Tip
If you are building a custom app or a custom engine agent and you keep hitting the same wall — “how do I let AI answer from our SharePoint, OneDrive and Teams content without copying all that data somewhere else?” — the Microsoft 365 Copilot APIs are what you are looking for. They let you tap the same retrieval and search machinery that powers Microsoft 365 Copilot, from your own code, while honouring existing permissions and sensitivity labels.
As of the official documentation (updated July 2026), some of these APIs are generally available and others are in preview. Always check the current status on Microsoft Learn before shipping to production.
What are the Microsoft 365 Copilot APIs?
Instead of building a full AI stack from scratch and extracting sensitive data into an external index, the Copilot APIs give you production-ready building blocks that work directly with your Microsoft 365 data — and respect document access controls and sensitivity labels while doing it.
The two you’ll reach for most often:
| API | Use it to | Example scenario |
|---|---|---|
| Retrieval API | Pull relevant chunks of Microsoft 365 content in a secure, compliant way | Connect your own model to org content without copying data out — answers stay grounded in up-to-date policies and docs |
| Search API | Run hybrid (semantic + lexical) search over OneDrive/SharePoint content using natural-language queries | A “find that document” experience in your own app that understands intent, not just keywords |
The big idea: your data never leaves the Microsoft 365 compliance boundary. You bring the model or the app experience; Microsoft handles secure, permission-trimmed grounding.
Why this matters for M365 developers
- No data extraction — you don’t copy content into a separate vector store, so you avoid a second copy to secure, govern and keep in sync.
- Permission-trimmed by default — results respect who can see what, plus sensitivity labels.
- Bring your own model/orchestrator — great for custom engine agents where you want control over the reasoning layer but still want enterprise-grounded answers.
Try it before you write code
You don’t have to scaffold a project just to see what the responses look like. Microsoft provides an Interactive Demo where you can fire live API requests against your own Microsoft 365 data and inspect the responses:
This is the fastest way to decide whether the Retrieval API or the Search API fits your scenario.
By accessing or using the Microsoft 365 Copilot APIs you agree to Microsoft’s API Terms of Use. Review licensing and cost considerations before building — grounding on Copilot infrastructure has commercial terms attached.
A sensible starting point
- Pick the API for the job — Retrieval API if you’re grounding your own model; Search API if you want a smart search experience over M365 content.
- Prototype in the Interactive Demo — validate that permission trimming returns what you expect for a test user.
- Read the licensing guidance — confirm the cost model works for your rollout.
- Wire it into a custom engine agent or app — start narrow (one content source, one scenario) and expand.
References
- Microsoft 365 Copilot APIs overview
- Microsoft 365 Copilot extensibility documentation
- Agents overview
- Interactive Demo (preview)
Building something with the Copilot APIs? I’d love to hear which scenario you’re tackling — drop a comment below.
Image Prompt
1
2
3
4
5
6
Clean flat 2D digital graphic, wide banner 16:9 aspect ratio.
Scene: a secure vault at the centre linked by clean API lines to a small app window, permission-gated document cards passing through a shield checkpoint into the app. Front-on view, simple geometric shapes.
Colour palette: soft blue (#4C8DFF), warm amber (#FFB454), on a dark charcoal background (#1E2128).
Style: minimal modern flat design, smooth solid colour shapes, crisp geometric edges, no outlines, no gradients, no shadows, no 3D, no hand-drawn or sketchy look.
Mood: secure, trustworthy, modern.
No text. No logos.