Copilot Studio custom MCP connector: server-verifiable identity of the calling agent?

You need the MCP server to authenticate the originating agent, beyond identifying the delegated user or connector client. Microsoft's current identity guidance explicitly excludes custom connectors, MCP servers and REST tools from the Agent ID connector-permission model. Its Teams-only runtime enforcement statement therefore does not establish agent attestation for your custom path.

The remote MCP deployment guide federates the connector's issuer and subject to a client app registration; it does not document a per-agent assertion delivered to your server. I cannot confirm a supported claim or test-pane versus published-channel attestation contract here.

For isolation, I would provision separate connector/client registrations and server authorization boundaries for each mandate, restricting who can reuse each connection. Validate signature, issuer and your API's audience, then enforce delegated permissions server-side. Treat that as connector isolation, not cryptographic proof of an agent. Request Microsoft's documented per-call attestation contract before making that stronger governance claim.