How do I connect Copilot Studio to the NIS2 walkthrough over MCP?
In Copilot Studio you add the walkthrough as a tool of an agent, with the address https://nisd2.eu/api/mcp and OAuth 2.0 with "Dynamic discovery" for sign-in. Copilot Studio runs in Microsoft's cloud, so as we understand it the instance has to be reachable from the internet over https. We have not tested this route yet.
How do I add the MCP server in Copilot Studio?
Copilot Studio is Microsoft's tool for an IT team to build its own agents, meaning assistants for particular tasks. Through MCP (Model Context Protocol), the protocol for such connections, the NIS 2 walkthrough becomes one of their tools.
Beforehand, an admin has turned on "Allow AI assistants for this company" in the nisd2.eu Settings. We have not tested Copilot Studio yet; the steps follow Microsoft's guide as of 15.10.2026.
In the agent, open the Tools page, then "Add a tool", "New tool" and "Model Context Protocol". The MCP onboarding wizard opens. According to Microsoft, Copilot Studio supports Streamable HTTP, and has not supported the older SSE since August 2025; the walkthrough answers over Streamable HTTP.
Fill in Server name, Server description and Server URL, with the address below. The agent reads the description to decide when to call the server, for example: Reads and fills in the company's NIS 2 walkthrough.
https://nisd2.eu/api/mcpWhich authentication do I choose?
OAuth is the usual way for software to sign in on your behalf without knowing your password. Choose OAuth 2.0 as the authentication type and "Dynamic discovery" as its type.
Copilot Studio then finds the sign-in addresses itself and registers with the sign-in service that every instance runs itself.
Select "Create", then "Next". On "Add tool", create a connection with "Create a new connection" and add the server with "Add to agent". Connecting opens the nisd2.eu sign-in page: sign in, check the return address, "Allow".
According to Microsoft, with OAuth 2.0 the individual users of the agent sign in themselves and grant it permission. In the walkthrough the agent then works with the rights of the person who signed in.
Does an API key work too?
Copilot Studio also offers an API key, in a header or as a query in the address. The walkthrough expects the key in the Authorization header, as "Bearer", a space, then the key.
It does not accept the key in the address. We have not checked whether Copilot Studio sends the header in that form, so use OAuth 2.0.
Does the instance have to be reachable from the internet?
Copilot Studio is a service in Microsoft's cloud. So we assume that Microsoft opens the connection and that the instance has to be reachable from the internet over https. Microsoft's guide does not say so explicitly.
nisd2.eu is reachable that way. A self-hosted instance only inside the company network would then not be reachable along this route; we have not checked whether Microsoft offers a way in. Inside the company network, software that runs on the computer works, such as Claude Code.
In Copilot Studio, access to MCP servers runs through the Power Platform: according to Microsoft, a data policy for connectors also governs the MCP server and its tools. Ask whoever manages the Power Platform at your company whether a policy allows the server.
What may the agent do in the walkthrough?
The agent reads the items and fills in fields, lists and screens, with the signed-in person's rights.
It cannot finish an item, decide it is not applicable, delete a supplier, an asset or a training, or sign. The server offers those functions to no assistant.
What the agent reads goes to Microsoft, under your company's agreement with Microsoft. We did not check Microsoft's terms on this for this article.
How the walkthrough does it
For an IT team that works in Microsoft 365, two items suggest themselves.
5.1 "Write down who works for you": the agent adds to your list of suppliers, one line each with what they do for you. The item counts everyone who can reach your data, so Microsoft as the agent's vendor belongs there too.
10.1 "Write the staff, access and asset policy": the template has fixed sections on joining, changing role and leaving, on outside staff, on access and on managing your IT. The agent picks the clauses that fit and adds below what applies to you, for example how Microsoft 365 accounts are blocked on the last working day.
Every screen the agent wrote shows its name and the day. The person reads the policy in the app and finishes the item there; management approves it, in the app as well.
Common questions
What rights does the Copilot Studio agent get?
Those of the person who signs in: their areas of the walkthrough, or all of them for an admin. The agent of someone who only reviews the walkthrough can read it but fills in nothing.
How long does the agent stay connected?
With the refresh token the walkthrough hands out, Copilot Studio can renew the sign-in itself. It ends at the latest 90 days after "Allow", and then the person signs in again. A new password ends it sooner.
How do I disconnect Copilot Studio again?
In the nisd2.eu Settings under "Connected" with "Disconnect", or all at once with "Disconnect all assistants". For the whole company, an admin turns "Allow AI assistants for this company" off. The connection ends at its next call.
Is there a limit on MCP calls?
Yes, 300 tool calls per person per hour, for all of that person's assistants together. The next hourly window starts fresh.
Can I see in the walkthrough what the agent entered?
Yes. Every screen it wrote carries its name and the day. The activity log shows each change under the person's name, "via" the agent's name.
Read next
Sources
- Microsoft Learn, Connect your agent to an existing Model Context Protocol (MCP) server, learn.microsoft.com/microsoft-copilot-studio/mcp-add-existing-server-to-agent (updated 15.10.2026)
- MCP specification 2026-07-28, Authorization, modelcontextprotocol.io
- open-isms, app/.well-known/oauth-authorization-server/route.ts and app/.well-known/oauth-protected-resource/api/mcp/route.ts, github.com/NISD2/open-isms
- open-isms, lib/mcp/server.ts, lib/mcp/procedures.ts and lib/mcp/endpoint.ts, github.com/NISD2/open-isms
- open-isms, MCP server documentation, content/docs/self-hosting/mcp.md, github.com/NISD2/open-isms
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Supply Chain Security
Write down who works for you
A list of your suppliers and service providers.
Access Control & HR Security
Write the staff, access and asset policy
Who gets into what, and what happens when someone leaves.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
