **What crosses the Microsoft boundary:** * **Inbound:** the user's message text and their verified identity (email address and Entra tenant identifier). * **Outbound:** the agent's response, as the user reads it in Copilot. That is only the message the user types and the answer they read back. No raw customer documents and no personal data beyond a user identifier traverse this path. The integration adds no tool or data source. Under the Microsoft Data Processing Agreement, Microsoft may process this data only to provide the service, and not for profiling, advertising, or model training. The Microsoft transport carries the conversation in transit and is not a new system of record. # Security and data-isolation controls The integration's controls **fail closed**. When a precondition cannot be safely met, the turn is blocked rather than allowed to proceed in a degraded state. Each control is enforced on every turn. * **Tenant isolation.** Every turn carries the verified per-user identity, and the entity-scope data filter applies downstream. Cross-tenant data retrieval is architecturally prevented. * **Regional data residency.** Routing is keyed on the verified Entra tenant identifier. A request that cannot be mapped to a configured region is rejected, never defaulted. * **Verified identity on every turn.** No request is processed with an unresolved or elevated identity. * **Scoped access.** Bounded by Microsoft SSO combined with TechWolf's tenant and entity-level scoping, the access model that already governs the user's TechWolf access. * **Availability and continuity.** Connectivity is per-turn and stateless, and conversation continuity is preserved via a stable conversation identifier. The runtime runs across multiple availability zones and restarts automatically. ## What the user sees when a control cannot be satisfied | Condition | Behaviour | What the user sees | | ----------------------------------------------------- | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | Entra identity cannot be resolved | Turn not processed | A sign-in card: "Sign in to use the TechWolf agent". On a transient fault: "The TechWolf agent could not verify your identity right now. Please try again." | | Tenant not onboarded, or cannot be mapped to a region | Turn not processed; never falls back to a default tenant | "You don't have access to the TechWolf agent. Please contact your administrator." | | Authorization check fails | Turn not processed | The same no-access message. | | Authorization service unreachable | Turn blocked; an outage never grants access | "We couldn't verify your access right now. Please try again in a moment." | | Dataset not covered by the subscription | Server-side, default-deny on every endpoint | An explanation of what the subscription does not cover, rather than a partial answer. |