Need AI Fin Ops? How to set up Microsoft 365 Copilot AI FinOps and Cost Management


Introduction

Following on my last blog post, Do We need AI FinOps? I heard a resounding yes! I wanted to continue the story.

Microsoft have been busy releasing the next reason that your AI bills are going to increase: Persistent Agents. These agents are part of the Agent 365 ecosystem with their own personal identity, mailbox, user account and tools.

Unlike existing Copilot Studio agents which are often initiated and tied to a user, these are an extension to the Autopilot concept and allow you to have AI Team mates.

The AI Teammates are hosted on the Github Copilot Harness, so they are billed through usage-based billing UBB and because of their nature, they are going to be harder to control because they are accessible through Microsoft Teams and Outlook, via chat and email respectively and also Microsoft Office via the Word, Excel and PowerPoint comments feature.

So, what does this mean?

Well, it is further proof of the need to get serious with your AI FinOps spend. So let’s discuss the process of setting up the Cost Management features for Microsoft 365 Copilot.

Microsoft, have also been busy. They have added more features, giving you more control in how you can configure these billing profiles and spending policies.

However, the clock is ticking when Microsoft released these usage based billing features they were switched off by default. This is due to change, from 1st December 2026 a default spending policy will be set-up for CSP purchased Microsoft Copilot Business licenses.

More information can be found here.

October 2026 announcements – Partner Center announcements | Microsoft Learn.

https://learn.microsoft.com/en-us/partner-center/announcements/2026-october#4

Where Microsoft Copilot FinOps Controls Live

Microsoft have put the Microsoft Copilot FinOps controls directly in Microsoft 365.

It all starts in the Microsoft Admin Centre (MAC) https://admin.cloud.microsoft.

Browse to the Copilot Node -> Cost Management

The image displays a dashboard with various tabs and statistics, including a total of 10,206 Copilot Credits used, no credit increase requests, and an account team that has used 5,790 credits.

AI-generated content may be incorrect..

Here you can set up a general policy which covers everyone in the business who has access to use these tools. My recommendation is that you work with your CFO to define a monthly spend and then allocate it to all your users. The pricing is based on 0.01p per Copilot Credit, so 1000 credits is £10.00, and 10000 Copilot Credits is £100.

The first step, as mentioned, is to plan out what budgets and policies you are going to apply to the organisation. In my experience, you will have at least two spending policies but most likely more based on the usage/value scenarios.

  1. General Organisation
  2. Copilot VIPs / High usage/value users.

Setting up your spending policies

To set up a spending policy, do the following:

  • Click on the Configuration Tab under Copilot->Cost Management
  • Click Add Spending Policy
  • Here you can choose the services that will be applied to this spending policy. I think the interesting one is the option at the top, “Allow new Agents and services as they become available” which shows that Microsoft have more services that will use this way of billing and here you can choose whether to automatically enable those. I suggest that you switch this off if you want to have control of the onboarding of services.

We have the following services, expanding Microsoft Copilot allows us to choose the sub-Copilot experiences.

I am glad that they are giving us a way to turn off the services at this level and being able to control who can create Managed Apps with Code vs who can execute those Managed Apps through the “Copilot Managed Runtime”.

