> ## Documentation Index
> Fetch the complete documentation index at: https://docs.seekout.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Deploy the SeekOut agent for Microsoft 365 Copilot
> Administrator guide to reviewing, deploying, and adopting the SeekOut agent for Microsoft 365 Copilot across your organization.
This guide is for Microsoft 365 and Teams administrators who are evaluating or rolling out the **SeekOut** agent for Microsoft 365 Copilot. It covers what the agent does, what it requires, [why your data stays in your tenant](#your-data-stays-in-your-tenant), how to deploy it to your organization, and how to drive adoption after rollout.
If you are an individual user who just wants to start using the agent, see [Connect SeekOut to M365 Copilot Agent](/mcp/connect/copilot) instead.
## About the agent
| | |
| ------------------- | --------------------------------------------------------------------------------------------------------------- |
| Agent name | SeekOut (SeekOut Sourcing Agent) |
| Publisher | SeekOut, Inc. |
| Type | External partner agent (declarative agent for Microsoft 365 Copilot) |
| What it connects to | The SeekOut MCP server, over HTTPS |
| Hosting | Runs on Microsoft's model inside Microsoft 365 Copilot. SeekOut hosts no additional tenant-side infrastructure. |
The agent brings SeekOut's talent intelligence into Microsoft 365 Copilot. Recruiters, sourcers, and hiring teams can source candidates across SeekOut's public, GitHub, healthcare, nursing, and academic talent pools plus their own ATS pipeline and internal employees; build shortlists, compare markets, discover companies, retrieve contact information, save candidates to workspaces, export to a connected ATS, and draft outreach.
## Requirements
Each person who uses the agent needs all of the following:
* A **Microsoft 365 Copilot** license.
* An **active SeekOut account**. The agent has no anonymous or trial mode — a user without a SeekOut seat cannot use it.
* Whatever **SeekOut entitlements** the task requires. Every action runs against the user's own SeekOut account and is limited to what that user is already permitted to do in SeekOut.
Two SeekOut features depend on configuration on the SeekOut side rather than anything you do in Microsoft 365:
* **ATS pipeline search and ATS export** require a connected ATS in your SeekOut account.
* **Internal-employee search** requires your organization's employee data to be uploaded to SeekOut.
When one of these is not enabled, the agent says so and continues with what is available. Contact your SeekOut account team to turn either on.
"Capability" is a Microsoft term with a specific meaning for declarative agents — see [Capabilities currently declared](#capabilities-currently-declared). The two SeekOut features above are account configuration, not Microsoft 365 Copilot capabilities.
## Your data stays in your tenant
This is the section to hand to a security reviewer. Every claim below is sourced
to Microsoft's own documentation, not to SeekOut's description of itself, so it
can be verified independently.
The short version: **SeekOut's MCP server has no access to your tenant.** Your
users call out to SeekOut; SeekOut never reaches in.
### Where each part runs
The SeekOut agent is a **declarative agent**, and that architecture is what
answers most security questions about it. Microsoft's model splits it in two:
| Part | Runs | Under whose permissions |
| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| The agent itself — instructions, orchestration, model | Inside Microsoft 365 Copilot. Declarative agents "run on the same orchestrator, foundation models, and trusted AI services that power Microsoft 365 Copilot" and "inherit all data protections provided by Microsoft 365 Copilot" ([Microsoft](https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/overview-declarative-agent)). | The signed-in Microsoft 365 user |
| **Capabilities** — Code Interpreter today, and more over time | Inside Microsoft 365 Copilot. They are Microsoft features the agent declares, not SeekOut code. | The signed-in Microsoft 365 user |
| **The SeekOut action** — the MCP tool calls | SeekOut's servers, reached over HTTPS. App logic "is hosted elsewhere and accessed by the Microsoft 365 host application via HTTPS" ([Microsoft](https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/agents-are-apps)). | The SeekOut account the user signed in to |
Everything in the first two rows stays inside Microsoft's boundary, on
Microsoft's infrastructure, under your user's own permissions. Only the third
row leaves — and it leaves because your user asked it to.
So **capabilities never hand SeekOut anything.** SeekOut does not implement a
capability, does not receive its inputs, and does not see its output. That holds
as the agent declares more of them: a capability extends what Copilot can do for
your user, not what SeekOut can see.
### SeekOut has no access to your Microsoft Entra tenant
SeekOut holds **no Microsoft Entra app registration in your tenant**. The app
package requests no Microsoft Graph permissions, declares no
`webApplicationInfo`, and creates no admin consent to grant — which is why you
will not find a SeekOut enterprise application in your directory.
