GitHub Copilot Harness + Work IQ + Business Data

Fetching a Dataverse record successfully does not establish that the separate search path is permitted. Your screenshots show broad operations enabled, but Work IQ also evaluates the requested resource path, operation and request content; OAuth and read/write permission alone do not override that layer.

Capture the failing do_action arguments, especially the exact relative path, and compare them with search_paths and get_schema results from the same server. Use the advertised tool and method rather than treating every POST as a write or inventing a search endpoint. Check the effective tenant policy and allow up to 24 hours after policy changes before retesting.

Also verify the calling application's App Access for that Dataverse environment, separately from Work IQ participation and the Copilot audience. If the advertised path still fails, send Microsoft support the sanitized request, correlation ID and UTC timestamp. The missing path prevents a definitive root-cause diagnosis.