A quick summary of the services is shown below

ServiceDescription
Copilot CoworkA task-based Copilot experience for carrying out advanced, multi-step work on a user’s behalf; it requires a Microsoft 365 Copilot licence and consumes Copilot Credits for eligible usage.
Copilot CodeA software-development experience that uses the GitHub Copilot coding harness to help create and complete coding work. Eligible usage requires a Microsoft 365 Copilot licence and is governed through Copilot Credits and the organisation’s spending policy.
Advanced work in SharePointProvides advanced AI-assisted work over SharePoint content, helping licensed Copilot users analyse and act on organisational information while its usage is governed through Copilot Credits.
Advanced work in OneDriveProvides advanced AI-assisted work with files stored in OneDrive, enabling licensed Copilot users to analyse and work with their content while usage is charged through Copilot Credits.
Work IQ API for custom apps and agentsAllows custom applications and agents to use Microsoft 365 work context and organisational knowledge through Work IQ, with API consumption metered separately in Copilot Credits.
Copilot Managed RuntimeA governed hosting and execution environment for internal line-of-business applications, providing Microsoft Entra authentication, connectors, policy enforcement, central inventory and usage monitoring; running eligible apps can consume Copilot Credits.
Teams Phone AgentAn AI agent capability for Teams Phone scenarios that supports automated handling of calling-related work, with eligible usage managed through Microsoft 365 Copilot spending policies and Copilot Credits.
  • Click Next once you have selected the services you wish to include in the spending policy.
  • Now you need to give the spending policy a name.
  • Select whether access scope should apply to everyone or a group of people. If you select specific group you can choose either Microsoft 365 Groups or Security Groups.
  • Choose your group if you are going down that route.
  • Click Next

Now you are ready to setup the spending policy limits.

  • Choose whether to have no limit or apply a monthly limit, I would advise the later.
  • Additionally, we can choose to limit individual users within a plan. If you want to ensure that a particular user does not consume all of the credits then you can add an individual limit. I would suggest doing this in the first instance. If you have a suer that is getting more value from AI then most you can always move them into their own spending policy and manage them individually or group them with other Copilot VIPs!
  • Finally, we can define alerts, the user interface will change depending on what options you have enabled.
  • You can provide a list of users and then choose the limit as to when people should be notified this can either be based on % consumption or individual credit consumption. Additionally you can be alerted when a user reaches a % of their capacity as well.
  • Once setup click Next

Finally choose how you are going to pay, you can choose to include this spending policy in any pre-purchased payment packs as well as llnk it to your Azure Subscription. You will need to have access to the Azure Subscription to be able to link them to the Spending Policy.

  • Click Next
  • Review your spending policy settings
  • Click Create Spending Policy.

You can always go back and edit the spending policy if you wish by choosing the spending policy and clicking Details.

Reviewing Consumption

Once we have set up our spending policies then we will need to review who is using what every once in a while.

  • Clicking the Consumption tab will reveal the different views where we can review at a policy, user, group or service level.
  • It is worth highlighting that depending on the view you can change the data that is being viewed. For example at the policy level the top-right filter allows you to view by month, current month and the entire year.
  • If you choose the user level, you can also drill into an individual’s consumption level. You can see which spending policy has been applied to them if they are in multiple policies and how their daily usage is working out.

If you want to look into the usage in more detail then there are more options on the overview page.

Usage – Overview Page

The Overview page will allow you to get more detail on the Copilot usage.

I find the Spending trend particularly useful which can be configured to show a different scope of data.

What about Copilot Agents and Copilot Credits?

So, you might be looking at these screens and instructions and say that looks great Simon but what about controlling my Copilot Agents and Copilot Credit consumption.

Unfortunately the controls to Copilot Agent Copilot Credit consumption is not found here which is a bit of a shame but I suspect that is down to keeping those controls under the Power Platform Admin team rather than confusing things within the Microsoft 365 Admin centre.

To setup controls for Copilot Studio Agents you will need to be a Power Platform Administrator and browse to https://admin.powerplatform.microsoft.com

  • Click Licensing to be able to see the licensing and billing settings.
  • Click Copilot Studio

So, with Copilot Studio we pay for Copilot Credits either through Billing plans or by buying Copilot Credit / Message packs.

  • Click on Manage Billing Plans to see the list of billing plans.

If you wish to create a new billing plan, make sure you have access to an Azure Subscription as a contributor or owner.

We are using the resource group name copilot-credit-[envtype]-rg for our resource group names.

  • Add a new billing plan by clicking “New billing plan”
  • Give the billing plan a name, choose the Azure Subscription you wish to link the billing plan to
  • Choose the resource group you have setup
  • Choose the services that you wish to be billed through the billing plan.

My advice is to select the Copilot Studio and Dataverse and Power Automate and keep the rest separate so you can control the Copilot Studio aspects.

