Defined implementation

Move your agent from a demo to something customers can actually use.

Host the MCP server, configure sign-in so every user connects with their own account, and limit each data connection to the agreed scope. Test the agent, record its activity and prepare the required listing documentation. Submission and platform approval remain separate.

Plan the Agent Launch Review scope & terms

The engagement: Defined implementation
A deliverable you keep: A configured MCP service with scoped connections, authorization tests, evaluation records and operating documentation.
A completion check: Agreed access and tool tests pass and the handover is complete. Marketplace submission does not guarantee platform approval.

Price fixed after a short scope call. Price drivers and project calendar ↓

Illustrative sample · constructed example

The tool must check whose data the request can reach.

Constructed tool request · project lookup

Selected check

Does a request for an unrelated project return data?

Agent tools / authorization testsIllustrative

Constructed tool request · project lookup

PILOT CONTEXTCaller identityThe signed-in user has an agreed project permission.

RELATED CONTROL / ACTORTool boundaryRequest validation checks identity, scope and requested action.

SEPARATE CHECKActivity recordAllowed and denied requests keep a safe trace reference.

Deny the request. Results apply to the named sample checks below.

Agent tools / authorization tests — constructed inspection record
Test case	Expected behavior	Sample review
Signed-in caller	Establish the identity used for this request.	Sample caller identified
Unrelated project	Return no project content outside the approved scope.	Request denied
Authorized project	Return only the read permitted for that caller.	Not the selected request
Write operation	Require its own authorization and approval rule.	No write authorized

Constructed requests, no live data. Sign-in alone does not establish authorization at every downstream system.

Reference guidance: connecting an agent to an MCP server (Copilot Studio docs) ↗

Evidence: Sample caller requests a project outside the approved access scope.
Decision: Deny the request
Next action: Return a bounded error and record the denial without exposing project content.

Illustrative sample with no live data. Launch does not imply marketplace approval, identity delegation or unrestricted tool access.

Public Agent & MCP Launch

The work starts here.

The agent works in a demo, and now it has to be reachable by customers: hosted, signed in to, connected to real data, and ready to list.

Scope considerations

One agent, one hosted server
Per-user sign-in, not a shared key
You own the model and its behavior

What AZ changes or delivers

01
The MCP server is built and hosted somewhere it stays up, rather than on a laptop or a personal subscription.
02
Your APIs and business data are connected through it, and each connection is scoped to what the agent actually needs rather than to everything it could reach.
03
Sign-in uses OAuth, with Microsoft Entra ID as the identity provider, so the agent answers as the person asking rather than as itself.
04
It is connected to the agent platform the business is standardizing on (Copilot Studio or Microsoft Foundry). Generative orchestration is switched on where that platform requires it.
05
Evaluation and telemetry are turned on against an agreed test set, so what the agent returns can be measured rather than assumed.
06
The documentation a public listing or certification asks for is written, and the submission is prepared for you to send.

Acceptance

Checks before handover

Done when a test user signs in with their own account, the agent returns only what that account could already reach, and the listing submission is ready to send.

The MCP server is reachable at its agreed address and comes back after a restart
A test user signs in with their own account and the agent returns only what that user could already reach
Every connected API and data source is listed with the permission it was granted
Evaluation runs produce a recorded score against the agreed test set
The documentation pack is complete and the listing submission is ready for you to send

Scope, price and project calendar

Engagement price

Price fixed after a short scope call.

The price is agreed in writing before any work starts and before anyone is given access. The call itself costs nothing. What moves the number:

What determines the scope

How many APIs and data sources the agent connects to
Whether it is going into a public catalog or staying inside your own tenant
How much of the evaluation and telemetry has to be built rather than switched on
Whether the hosting has to meet a customer requirement about where it runs
How much of the security documentation already exists

Delivery calendar

The proposal names the start date, the change windows and the completion date before anything is agreed.

How engagements work

Scope & responsibilities

Responsibilities and exclusions

Review the exclusions, required client participation, change controls and operational handover for this engagement.

Exclusions

Building, training or tuning the model itself
Writing the agent prompts or deciding how it should behave
Any promise that a catalog or certification review will approve the listing, which is the reviewer decision and not one AZ can make
Running the server after handover, unless that is agreed separately

Client responsibilities

Own the agent behavior, the prompts and the model choice
Provide the APIs and data the agent connects to, and say who may reach each one
Name the person who approves the security position before anything is published
Provide the tenant and the licensing the hosting and sign-in require

Change and rollback method

The server runs somewhere non-production first, and the sign-in path is tested with a real account before anything is published.
Data connections are added one at a time, and what each one can reach is checked before the next is added.
Nothing is submitted to a public catalog until the documentation and the security position have been approved on your side.

Operational record and handover

The hosted MCP server and its configuration, written down
The connection list, with the permission granted to each one
The sign-in test results, per test account
The evaluation scores against the agreed test set
The documentation pack, ready to submit

Access, acceptance and support arrangements ↗

Discuss this engagement

Discuss Public Agent & MCP Launch

Describe the problem, systems and deadline. We will review the fit and the scope questions before preparing a written proposal.

Plan the Agent Launch