AI-powered operations command center for Managed Service Providers — built with Microsoft Copilot Studio
Agents League Hackathon — Enterprise Agents Battle | June 2026
One Copilot Studio agent that helps a single MSP engineer safely run 20+ SEC/FINRA-regulated financial firms. It switches client context instantly, intercepts irreversible compliance mistakes before they happen, and orchestrates the engineer's whole day — all grounded in real Microsoft 365 data via Work IQ, with zero general-knowledge hallucination.
- 🛡️ Prevents one-click compliance violations — catches a FINRA account-deletion request and steers it to the safe, audit-friendly path.
- ⏱️ Removes repetitive cross-tenant lookup — instant client context + automated morning triage replace manual digging across many clients.
- 📅 Calendar-aware, ticket-grounded — Work IQ Calendar and SharePoint knowledge make the day plan real, not generic.
- ✅ Honest by design — every answer is grounded in verified data; nothing is claimed that the agent does not actually do.
- 🎬 Teams Demo: MSP Operations Commander – Teams Demo
- 🎬 Copilot Studio Demo: MSP Operations Commander – Copilot Studio Demo
For privacy, the demos use fictional client and ticket data. No real client names, contacts, tickets, domains, tenant details, or sensitive information are shown.
Note on demo names: All client names used in the demo videos, screenshots, and this repository (e.g., "Contoso Capital Advisors") are fictional placeholders created for demonstration only. Any resemblance to real organizations is coincidental. No real client, employer, or tenant data is used anywhere in this project.
Personal project disclaimer: This is an independent personal project, designed and built by the author for this hackathon in his own Microsoft 365 environment. It is not an official product, service, or endorsement of the author's employer, and it does not include or expose any employer or client data, systems, or credentials.
- 🎬 Teams Demo Video
- 🎬 Copilot Studio Demo Video
- 🧩 Setup Guide (docs/SETUP.md)
- 🤝 Contributing & Transparency
- 📄 License (MIT)
- Microsoft IQ Integration
- Requirements Met
- The Problem
- The Solution
- Real-World Impact
- Architecture
- Key Features
- Screenshots
- How It Works / Setup
- Security & Compliance
- Responsible AI
- Client Coverage (Demo)
- Tech Stack
- About the Builder
- Judging Criteria Alignment
This agent integrates Microsoft Work IQ — the intelligence layer behind organizational knowledge that builds memory from emails, meetings, chats, and documents to understand work context, people, and relationships. The agent has three Work IQ tools enabled: Work IQ Calendar (calendar and scheduling context) and Work IQ SharePoint (organizational knowledge grounding) are actively used in the agent's workflows and shown in the demos, and Work IQ Mail is enabled and available for email context.
By grounding the agent in real Microsoft 365 work context — rather than general model knowledge alone — Work IQ satisfies the Enterprise Agents Microsoft IQ requirement and enables a Retrieval-Augmented Generation (RAG) pattern: every answer is grounded in verified enterprise data (SharePoint Client Profiles, Ticket Log) and respects Microsoft 365 permissions.
| Enterprise Agents Requirement | Status | Where to See It |
|---|---|---|
| Microsoft 365 Copilot Chat agent | ✅ Met | Agent published to Microsoft 365 Copilot and Microsoft Teams channels |
| Microsoft IQ integration (Work IQ / Foundry IQ / Fabric IQ / Web IQ) | ✅ Met | Work IQ Calendar and SharePoint actively used; Work IQ Mail enabled (see Microsoft IQ Integration section) |
| Grounded intelligence (RAG) | ✅ Met | SharePoint Client Profiles + Ticket Log used for retrieval; general knowledge disabled |
| Clear agent architecture | ✅ Met | Architecture diagram + workflow tables below |
| Enterprise security & Responsible AI | ✅ Met | See Security & Compliance and Responsible AI sections |
| Public GitHub repository | ✅ Met | This repository |
| Architecture diagram | ✅ Met | MSP_Operations_Commander.png (see Architecture section) |
| Demo videos (YouTube) | ✅ Met | Teams Demo and Copilot Studio Demo |
| Project description | ✅ Met | This README |
| Original work | ✅ Met | Personal Copilot Studio agent built by the author for this hackathon |
Managed Service Providers (MSPs) juggle dozens of client environments simultaneously. Each client has unique compliance requirements, security policies, third-party integrations, and IT configurations. Engineers waste hours context-switching between clients, looking up policies, and manually checking compliance before taking action.
The MSP Operations Commander transforms a Copilot Studio agent into an intelligent operations hub that:
- Switches client context instantly — Say "Working on Contoso Capital Advisors" and the agent loads that client's full environment profile, contacts, compliance rules, and ticket history
- Guards compliance automatically — Before risky actions (offboarding, CA changes, license removal), the agent checks client-specific compliance rules and warns the engineer
- Runs morning-to-evening orchestration — Morning triage builds a prioritized, calendar-aware day plan; evening review summarizes completed work, flags compliance actions, and previews tomorrow
- Learns from ticket history — Cross-references past tickets to identify recurring issues and recommend proven solutions
This is not a throwaway demo — it is a production-minded solution built by a working MSP engineer to solve a daily, real-world operational problem.