  • Choose the region and then you will see the environments in that region.
  • Select the Power Platform Environments you wish to support for this billing profile.
  • Click Save.

Managing Prepaid Copilot Credit Consumption for your environments

If you have Premium licenses you will have Copilot Credits available which can be allocated to environments or alternatively you can allow an environment to pull the Copilot Credits from the tenant wide available credits.

To control this use the “Manage Copilot Credits” button.

From this view we can see a list of Power Platform environments with columsn for current Copilot Credit Consumption and Allocated capacity. Additionally, you can see if there are any environments which are not within the allocated capacity.

To update the available Copilot Credit capacity

  • Click on the environment name
  • From here you can control the following
    • How many credits are available to the environment.
    • Whether the environment can draw from tenant capacity. My screenshot shows it greyed out because it is managed via a managed environment group policy.
    • Choose whether to have PAYG enabled as well, I have this switched off for development environments. However, I would suggest enabling this for Production with alerts so that you can ensure that your agents continue to work if they go over Copilot Credit capacity.
  • Finally, you can set up alerts.

Please ensure you have allocated some credits to cover your consumption otherwise your Copilot Studio agents will be impacted.

  • Click Save to complete your setup.

A note on the option “Draw from the available capacity in my tenant.”, I had an issue where this was disabled and I could not set it through the Managed Environment wide setting. I ended up having to switch the option off and back on again at the Managed Environment level to get this option to update. Until I did that, I could not configure Copilot Credit allocation as I kept getting an error.

Copilot Studio Consumption Monitoring

The monitoring of Copilot Credit consumption is possible through the Manage Agents button within the Licensing -> Copilot Studio menu.

We can now see each of the agents across the Power Platform environments.

Here we can see consumption of Copilot Credits which have been billed through a spending policy and those that have used pre-paid credits.

If you wish to get more detailed information, click “Download Report” you can choose the number of days history in your report to get more detailed information.

Limiting an individual agents consumption

We can also limit an individuals agent Copilot Credit consumption within this screen by clicking the … next to the agent and choosing “Set Limit”.

  • From here we can allocate a capacity limit for an individual agent.
  • This is a really useful feature to put some controls around your individual agents!

Copilot Studio Monitoring

There are a number of different reports and charts which are worth exploring which allow you to see who is using the agents and what their consumption is either at the pre-paid billing of pay as you go billing level.

Additionally, we can see which agents are consuming the most credits which is useful to help us get an idea of what typical credit usage might be for a year.

Conclusion

In this article we showed you some of the features that we can put in place to manage AI consumption, billing and FinOps around Microsoft Copilot and the various billing controls.

There is more coming to this area from Microsoft, in particular expect some more announcements at Ignite 2026.

One of the things that writing these articles helps to do is solidify and find those sometimes hidden options. I had not seen the individual agent credit control before which has been a great find.

I would love to hear your thoughts and what controls you would like to see which are missing.

An image of an MCP Server rack seating behind a firewall

Building a Secure Custom MCP Server secured by Microsoft Entra ID


Introduction 

In this article, we will discuss the topic of building a custom MCP Server which is secured by Microsoft Entra ID.

This post builds on a previous blog post I wrote about setting up an MCP Server consumed by Copilot Studio. I would suggest that you read that post first.

Of course, all the source code for this secure MCP Server is provided, so you can use it to get going quickly.

Now, I will also point out another resource which was shared with the community on Tuesday, and that is Paolo Pialorsi’s Microsoft Community Call from the 26th May 2026, which you can find here: (580) Microsoft 365 & Power Platform weekly call – 26th of May, 2026 – YouTube. You will need to watch from about the 34th minute.

Why?

Firstly, why do we want to do this?

Well, Custom MCP Servers are the new way to extend your Agentic applications’ reach into your business systems or platforms to enable your organisation to do even more with platforms such as Microsoft 365 Copilot, Claude, Copilot Cowork, and more.

However, we need to make sure that these MCP Servers are secured, so that they do not leak organisation information.

