Skip to main content

​
Installing the TechWolf Analyst Agent in Microsoft 365 Copilot

Installing the Analyst Agent is a one-time, administrator-gated action. Nothing is enabled until an administrator acts: there is no per-user installation and no end-user self-service. TechWolf provides the agent as an admin-approved application package; it is not published to the Microsoft commercial marketplace for individual users to install. This guide is written for the Microsoft 365 / Teams administrator who performs the install. It corresponds to the recorded administrator walkthrough below.
A recorded walkthrough of the full installation is available from your TechWolf contact.

​
Required roles

The installation needs two distinct administrator permissions. They are often, but not always, held by the same person:
  • Teams Administrator (or an equivalent role with Manage apps permission): uploads the app package and controls which users or groups the agent is available to.
  • Global Administrator: grants tenant-wide admin consent from the Teams admin center. Only this role can; a Teams Administrator sees the required permissions there but gets “Contact a Global Administrator to request consent” instead of a way to grant them. A Privileged Role Administrator or Cloud Application Administrator can grant the same consent, but has to do it from Microsoft Entra rather than the Teams admin center (see the Grant admin consent step).
    The Permissions tab showing 'Contact a Global Administrator to request consent' and no grant control

    The Permissions tab for an administrator who cannot grant consent.

  • Customer contact with TechWolf: a designated representative who shares the tenant identifier with TechWolf and coordinates the onboarding.
No service principal, standing credential, or per-user secret is provisioned for this integration.

​
What the administrator consents to

The integration requests consent for a single capability: verifying the signed-in user’s Microsoft Entra identity, so each message can be tied to a known user. It needs no access to Microsoft Graph user data, and reads no directory, mailbox, or file content. The only identity data that crosses the boundary to TechWolf is the user’s email address and Entra tenant identifier.
The install grants a delivery surface, not new data access. A user who reaches the agent through Copilot still sees only the data their existing TechWolf scope permits. See How It Works for the identity and access model.

​
Installation steps

The installation consists of the following steps. TechWolf first binds your tenant to the correct region, you grant your users access to the agent in the TechWolf Console, your administrator uploads the app package in the Teams admin center, an administrator grants consent once for the whole tenant, and only then do you decide who gets the agent.
1

Share your Entra tenant ID with TechWolf

Provide your Microsoft Entra tenant identifier to TechWolf. TechWolf registers it against the correct regional backend, which pins every Copilot turn from your tenant to that region. This is configured once, at onboarding. Follow Find your Microsoft Entra tenant ID if you need to locate it.
A tenant that has not been onboarded is rejected, never defaulted to another tenant. Until this step is complete, users in your tenant cannot reach the agent.
2

Give users access to the agent in the TechWolf Console

A user can only reach the agent if they have been granted access to it in the TechWolf Console. Do this for every intended user before they use the agent from Copilot; a user without the agent role sees a no-access message.In the TechWolf Console, go to User Management. Use Add users to add a new user, or Edit users to update an existing one.
Adding a user in the TechWolf Console

Add a user in User Management.

Assign the user their roles. The Data Foundation roles determine which data the user, and so the agent on their behalf, is allowed to see.
Data Foundation roles

Assign the user's data roles.

Under TechWolf Agent, set Roles to Viewer to grant access to the agent, then select Add.
TechWolf Agent role set to Viewer

Grant the TechWolf Agent role, then add the user.

3

Upload the app package

In the Teams admin center, go to Teams apps -> Manage apps. Open the Actions menu in the top right and choose Upload new app, then Upload a custom app.Select the app package (.zip) you received from TechWolf.
Selecting the app package

Select the app package you received from TechWolf.

The upload takes a moment and shows no progress indicator; give it ten seconds or so.
Uploading the custom app

Uploading the custom app package.

You may see an error even though the upload succeeded. Refresh the page to check before retrying: the app usually appears in the list after a refresh.
4

Confirm the upload

After refreshing, search for TechWolf Analyst Agent by name in Manage apps to confirm the upload went through.
Confirming the app is in the list

Search for the app by name to confirm the upload.

Open the app and check the About tab. It shows the publisher (TechWolf) and the uploaded version, so you can confirm you have the package TechWolf provided.
The app's About tab

The About tab shows the publisher and the uploaded version.

5

Grant admin consent

The agent verifies each user’s Entra identity, and that verification needs tenant-wide admin consent. It is a separate action from the upload above and needs one of the Entra roles listed at the top of this page, so it may well be a different person.A Global Administrator does this on the app you just uploaded, in the same Teams admin center. Open Teams apps → Manage apps, search for the agent by name, open it, and go to its Permissions tab. Review the permissions in the dialog that opens, then select Accept.The tab lists exactly what is being granted: three delegated Entra ID permissions, openid (sign users in), email (view users’ email address) and profile (view users’ basic profile). That is enough to confirm who the signed-in user is, and nothing more. See What the administrator consents to above.
The app's Permissions tab showing admin consent granted for openid, email and profile

The Permissions tab once consent has been granted.

When it is done, the tab shows Admin consent granted for all required permissions, which is also how you check it later. Consent covers the whole tenant, so it is granted once and applies to every user, never per person, and revoking it stops the agent for everyone.
If the person granting consent is not a Global Administrator, a Privileged Role Administrator or Cloud Application Administrator can grant the same consent from Microsoft Entra instead. Open the consent URL below, signed in as that administrator, and accept:
Substitute the tenant ID you shared in step 1. Putting it in the URL rather than using organizations is deliberate: it pins the grant to the tenant you are setting up, instead of whichever tenant the signed-in account happens to belong to.Two things to expect. The browser lands on a token.botframework.com page reporting a missing code parameter; that is the redirect target being an API rather than a web page, and the grant has already been recorded by then. Check for admin_consent=True and your own tenant ID in the address bar to confirm. Afterwards the application appears under Enterprise applications, where the grant can be reviewed or revoked.The Enterprise applications pane cannot be used to grant it the first time: an application only appears there once it is provisioned in your tenant, which this consent is what does.
Grant this before assigning users in the next step. Your users cannot grant it themselves, so anyone who reaches the agent first gets “you need to agree to additional permissions” followed by “Something went wrong. Please try again.”, and that prompt never completes no matter how often it is retried.
6

Choose who gets access

Decide which users or groups get the agent, using the tenant’s standard app-assignment controls, the same mechanism as any other Teams application. The integration grants no access on its own.The same Users and groups controls govern two things: the agent’s availability (which users or groups can find and add it themselves) and its installation (installing it for them directly). You can make the agent available for users to add on their own, install it for specific users or groups, or both.The steps below install it directly. On the app page, open Users and groups and choose Install app.
Choosing who gets access

Open Install app to choose who gets access.

Set Install to Specific users or groups, then add the people or groups that should have the agent by name.
Adding users and groups

Add the specific users or groups that should have the agent.

Apply the change. The agent is now installed for the selected users, and only the users you add here get it: access stays under your control.
Installation confirmed

The agent is now installed for the selected users.

Once assigned, users find the agent in Microsoft 365 Copilot under Agents. See How It Looks for the end-user experience.
If anything in this documentation does not match your experience or needs clarification, contact us at support@techwolf.ai.