- Built from real-world experience. The author works as an MSP engineer supporting 20+ financial advisory and wealth management firms on Microsoft 365. The workflows are modeled on common, real-world MSP onboarding, offboarding, compliance, and triage patterns — recreated here with fictional demo data, using no real client or employer data.
- Prevents costly mistakes. In SEC/FINRA-regulated environments, a single wrong action (deleting an account that must be retained, changing an archived-mailbox policy) can create a compliance violation. The Compliance Guard intercepts these before they happen.
- Saves engineer time every day. Instant client context switching and automated morning triage remove the repetitive lookup work that slows a solo MSP engineer down across many tenants.
- Realistically adoptable. It runs entirely inside the MSP's own Microsoft 365 tenant, requires no client tenant access, and uses only structured SharePoint data — so any MSP could stand it up with the included setup guide.
Click the diagram to open it full size.
The MSP Operations Commander is built as a Microsoft Copilot Studio agent with four custom workflows connected to structured knowledge sources and Microsoft Work IQ.
| Layer | Component | Purpose |
|---|---|---|
| Agent | MSP Operations Commander (my own Copilot Studio agent) | Main Copilot Studio agent used by the MSP engineer |
| Workflow | Client Context Switcher | Loads active client profile, compliance notes, special instructions, and ticket history |
| Workflow | Compliance Guard | Checks risky IT actions against client-specific compliance rules |
| Workflow | Morning MSP Triage | Builds a structured day plan using active ticket history, priority, client impact, compliance risk, and calendar context |
| Workflow | Evening MSP Review | Summarizes completed work, pending items, compliance-sensitive actions, follow-ups, and tomorrow’s priorities |
| Knowledge Source | Client Profiles | SharePoint list containing client environment and compliance context |
| Knowledge Source | Ticket Log | SharePoint list containing structured ticket history |
| Integration | Work IQ Calendar | Calendar and scheduling context (actively used) |
| Integration | Work IQ SharePoint | Organizational knowledge grounding (actively used) |
| Integration | Work IQ Mail | Email context (enabled and available) |
| Input | Agent Workflow | Knowledge / Tool Used | Output |
|---|---|---|---|
Working on Contoso Capital Advisors |
Client Context Switcher | Client Profiles + Ticket Log | Active client context loaded |
Can I delete an offboarded user account? |
Compliance Guard | Client Profiles + Ticket Log | Safe compliance guidance |
Start my day |
Morning MSP Triage | Ticket Log + Client Profiles + Work IQ Calendar | Calendar-aware, prioritized MSP day plan |
End my day |
Evening MSP Review | Ticket Log + Client Profiles + Work IQ Calendar | Calendar-aware end-of-day operations summary |
| Trigger | What Happens |
|---|---|
| "Working on Contoso Capital Advisors" | Loads full client profile: contacts, environment, compliance rules, tools, and past tickets |
| "Switch to <client>" | Instantly switches context to a different client |
- Uses
Global.ClientNamevariable accessible across all topics - Pulls verified data from SharePoint Client Profiles list
- No client tenant connection needed — all data lives in the MSP's own tenant
| Action | Agent Response |
|---|---|
| "Can I delete this user account?" | Checks client compliance notes → Contoso Capital Advisors: "FINRA registered. Do NOT delete. Disable, convert mailbox to shared, remove license. Global Relay archiving required." |
| "Change Conditional Access policy" | Checks CA notes → "Document all changes per client compliance policy." |
- Validates every risky action against client-specific rules
- Returns: Verdict, reasoning, required approval, safe steps, and client-specific warnings
- Prevents compliance violations before they happen
Trigger: Start my day
Returns a structured day plan:
- Active critical or urgent items
- High-priority tickets
- Waiting client responses
- Calendar-aware day plan (reads the engineer's calendar via Work IQ Calendar)
- Compliance flags for active clients
- Recommended first action
Trigger: End my day
Returns an end-of-day summary:
- Completed work
- Pending or unresolved items
- Compliance actions taken today
- Follow-ups needed
- Tomorrow preview (calendar-aware via Work IQ Calendar)
- End-of-day summary paragraph
Type "Working on <client>" and the agent instantly loads that client's full profile, compliance rules, and ticket history.
Before any risky action, the agent checks client-specific compliance rules and returns a safe verdict with reasoning.
"Start my day" builds a prioritized, calendar-aware day plan across all active clients and tickets.
The agent runs entirely inside the MSP's own Microsoft 365 tenant — no client tenant access is required. A full step-by-step setup guide (including SharePoint list schemas) is available in docs/SETUP.md.
