10. Copilot Extensions

What is a Copilot Extension?

A Copilot Extension is an agent that plugs directly into Microsoft 365 Copilot — appearing alongside users in Teams, Outlook, Word, and other M365 apps. Extensions can answer questions, execute actions, retrieve data from external systems, and automate multi-step workflows, all within the Copilot experience.

Extension Architecture

• Declarative Agent — defined by a manifest (JSON) describing name, instructions, skills, and scope
• Plugin (API-based) — an existing API surfaced as a Copilot skill via OpenAPI description
• Message Extension — custom card-based interactions in Teams conversations
• Connector — ingests external data into the Microsoft Graph for grounding

Types of Extensions

Declarative Agent Manifest

Every declarative agent is defined by a JSON manifest. Here's a minimal example:

{
  "$schema": "https://developer.microsoft.com/json-schemas/copilot/declarative-agent/v1.0/schema.json",
  "version": "1.0",
  "name": "HelpDesk Agent",
  "description": "Resolves IT support tickets",
  "instructions": "You are an IT support agent. Help users diagnose issues, create tickets, and escalate when needed.",
  "capabilities": [
    {
      "name": "WebSearch",
      "url": "https://api.example.com/websearch"
    }
  ],
  "conversation_starters": [
    { "text": "My VPN is not working" },
    { "text": "How do I reset my password?" }
  ]
}

Building an API Plugin

To expose a custom API as a Copilot skill, create an OpenAPI description and reference it from the manifest:

{
  "openapi": "3.0.0",
  "info": { "title": "Ticket API", "version": "1.0.0" },
  "paths": {
    "/tickets": {
      "get": {
        "summary": "List tickets for a user",
        "parameters": [
          { "name": "userId", "in": "query", "required": true, "schema": { "type": "string" } }
        ],
        "responses": {
          "200": {
            "description": "List of tickets",
            "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Ticket" } } } }
          }
        }
      }
    }
  }
}

Deploying to Microsoft 365

Use Teams Toolkit (VS Code) or Microsoft Copilot Studio to package and publish your extension. The deployment flow:

• Package manifest + icons into a .zip
• Upload to Microsoft 365 admin center or publish via Partner Center
• Assign permissions and scope (org-wide or specific groups)
• Test in Copilot with /HelpDesk mention

Handling Authentication

Extensions authenticate via Microsoft Entra ID. Your API must validate tokens:

// Validate the JWT from Copilot
const jwt = req.headers.authorization?.split(" ")[1];
const decoded = jwt.verify(jwt, jwksUri);
const userId = decoded.sub; // M365 user ID