> ## Documentation Index
> Fetch the complete documentation index at: https://developers.techwolf.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Installation
# Installing the TechWolf Analyst Agent in Microsoft 365 Copilot
Installing the Analyst Agent is a **one-time, administrator-gated** action.
Nothing is enabled until an administrator acts: there is no per-user
installation and no end-user self-service. TechWolf provides the agent as an
admin-approved application package; it is not published to the Microsoft
commercial marketplace for individual users to install.
This guide is written for the Microsoft 365 / Teams administrator who performs
the install. It corresponds to the recorded administrator walkthrough below.
A recorded walkthrough of the full installation is available from your
TechWolf contact.
# Required roles
The installation needs two distinct administrator permissions. They are often,
but not always, held by the same person:
* **Teams Administrator** (or an equivalent role with **Manage apps**
permission): uploads the app package and controls which users or groups the
agent is available to.
* **Global Administrator**: grants tenant-wide admin consent from the Teams
admin center. Only this role can; a Teams Administrator sees the required
permissions there but gets *"Contact a Global Administrator to request
consent"* instead of a way to grant them. A **Privileged Role Administrator**
or **Cloud Application Administrator** can grant the same consent, but has to
do it from Microsoft Entra rather than the Teams admin center (see the **Grant
admin consent** step).
* **Customer contact with TechWolf**: a designated representative who shares the
tenant identifier with TechWolf and coordinates the onboarding.
No service principal, standing credential, or per-user secret is provisioned for
this integration.
# What the administrator consents to
The integration requests consent for a **single capability**: verifying the
signed-in user's Microsoft Entra identity, so each message can be tied to a
known user. It needs no access to Microsoft Graph user data, and reads no
directory, mailbox, or file content.
The only identity data that crosses the boundary to TechWolf is the user's
**email address** and **Entra tenant identifier**.
The install grants a **delivery surface, not new data access**. A user who
reaches the agent through Copilot still sees only the data their existing
TechWolf scope permits. See [How It Works](./how-it-works) for the identity
and access model.
# Installation steps
The installation consists of the following steps. TechWolf first binds your
tenant to the correct region, you grant your users access to the agent in the
TechWolf Console, your administrator uploads the app package in the Teams admin
center, an administrator grants consent once for the whole tenant, and only
then do you decide who gets the agent.
Provide your **Microsoft Entra tenant identifier** to TechWolf. TechWolf
registers it against the correct regional backend, which pins every
Copilot turn from your tenant to that region. This is configured once,
at onboarding. Follow [Find your Microsoft Entra tenant
ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant)
if you need to locate it.
A tenant that has not been onboarded is rejected, never defaulted to
another tenant. Until this step is complete, users in your tenant
cannot reach the agent.
A user can only reach the agent if they have been granted access to it in
the TechWolf Console. Do this for every intended user before they use the
agent from Copilot; a user without the agent role sees a no-access
message.
In the TechWolf Console, go to **User Management**. Use **Add users** to
add a new user, or **Edit users** to update an existing one.
Assign the user their roles. The **Data Foundation** roles determine
which data the user, and so the agent on their behalf, is allowed to see.
Under **TechWolf Agent**, set **Roles** to **Viewer** to grant access to
the agent, then select **Add**.
In the [Teams admin center](https://admin.teams.microsoft.com/), go to
**Teams apps** -> **Manage apps**. Open the **Actions** menu in the top
right and choose **Upload new app**, then **Upload a custom app**.
Select the app package (`.zip`) you received from TechWolf.
The upload takes a moment and shows no progress indicator; give it ten
seconds or so.
You may see an error even though the upload succeeded. Refresh the
page to check before retrying: the app usually appears in the list
after a refresh.
After refreshing, search for **TechWolf Analyst Agent** by name in
**Manage apps** to confirm the upload went through.
Open the app and check the **About** tab. It shows the publisher
(TechWolf) and the uploaded version, so you can confirm you have the
package TechWolf provided.
The agent verifies each user's Entra identity, and that verification
needs tenant-wide admin consent. It is a separate action from the upload
above and needs one of the Entra roles listed at the top of this page,
so it may well be a different person.
A **Global Administrator** does this on the app you just uploaded, in
the same Teams admin center. Open **Teams apps** → **Manage apps**,
search for the agent by name, open it, and go to its **Permissions**
tab. Review the permissions in the dialog that opens, then select
**Accept**.
The tab lists exactly what is being granted: three delegated Entra ID
permissions, `openid` (sign users in), `email` (view users' email
address) and `profile` (view users' basic profile). That is enough to
confirm who the signed-in user is, and nothing more. See [What the
administrator consents to](#what-the-administrator-consents-to) above.
When it is done, the tab shows **Admin consent granted for all required
permissions**, which is also how you check it later. Consent covers the
whole tenant, so it is granted once and applies to every user, never per
person, and revoking it stops the agent for everyone.
**If the person granting consent is not a Global Administrator**, a
Privileged Role Administrator or Cloud Application Administrator can
grant the same consent from Microsoft Entra instead. Open the
consent URL below, signed in as that administrator, and accept:
```
https://login.microsoftonline.com//adminconsent?client_id=67e0fd02-01f0-4752-8776-7a3feb0428ec
```
Substitute the tenant ID you shared in step 1. Putting it in the URL
rather than using `organizations` is deliberate: it pins the grant to
the tenant you are setting up, instead of whichever tenant the
signed-in account happens to belong to.
Two things to expect. The browser lands on a
`token.botframework.com` page reporting a missing `code` parameter;
that is the redirect target being an API rather than a web page, and
the grant has already been recorded by then. Check for
`admin_consent=True` and your own tenant ID in the address bar to
confirm. Afterwards the application appears under **Enterprise
applications**, where the grant can be reviewed or revoked.
The **Enterprise applications** pane cannot be used to grant it the
first time: an application only appears there once it is provisioned
in your tenant, which this consent is what does.
Grant this **before** assigning users in the next step. Your users
cannot grant it themselves, so anyone who reaches the agent first
gets *"you need to agree to additional permissions"* followed by
*"Something went wrong. Please try again."*, and that prompt never
completes no matter how often it is retried.
Decide which users or groups get the agent, using the tenant's standard
app-assignment controls, the same mechanism as any other Teams
application. The integration grants no access on its own.
The same **Users and groups** controls govern two things: the agent's
**availability** (which users or groups can find and add it themselves)
and its **installation** (installing it for them directly). You can make
the agent available for users to add on their own, install it for
specific users or groups, or both.
The steps below install it directly. On the app page, open **Users and
groups** and choose **Install app**.
Set **Install** to **Specific users or groups**, then add the people or
groups that should have the agent by name.
Apply the change. The agent is now installed for the selected users, and
only the users you add here get it: access stays under your control.
Once assigned, users find the agent in Microsoft 365 Copilot under
**Agents**. See [How It Looks](./how-it-looks) for the end-user
experience.
If anything in this documentation does not match your experience or needs
clarification, contact us at [support@techwolf.ai](mailto:support@techwolf.ai).
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.