The only identity SeekOut sees is the **SeekOut account** the user signs in to
over OAuth on first tool use. SeekOut authenticates that user against SeekOut's
own directory and authorizes them with their own SeekOut entitlements. It never
authenticates against, queries, or reads Microsoft Entra ID, and it cannot
enumerate your users, groups, or directory objects.
Grounding on Microsoft 365 content — SharePoint, OneDrive, mail, chats, Copilot
connectors — is a **Microsoft-side** concern under Copilot's own permission
model, in which "Copilot only surfaces organizational data to which individual
users have at least view permissions" and the Semantic Index "honors the user
identity-based access boundary so that the grounding process only accesses
content that the current user is authorized to access"
([Microsoft](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)).
If the agent later declares a knowledge capability, that grounding still happens
inside Copilot under your user's permissions. It does not become a SeekOut data
feed.
### The direction of every call
**SeekOut requests nothing from your tenant.** SeekOut's MCP server has no way
to query, browse, or pull your Microsoft 365 data. It receives only what Copilot
sends it, and it cannot ask for more.
Copilot decides what that is, inside your tenant: "If an agent is needed,
Microsoft 365 Copilot generates a search query to send to the agent on the
user's behalf. The query is based on the user's prompt, Copilot activity
history, and data the user has access to in Microsoft 365"
([Microsoft](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)).
That composition happens entirely within Microsoft's boundary, on your user's
behalf, from data that user is already entitled to. Your data governance, your
user permissions, and your admin controls determine it — nothing on the SeekOut
side does.
| Direction | What moves |
| ------------------------ | ------------------------------------------------------------------------------------------------- |
| **Outbound to SeekOut** | The request Copilot composes for the SeekOut action, plus the arguments for the tool being called |
| **Inbound from SeekOut** | Candidate and market data, scoped to that user's SeekOut entitlements |
| **Never leaves Copilot** | Everything a capability touches, and any Microsoft 365 grounding |
### Verify it yourself
| Claim | Where Microsoft states it |
| --------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| The agent runs on Copilot's own orchestrator and inherits its data protections | [Declarative agents for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/overview-declarative-agent) |
| Agent logic is hosted outside Microsoft 365 and reached over HTTPS — it is not given tenant access | [Microsoft 365 app model for agents](https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/agents-are-apps) |
| Copilot surfaces only data the individual user already has at least view permission to | [Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) |
| Copilot generates the request to an agent on the user's behalf, inside the tenant | [Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) |
| Prompts, responses, and Graph data are not used to train the foundation models | [Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) |
| Tenant isolation is enforced by Microsoft Entra authorization and role-based access control | [Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) |
| Admins can view the permissions and data access an agent requires, plus its terms and privacy statement, before allowing it | [Data, privacy, and security for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) |
| Admins have full control over which agents are allowed, and can block or remove any of them | [Manage agents in the Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-copilot-agents-integrated-apps) |
### What SeekOut does with what you send
The sections above cover your side of the boundary. This is ours — the request
Copilot sends us, and the response we return.
| | |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **In transit** | All traffic between your assistant and SeekOut MCP is encrypted with **TLS 1.2+**. See [Security overview](/mcp/security/overview). |
| **Identity** | Interactive connections act as the signed-in SeekOut user and inherit that user's permissions. There is no shared or tenant-wide identity on our side. See [Authentication](/mcp/security/authentication). |
| **Authorization** | Every tool respects the permissions assigned to that user in SeekOut. A user cannot reach data through the agent that they could not reach by signing in to SeekOut directly. |
| **Rate limiting** | Enforced per user — 1,000 requests per day and 10 per second by default, adjustable per user. See [Usage limits](/mcp/security/usage-limits). |
| **Revoking access** | Remove the agent in Microsoft 365, or have a SeekOut administrator revoke the user's MCP session from the SeekOut admin console. See [Security overview](/mcp/security/overview). |
| **Program and controls** | SeekOut's security program, controls, and compliance posture are documented on the [SeekOut Security](https://www.seekout.com/security/) page. |
| **Processing and retention** | Governed by the [SeekOut privacy policy](https://www.seekout.com/privacy/) and your [terms of use](https://www.seekout.com/terms/), and by your SeekOut agreement where it is more specific. |
Data returned from SeekOut becomes part of the Copilot conversation and is
retained under your Microsoft 365 Copilot settings, so review those alongside
this rollout — the two halves are governed separately, and Microsoft recommends
checking an agent's privacy statement and terms of use before enabling it
([Microsoft](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy)).
## Before you deploy
### Authentication
The agent uses **OAuth 2.0 authorization code flow** against SeekOut. The first time a user invokes a SeekOut tool, Copilot prompts them to sign in to SeekOut and authorize the connection. There is no tenant-wide service credential and no admin consent step in SeekOut — authorization is per user, and each user acts as themselves.