Like your APIs or applications, you need to ensure that your MCP Servers are not accessible to everyone, including those who want to get into your organisation.

Often, your APIs and MCP Servers are sitting on public networks and are publicly accessible, and so we need to ensure that only the people that we want to be able to access the MCP Server can.

How?

Firstly, let’s create our MCP Server from the GitHub repository sample.

You can find the secure MCP Server sample on GitHub here:

microsoft365-dev-samples/copilot-secure-mcp-azure-containers at main · SimonDoy/microsoft365-dev-samples

To use, simply clone the repository to your local machine and then follow these instructions.

Setting up the Infrastructure

Once you have cloned the GitHub repository to your local machine, you will need to do the following.

Firstly, we need to set up two Microsoft Entra ID Applications, one to secure the MCP Server and one to be used as the MCP Client to connect to the MCP Server.

I am using the application name pattern [Organisation Name] [Product/Project] MCP Server ([Environment]).

e.g. iThink 365 Toggl MCP Server (Dev)

e.g. iThink 365 Toggl MCP Client (Dev)

I will assume you know how to create the Microsoft Entra ID Application, but there are some things we need to do to support various features of MCP Client, such as Dynamic Discovery and discovering Authentication requirements.

These are particularly important when using the very popular MCP Client test tool, MCP Inspector.

  • Browse to Entra ID (https://entra.microsoft.com)
  • Browse to your App Registrations
  • Add your application named as above, but don’t configure any of the client secrets, etc., yet. I will take you through that.

Once you have set up your Entra ID Application, let’s configure each one.

Setting up your MCP Server Entra ID Application

Firstly, we need to configure the MCP Server Entra ID application to expose an API.

  • From App Registrations
  • Open your Entra ID Application
  • Click on Expose an API
  • Take the default Application ID URL that is provided, which will be something like api://[your client id]
  • Add a scope called mcp.tools
  • Who can consent (Admin and users)
  • Provide names and descriptions for each of the Admin and User sections.

We need to configure the Entra ID application to use a different version of the Access Token. This is because MCP Clients like MCP Inspector expect to be able to use the URL of your MCP server as the Application ID URI.

  • Next, click on Manifest
  • Find the property “requestedAccessTokenVersion” and change the value to 2
  • Save your manifest.

Now, because we have done this, we can change the Application ID Uri to other values. The eagle-eyed among you will have seen that I have got the Application ID URI set to use https://localhost:7143/api/mcp

Why do I have this? Well this will let me test out my secured MCP Server locally using MCP Inspector.

Next, check the API Permissions, and you will see a default Microsoft Graph User.Read permission, which is great.

Let’s add the MCP Server scope as well that we have just created.

  • Click Add a permission
  • Choose from the top API that my organisation uses
  • Find your MCP Server Entra ID application name.
  • Grant admin consent.

Finally, we need to configure the redirect URLS for the Entra ID application so that we can use MCP Inspector to test it out.

Save your configuration.

Setting up your MCP Client Entra ID Application

Next, we will move to configuring the MCP Client.

  • Open the MCP Client that you have created.
  • Click on API permissions
    • Add the permission to the mcp.tools scope from your MCP Server using the API’s my organisation uses
    • Choose the mcp.tools scope
  • Finally, Grant Admin Consent to the application if you have permission.

Finally, we need to set up the MCP Client Entra ID application with some redirect URLs

Fire up and configure the MCP Server

Now that we have the MCP Server and MCP Client Entra ID applications set up. We can switch back to the code and update the configuration to ensure that our MCP Server uses it.

Open the MCP Server Project, i365.Mcp.EchoMCPServer in Visual Studio or Visual Studio Code. I am using Visual Studio.

  • Open applicationsettings.development.json
  • Update the AzureAd section with the following configuration
  • TenantId: [Your local Microsoft Entra ID tenant ID]
  • Audience: [the Client id for your MCP Server Entra ID Application].
  • ClientId: “[the Client id for your MCP Server Entra ID Application]”.
  • RequiredScope: “mcp.tools”
  • Now you should be able to compile and start the code with this configuration.

