Installing the TechWolf Analyst Agent in Microsoft 365 Copilot
Installing the Analyst Agent is a one-time, administrator-gated action.
Nothing is enabled until an administrator acts: there is no per-user
installation and no end-user self-service. TechWolf provides the agent as an
admin-approved application package; it is not published to the Microsoft
commercial marketplace for individual users to install.This guide is written for the Microsoft 365 / Teams administrator who performs
the install. It corresponds to the recorded administrator walkthrough below.
A recorded walkthrough of the full installation is available from your
TechWolf contact.
The installation needs two distinct administrator permissions. They are often,
but not always, held by the same person:
Teams Administrator (or an equivalent role with Manage apps
permission): uploads the app package and controls which users or groups the
agent is available to.
Global Administrator: grants tenant-wide admin consent from the Teams
admin center. Only this role can; a Teams Administrator sees the required
permissions there but gets “Contact a Global Administrator to request
consent” instead of a way to grant them. A Privileged Role Administrator
or Cloud Application Administrator can grant the same consent, but has to
do it from Microsoft Entra rather than the Teams admin center (see the Grant
admin consent step).
The Permissions tab for an administrator who cannot grant consent.
Customer contact with TechWolf: a designated representative who shares the
tenant identifier with TechWolf and coordinates the onboarding.
No service principal, standing credential, or per-user secret is provisioned for
this integration.
The integration requests consent for a single capability: verifying the
signed-in user’s Microsoft Entra identity, so each message can be tied to a
known user. It needs no access to Microsoft Graph user data, and reads no
directory, mailbox, or file content.The only identity data that crosses the boundary to TechWolf is the user’s
email address and Entra tenant identifier.
The install grants a delivery surface, not new data access. A user who
reaches the agent through Copilot still sees only the data their existing
TechWolf scope permits. See How It Works for the identity
and access model.
The installation consists of the following steps. TechWolf first binds your
tenant to the correct region, you grant your users access to the agent in the
TechWolf Console, your administrator uploads the app package in the Teams admin
center, an administrator grants consent once for the whole tenant, and only
then do you decide who gets the agent.
1
Share your Entra tenant ID with TechWolf
Provide your Microsoft Entra tenant identifier to TechWolf. TechWolf
registers it against the correct regional backend, which pins every
Copilot turn from your tenant to that region. This is configured once,
at onboarding. Follow Find your Microsoft Entra tenant
ID
if you need to locate it.
A tenant that has not been onboarded is rejected, never defaulted to
another tenant. Until this step is complete, users in your tenant
cannot reach the agent.
2
Give users access to the agent in the TechWolf Console
A user can only reach the agent if they have been granted access to it in
the TechWolf Console. Do this for every intended user before they use the
agent from Copilot; a user without the agent role sees a no-access
message.In the TechWolf Console, go to User Management. Use Add users to
add a new user, or Edit users to update an existing one.
Add a user in User Management.
Assign the user their roles. The Data Foundation roles determine
which data the user, and so the agent on their behalf, is allowed to see.
Assign the user's data roles.
Under TechWolf Agent, set Roles to Viewer to grant access to
the agent, then select Add.
Grant the TechWolf Agent role, then add the user.
3
Upload the app package
In the Teams admin center, go to
Teams apps -> Manage apps. Open the Actions menu in the top
right and choose Upload new app, then Upload a custom app.Select the app package (.zip) you received from TechWolf.
Select the app package you received from TechWolf.
The upload takes a moment and shows no progress indicator; give it ten
seconds or so.
Uploading the custom app package.
You may see an error even though the upload succeeded. Refresh the
page to check before retrying: the app usually appears in the list
after a refresh.
4
Confirm the upload
After refreshing, search for TechWolf Analyst Agent by name in
Manage apps to confirm the upload went through.
Search for the app by name to confirm the upload.
Open the app and check the About tab. It shows the publisher
(TechWolf) and the uploaded version, so you can confirm you have the
package TechWolf provided.
The About tab shows the publisher and the uploaded version.
5
Grant admin consent
The agent verifies each user’s Entra identity, and that verification
needs tenant-wide admin consent. It is a separate action from the upload
above and needs one of the Entra roles listed at the top of this page,
so it may well be a different person.A Global Administrator does this on the app you just uploaded, in
the same Teams admin center. Open Teams apps → Manage apps,
search for the agent by name, open it, and go to its Permissions
tab. Review the permissions in the dialog that opens, then select
Accept.The tab lists exactly what is being granted: three delegated Entra ID
permissions, openid (sign users in), email (view users’ email
address) and profile (view users’ basic profile). That is enough to
confirm who the signed-in user is, and nothing more. See What the
administrator consents to above.
The Permissions tab once consent has been granted.
When it is done, the tab shows Admin consent granted for all required
permissions, which is also how you check it later. Consent covers the
whole tenant, so it is granted once and applies to every user, never per
person, and revoking it stops the agent for everyone.
If the person granting consent is not a Global Administrator, a
Privileged Role Administrator or Cloud Application Administrator can
grant the same consent from Microsoft Entra instead. Open the
consent URL below, signed in as that administrator, and accept:
Substitute the tenant ID you shared in step 1. Putting it in the URL
rather than using organizations is deliberate: it pins the grant to
the tenant you are setting up, instead of whichever tenant the
signed-in account happens to belong to.Two things to expect. The browser lands on a
token.botframework.com page reporting a missing code parameter;
that is the redirect target being an API rather than a web page, and
the grant has already been recorded by then. Check for
admin_consent=True and your own tenant ID in the address bar to
confirm. Afterwards the application appears under Enterprise
applications, where the grant can be reviewed or revoked.The Enterprise applications pane cannot be used to grant it the
first time: an application only appears there once it is provisioned
in your tenant, which this consent is what does.
Grant this before assigning users in the next step. Your users
cannot grant it themselves, so anyone who reaches the agent first
gets “you need to agree to additional permissions” followed by
“Something went wrong. Please try again.”, and that prompt never
completes no matter how often it is retried.
6
Choose who gets access
Decide which users or groups get the agent, using the tenant’s standard
app-assignment controls, the same mechanism as any other Teams
application. The integration grants no access on its own.The same Users and groups controls govern two things: the agent’s
availability (which users or groups can find and add it themselves)
and its installation (installing it for them directly). You can make
the agent available for users to add on their own, install it for
specific users or groups, or both.The steps below install it directly. On the app page, open Users and
groups and choose Install app.
Open Install app to choose who gets access.
Set Install to Specific users or groups, then add the people or
groups that should have the agent by name.
Add the specific users or groups that should have the agent.
Apply the change. The agent is now installed for the selected users, and
only the users you add here get it: access stays under your control.
The agent is now installed for the selected users.
Once assigned, users find the agent in Microsoft 365 Copilot under
Agents. See How It Looks for the end-user
experience.
If anything in this documentation does not match your experience or needs
clarification, contact us at support@techwolf.ai.
Was this page helpful?
⌘I
Assistant
Responses are generated using AI and may contain mistakes.