You control who can reach the agent using Microsoft 365 agent management; SeekOut controls what each authorized user can then do, using that user's existing SeekOut permissions.
### Network
The agent calls these SeekOut hosts over TLS on port 443. Allow them if your organization restricts outbound traffic:
| Host | Purpose |
| ------------------------------- | ----------------------------------------------- |
| `seekout-search-mcp.seekout.io` | SeekOut MCP server — all tool calls |
| `app.seekout.io` | SeekOut OAuth authorization and token endpoints |
### Capabilities currently declared
| Capability | What it is used for |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Code Interpreter** | Assembling downloadable reports — for example turning a talent intelligence dashboard into a PDF — from values SeekOut already returned. |
This list will grow. Adding a capability changes what Copilot can do for the user inside Microsoft's boundary; per the table above, it does not widen SeekOut's access. Admins can review the current capability set for the installed version in the Microsoft 365 admin center at any time.
### Usage limits
SeekOut enforces rate limits per user, not per organization. Defaults are 1,000 requests per day and 10 requests per second for each user, and SeekOut can adjust an individual user's limits on request. See [Usage limits](/mcp/security/usage-limits).
## Deploy the agent
Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/) and open the agent management area (**Agents & connectors**). SeekOut appears as an external partner agent.
Check the publisher, description, and permissions against your organization's requirements, using the data-flow and authentication details above. Microsoft's [Manage agents in the Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-copilot-agents-integrated-apps) describes the review, availability, and blocking controls in detail.
Allow the agent for your whole organization, or scope it to the specific users or groups who hold SeekOut seats. Scoping to your recruiting and talent teams is usually the better starting point, because everyone else would be blocked at the SeekOut sign-in step anyway.
Verify that the users you granted access to have both a Microsoft 365 Copilot license and a SeekOut seat. A mismatch is the most common cause of rollout support tickets.
Start with a small group of recruiters. Have each of them complete the first-use SeekOut sign-in and run a real search, so you surface any conditional-access or network issues before a wider release.
Users find and open the agent from the Agent Store in the Microsoft 365 Copilot app. If a user reports that the **Add** button is unavailable, the agent has not yet been allowed for that user in the admin center.
## Drive adoption
Once the agent is available, three things account for most of the difference between a successful rollout and a quiet one.
A regular Microsoft 365 Copilot chat does not use SeekOut on its own. Users must open the SeekOut agent from **Agents → More agents**, or invoke it with `@SeekOut` from another conversation. This is the single most common point of confusion after rollout.
The agent is built for the **Think deeper** response mode. **Auto** can produce unreliable answers. Include this in your rollout note.
Sourcing questions work best when they are specific. Share a few starting points:
Find senior backend engineers in Seattle with Python and distributed systems experience.
Compare the talent market for senior backend engineers across Seattle, Austin, and New York.
Build a talent dashboard for Principal ML Engineers.
For more, see [Prompting patterns](/mcp/capabilities/prompting-patterns) and [Workflows](/mcp/capabilities/workflows).
## Manage access after rollout
* **Remove access for a user or group:** change the agent's availability in the Microsoft 365 admin center.
* **Block the agent for the organization:** block it in the admin center. This stops access at the Microsoft 365 layer.
* **Revoke a SeekOut session:** a SeekOut administrator can revoke a user's MCP session from the SeekOut admin console. See [Security overview](/mcp/security/overview).
* **Remove the SeekOut seat:** without an active SeekOut account, the agent cannot return data for that user, regardless of Microsoft 365 access.
## Troubleshooting
### The Add button for the SeekOut agent is unavailable
The agent has not been allowed for that user. Allow it in the Microsoft 365 admin center, scoped to that user or their group, then have them try again.
### Users can open the agent but every request fails at sign-in
The user does not have an active SeekOut account, or their SeekOut account is disabled. Confirm the seat with your SeekOut account team.
### A SeekOut feature reports that access is not enabled
ATS functions need a connected ATS in your SeekOut account, and internal-employee search needs uploaded employee data. Both are configured on the SeekOut side.
### Answers are unreliable or incorrect
Confirm the user selected **Think deeper** rather than **Auto**.
### Sign-in or tool calls time out
Check that `seekout-search-mcp.seekout.io` and `app.seekout.io` are reachable over TLS on port 443 from your users' network, and that no conditional-access or proxy rule is blocking the OAuth redirect.
For anything else, see [Troubleshooting](/mcp/reference/troubleshooting) and [FAQ](/mcp/reference/faq).
## Get help
Contact SeekOut Support at [support@seekout.com](mailto:support@seekout.com) or your SeekOut account team. Include your organization name, the affected user, and what the agent returned.