Estratos

Copilot Cowork

Microsoft 365 Copilot (Copilot Cowork) connects to Estratos through the Estratos Memory app package — a declarative Copilot agent wired to the Estratos memory server. The package has passed a real-tenant personal sideload, Estratos sign-in, and authenticated memory retrieval. Until a public listing exists, each adopting organization still needs its Estratos app owner to register a confidential OAuth app in Microsoft 365, store it in OAuthPluginVault, and build with the resulting registration ID.

Availability status: Estratos Memory is not yet listed in the public Microsoft marketplace (AppSource). A licensed Microsoft 365 tenant completed the personal sideload, sign-in, describe_hierarchy, and retrieve flow on 15 July 2026. Organization-wide catalog rollout remains owner/admin-gated and has not yet been completed.

Owner/admin deployment path

  1. The Estratos app owner registers the confidential OAuth app in Microsoft 365 and stores its credentials in OAuthPluginVault. The package references only the resulting registration ID; it never contains the client secret.
  2. The owner builds the tenant-ready package with that registration ID.
  3. In a real tenant, the owner or admin enables custom app upload and sideloads the package for a personal validation run.
  4. Open Estratos Memory, complete Estratos sign-in, and ask a question such as "Describe our memory hierarchy" to verify an authenticated memory-tool call. This personal flow has been proven for the Estratos reference package.
  5. After validating your tenant-specific build, your Microsoft 365 admin can upload the package for organization-wide availability in the Teams admin center under Teams apps → Manage apps → Upload new app.

Copy this page's URL for your admin from the Copilot Cowork card on Connect › Configure agents.

Approve the connection

Once your admin makes the tenant package available, the first question should trigger a Sign in prompt. Sign in to Estratos in the browser window that opens; pick the workspace to connect and click Allow. Copilot should then receive a token scoped to that workspace. End users never enter a client ID, secret, or API key; those credentials stay in OAuthPluginVault, and the install package contains only the vault registration ID. This sign-in and authenticated memory-tool sequence has passed in the Estratos reference tenant.

What installs

The app package installs a Copilot agent wired to the Estratos memory server — the same six memory tools every other agent family uses (describe the hierarchy, retrieve, list, remember, remember tagged, delete), with agent instructions that teach Copilot the scope-path rules. Memory content itself always stays on Estratos.

Rollout

After validating your tenant-specific build, your Microsoft 365 admin can make the agent available to everyone, or pre-install it through app setup policies. Each member's agent will act with that member's Estratos role, so a basic user's writes still queue for review.

Copilot Cowork support is a frontier preview: the package, personal sideload, sign-in, and authenticated memory-read flow are proven in a real licensed tenant. Organization-catalog rollout and the Microsoft marketplace submission remain pending.

If it doesn't connect

See troubleshooting for reconnecting, token expiry, and testing your connection. For protocol-level details, see the MCP reference.