Forum Discussion

pMesiha's avatar
pMesiha
Copper Contributor
Oct 28, 2026

GitHub Copilot Harness + Work IQ + Business Data

Hello,

I have been trying to use the latest Work IQ MCP from an agent build using Copilot Studio (GHCP Harness).

The MCP is able to answer questions to provide details about a dataverse record when i provide the record ID, when i try to ask for questions that require the agent to list/search, it fails with the error "Path is not in the policy allowlist." when trying to perform a post request to the do_action tool.

 

I double checked:

  1. Work IQ enabled on Power Platform environment
  2. Business Apps in M365 allowed for my user account
  3. MDA has required config enabled
  4. Semantic index created for MDA
  5. Work IQ MCP Policy under M365 and all operations are enabled:

     6. Confirmed checked that i have enabled read/write on the Work IQ MCP inside my agent (just in case Post request is considered a write)

 

Any clue what is going wrong or if there are missing configuration somewhere that i need to check?

copilot studio

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Nov 05, 2026

    Fetching a Dataverse record successfully does not establish that the separate search path is permitted. Your screenshots show broad operations enabled, but Work IQ also evaluates the requested resource path, operation and request content; OAuth and read/write permission alone do not override that layer.

     

    Capture the failing do_action arguments, especially the exact relative path, and compare them with search_paths and get_schema results from the same server. Use the advertised tool and method rather than treating every POST as a write or inventing a search endpoint. Check the effective tenant policy and allow up to 24 hours after policy changes before retesting.

     

    Also verify the calling application's App Access for that Dataverse environment, separately from Work IQ participation and the Copilot audience. If the advertised path still fails, send Microsoft support the sanitized request, correlation ID and UTC timestamp. The missing path prevents a definitive root-cause diagnosis.