MDM: Microsoft Copilot

Microsoft 365 Copilot is different from the other harnesses: its built-in chat model cannot be redirected to a gateway, so there is no base URL to push. See the Microsoft 365 Copilot connect page for why.

That shapes what a managed rollout means here.

• The app, through Intune. Microsoft 365 apps, including Copilot surfaces, are managed through the Microsoft admin center and Intune like any other Microsoft app. That governs deployment and policy, not which model the model plane uses.
• Agents, not the base model. Governance of the model and tools comes from custom engine agents (you own the orchestrator endpoint, so point it at TapPass) and from the tool plane via MCP and connectors. Those are configured in Copilot Studio and Azure AI Foundry, not through device MDM.

• A documented pattern for pushing the TapPass orchestrator endpoint and per-user keys to custom engine agents at scale.
• Guidance for pinning TapPass as the governed tool provider (MCP) across a Microsoft 365 tenant.

If you need this now, tell your TapPass contact which surface (M365 Copilot, Copilot Studio, or custom engine agents) and we will help you scope it.