Quick overview:
- Create the Copilot Studio agent — A single agent in Microsoft Copilot Studio with general knowledge disabled so responses stay grounded in verified data.
- Build two SharePoint lists as structured knowledge sources:
- Client Profiles — one row per client (name, contacts, environment, compliance notes, special instructions, tools).
- Ticket Log — structured ticket history (ticket number, client, subject, priority, status, resolution).
- Add the four custom topics / workflows — Client Context Switcher, Compliance Guard, Morning MSP Triage, and Evening MSP Review, each triggered by natural-language phrases.
- Enable Microsoft Work IQ — Turn on Work IQ Calendar and Work IQ SharePoint (actively used by the workflows) and Work IQ Mail (enabled for email context) so the agent can use calendar, people, organizational document, and mail context.
- Publish — Publish the agent to the Microsoft 365 Copilot and Microsoft Teams channels.
The public demo uses fictional client and ticket data only. No real client data, tenant details, or secrets are included in this repository.
- No client tenant access required — All data stored in the MSP's own SharePoint
- No secrets in this repo — Credentials, tokens, and tenant IDs are never committed (see
.gitignore) - FINRA/SEC compliance aware — Built for regulated financial advisory firms
- Email archiving awareness — Knows which clients use Global Relay, Redtail, or Smarsh
- Account retention rules — Prevents accidental deletion of accounts that must be retained
- No AI hallucination — General knowledge disabled; agent uses only verified SharePoint data
- Permission-aware retrieval — Work IQ and SharePoint grounding honor existing Microsoft 365 permissions; the agent only surfaces data the signed-in user is authorized to see
This agent is designed for a sensitive, regulated domain (financial advisory firms under SEC and FINRA oversight), so responsible-AI principles are built into its core behavior:
- Grounded, not guessed. General model knowledge is disabled. Every answer is grounded in verified SharePoint data (Client Profiles, Ticket Log), following a RAG pattern to minimize hallucination.
- Human stays in control. For high-impact actions (offboarding, account deletion, license removal, Conditional Access changes), the agent advises and recommends safe steps — it does not silently execute irreversible changes. The engineer remains the decision-maker.
- Clear boundaries for risky actions. The Compliance Guard enforces explicit, client-specific rules before sensitive operations, reflecting Microsoft's guidance to define clear boundaries for agent actions in sensitive domains like finance.
- Permission-respecting. Retrieval honors Microsoft 365 access controls; the agent cannot surface data the user is not entitled to.
- Transparency. Responses cite which client rule or ticket history drove a recommendation, so engineers can verify the reasoning rather than trust a black box.
- Privacy by design. The public repository and demo use only fictional data. No real client information, credentials, or tenant identifiers are exposed.
The demo uses a single fictional placeholder client. It does not represent a real client or any real organization, and any resemblance to an actual company is coincidental.
| Client | Industry | Environment | Compliance |
|---|---|---|---|
| Contoso Capital Advisors | Wealth Management | Full Cloud | FINRA registered; no account deletion; Global Relay archiving; document all CA changes |
- Microsoft Copilot Studio — Agent builder with custom topics and generative AI
- Claude Opus 4.8 — Underlying model powering the agent
- SharePoint Online — Client Profiles list + Ticket Log list as structured knowledge sources
- Microsoft Work IQ — Work IQ Calendar and Work IQ SharePoint (actively used) plus Work IQ Mail (enabled) for calendar, people, organizational, and mail context
- Microsoft Teams — Primary agent channel
Adel Alkhatib — Cloud System Engineer at InhouseCIO, LLC
- Works as an MSP engineer supporting 20+ financial advisory firm clients across Microsoft 365 environments
- Works remotely supporting US-based clients
- Built this agent independently for the Agents League Hackathon, inspired by his own daily operational challenges as a solo MSP engineer
- Connect on LinkedIn
This project is a personal, independent work and is not affiliated with, endorsed by, or sponsored by his employer.
| Criteria (Weight) | How This Agent Delivers |
|---|---|
| Accuracy & Relevance (20%) | Uses only verified SharePoint data, no hallucination, client-specific responses |
| Reasoning & Multi-step (20%) | Compliance Guard validates actions against multiple data points; Morning Triage cross-references tickets, clients, calendar, and compliance |
| Reliability & Safety (20%) | Compliance-first design for SEC/FINRA regulated firms; prevents account deletion, enforces retention policies; Responsible AI guardrails keep a human in control |
| Creativity & Originality (15%) | Multi-tenant MSP context switching is unique — no other entry manages multiple client environments this way |
| UX & Presentation (15%) | Natural language triggers, structured outputs, morning-to-evening workflow orchestration |
| Community Vote (10%) | Public-facing, easy-to-grasp demo with a compelling compliance-safety story designed to resonate in the Discord community poll |
Built for the Agents League Hackathon — Enterprise Agents Battle, June 2026