Post cover image

May 5, 2026

Integrating Microsoft Copilot Studio Agents with Snowflake Cortex Using MCP

In an earlier blog, we used the Dataverse connector to integrate a Copilot Studio agent with Snowflake Cortex Agents. This post replaces…

By Shankar Narayanan SGS

4 min read

In an earlier blog, we used the Dataverse connector to integrate a Copilot Studio agent with Snowflake Cortex Agents. This post replaces that pattern with Snowflake's managed MCP Server, so Copilot Studio calls a Cortex Agent through an MCP endpoint.

  1. Configure Cortex Analyst for Text-to-SQL over structured objects (tables/views).
  2. Configure Cortex Search for retrieval over unstructured content.
  3. Create a Cortex Agent with system instructions that can invoke Cortex Analyst and Cortex Search.
  4. Configure the Cortex MCP Server to expose the Cortex Agent as an MCP tool endpoint.
  5. In Copilot Studio, configure the MCP connector to register the Cortex Agent tool via the MCP Server, then deploy the agent.
  6. (Optional) Add additional data sources for the Copilot Studio agent.

Setup Prerequisites

Copilot Studio authenticates Snowflake using OAuth. Snowflake supports native OAuth and external OAuth. Use native OAuth if you only need Snowflake-managed auth; use external OAuth if you want to federate auth via Microsoft Entra ID.

Provision a Snowflake MCP Server and register the Cortex Agent as an MCP tool. You can also expose Cortex Search or Cortex Analyst directly as tools if you don't need the agent orchestrator. The snippet below shows an example of MCP Server specification.

CREATE OR REPLACE MCP SERVER salesintelligencemcpserver
FROM SPECIFICATION $$
    tools:
    - title: "Sales Intelligence Agent"
      name: "sales_intelligence_agent"
      type: "CORTEX_AGENT_RUN"
      identifier: "SALES_INTELLIGENCE.DATA.SALES_INTELLIGENCE_AGENT"
      description: "This agent orchestrates between Sales data for analyzing sales conversations using cortex search service (SALES_CONVERSATION_SEARCH) and metrics (sales_metrics_model.yaml)"
$$

For MCP Server setup details, see the Snowflake documentation.

In Copilot Studio, the Model Context Protocol connector is implemented as a Power Automate custom OpenAPI connector.

Configuring Snowflake OAuth

In the Snowflake OAuth model, Snowflake is the authorization server: it authenticates the user, enforces authorization, and issues tokens. The OAuth endpoints are hosted in Snowflake. This applies whether you use Snowflake-native authentication or an external IdP configured in Snowflake, because Snowflake still performs the final token issuance. More details: Snowflake OAuth overview.

None

Create a custom OAuth security integration for Copilot Studio. Follow the Snowflake documentation.

CREATE SECURITY INTEGRATION sf_mcp_oauth
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  ENABLED = TRUE
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 86400
  OAUTH_USE_SECONDARY_ROLES = IMPLICIT
  OAUTH_REDIRECT_URI = 'https://localhost'

Optionally set BLOCKED_ROLES_LIST to deny specific roles, and NETWORK_POLICY to force a specific network policy for tokens issued via this integration.

OAUTH_REDIRECT_URI is a placeholder at this stage. After you create the MCP connection in Copilot Studio, Copilot generates the actual redirect URL; update the Snowflake security integration with that value. Use the query below to retrieve the OAuth client ID and client secret.

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<integration_name>');

Configure the Copilot Studio agent

Create a Copilot Studio agent (if you don't already have one). Open the agent, navigate to Tools, and select Add a tool.

None

Select Model Context Protocol to configure an MCP connection.

None

Set the server's name and description, then enter the MCP Server URL. Use a description that maps to the capability exposed by the tool (Copilot uses it for tool selection). The MCP Server URL format is:

https://<account_URl>/api/v2/databases/{database}/schemas/{schema}/mcp-servers/{name}

Note: When configuring the MCP Server hostname, use hyphens (-) instead of underscores (_). Hostnames containing underscores can cause MCP connection failures.

Under Authentication, choose OAuth 2.0 and set the configuration to Manual.

None

Populate the fields as follows:

None

On the next screen, Copilot Studio generates the redirect URL for this connection.

Note: If you are looking to use Secondary roles. then use the scope as session:role:any

Update the Snowflake security integration with the Copilot Studio redirect URL.

ALTER SECURITY INTEGRATION <Integration Name> SET OAUTH_REDIRECT_URI = <Copilot OAuth URL>

Select Next. Copilot Studio will prompt you to select an existing MCP connection or create a new one.

None

From the Connection drop-down, select Create new connection.

None

Select Create to launch the Snowflake OAuth sign-in flow.

None

Complete the Snowflake sign-in. After the OAuth flow completes, Copilot Studio stores the connection (access token/refresh token as applicable). Select Add to attach the tool to the agent.

None

Under Details, expand additional settings and choose which identity Copilot should use when calling Snowflake (for example, per-user/end-user credentials).

None

Under Tools, Copilot Studio lists the tools exposed by the Snowflake MCP Server. Enable the full set, or enable only the specific tools you want this agent to invoke.

None

At this point, the MCP tool is available to the Copilot Studio agent. A follow-up post will cover configuring external OAuth with Microsoft Entra ID.