Test your MCP Server with MCP Inspector

With your MCP Server up and running, let’s connect MCP Inspector to it.

  • Fire up a terminal / PowerShell whatever you would like, and run
  • “npx @modelcontextprotocol/inspector”

After a minute or so, you’ll see MCP Inspector appear.

Make sure you access the MCP Inspector from a browser that is running against the tenant that contains the two MCP Server and MCP Client Entra ID applications that we have created; otherwise, you will see errors about the application not existing in tenant xxxx.

Update the MCP Inspector to point to your MCP Server running locally,

Use the URL: https://localhost:7143/api/mcp

An animated gif showing the process of authenticating MCP Inspector to the Entra ID Backed MCP Server.
The result is an access token which can be used to authenticate with the MCP Serve.r

Testing the Authentication Process

Make sure your MCP Server is running on https with port 7143.

  • Click on “Open Auth Settings”
  • Click on “Quick OAuth Flow”
  • You should now see MCP Inspector go through the OAuth Flow Process, discover the metadata required to connect to our Authorisation server, etc.
  • You will then be asked to sign in
  • Once you sign in, you should see an access token created, and you should be ready to connect.

Connecting to the MCP Server

We are now ready to connect to the MCP server.

Click on the Connect button.

You might need to authenticate again, but you should see the tools appear that are hosted within the MCP Server.

This animated gif shows how the user can now connect to the secure MCP Server and list all the tools. The user accesses the echo tool and say Hello MCP Server. The MCP Server responds back with Hello, Hello MCP Server.

That’s it, you are up and running.

What Next?

Well, now that you have your base MCP Server, you need to get it deployed into Azure, and you will need to start adding tools to your MCP Server.

You can find out the process to get it deployed into Azure using Azure DevOps in this article.

How to: Build a Custom MCP Server with the .NET MCP SDK, host as an Azure Container and connect to Copilot Studio | Doy’s Microsoft 365 and Azure Dev Blog

So, how does this all work, and why did you do it the way you did?

So, getting this up and running took me a while as I was trying to reverse engineer what was going on. I looked at loads of examples, and there does seem to be some issues with MCP Servers and Entra ID when you’re trying to get dynamic client registration, etc., working.

However, let’s talk through the code a bit. Firstly, the .NET MCP SDK was used to build this MCP Server, and it does have support for discovering protected metadata resources, but I could not quite get it to produce the endpoint result that I was looking for. I used Microsoft’s Dataverse MCP Server to try to understand how it all fits together.

The discovery of authentication settings is provided in the code by this section, which creates a well-known endpoint, “/.well-known/oauth-protected-resource”.

Now you should be able to use the .NET MCP SDK to create this as well, except I was trying to copy the Dataverse MCP Server, which provides the code_challenge_methods_supported parameter as shown above. However, when you use the MCP SDK, it does not allow you to configure this and all you can configure is Bearer header configuration.

Figure 1 – This is from the .NET MCP SDK, and I could not get the dynamic discovery stuff to work with this.

Also, another part of the puzzle for the dynamic setup was having a .wellknown/oauth-authorization-server endpoint, which is used by the MCP Client to complete all the authentication. You can see the code here

The other things that we have configured is stateless MCP switched to true. I have seen this cause issues with Copilot Studio MCP Clients, however, I really need to work through building a stateful example soon.

The authentication being backed by the mcp.tools scope is again the same pattern that I have seen Microsoft use and so I have copied that. The code that enforces the Authentication Policy to enable access for mcp.tools is shown below.

Anyway, I think this blog post, along with my original one about building MCP Servers for Copilot Studio, should give you plenty of support in understanding the code. But please ask if I have missed out on something that you would like to be included.

Conclusion

So, in this post, we discussed setting up a secured Entra ID MCP Server using a template and making it so that you can test it from MCP Inspector using Entra ID OAuth authentication.

Thanks for reading. My next blog post is to take this template and make it available to Microsoft 365 Copilot Cowork through the new plugin infrastructure. I have a working version, just need to get writing, so watch this space!