MCP is no longer experimental. Microsoft has published an official MCP server catalog and Copilot Studio now supports MCP tools natively. This significantly expands both the capability and the attack surface of enterprise agents.
Microsoft publishes a formal catalog of official MCP server implementations at github.com/microsoft/mcp. These include servers for Azure, GitHub, SharePoint, Teams, Outlook, SQL Server, and more. Copilot Studio agents can now use MCP tools directly — each tool added extends the agent's action surface to everything that MCP server can reach. The security implications scale with the permissions of the MCP server's connected services.
MCP defines how AI agents discover, connect to, and invoke tools, data sources, and services across a standard protocol. With Microsoft's official server catalog, MCP is now enterprise infrastructure — not a prototype technology.
When a Copilot Studio agent is configured with MCP tools, the agent authenticates to those MCP servers using maker credentials by default. This means:
| Attack | How It Works | Impact | Primary Control |
|---|---|---|---|
| Tool Poisoning | Malicious MCP server returns poisoned tool descriptions. Agent reads descriptions to decide which tool to invoke — poisoned descriptions redirect agent to attacker-controlled tools. | CRITICAL Full agent hijack | Foundry Guardrails (whitelist); Defender for Cloud Apps (MCP server governance) |
| MCP Server Impersonation | Attacker substitutes a malicious MCP server (DNS hijack, supply chain, local server swap). Agent connects to attacker's server and receives malicious tool outputs. | CRITICAL Data exfiltration, action hijack | Defender for Cloud Apps (MCP server registry); no cryptographic binding standard in MCP spec |
| Indirect Prompt Injection via MCP | Malicious instructions embedded in data returned by an MCP tool. Agent treats the embedded text as legitimate instruction and acts on it using maker credentials. | CRITICAL Data exfiltration, lateral movement | Prompt Shields (XPIA detection); Entra Internet Access Prompt Injection Protection (GA Mar 31) |
| OAuth Scope Abuse | Agent inherits overly broad OAuth scopes from maker credentials when connecting to MCP-backed SaaS. Broad token enables lateral movement across multiple services. | HIGH Lateral movement across SaaS | Defender for Cloud Apps OAuth governance; enforce end-user auth per agent |
| Unauthenticated MCP Server | Many community MCP servers have no authentication. Any agent or attacker on the network can call them without credentials. | HIGH Unauthorised tool execution | Network segmentation; Entra Internet Access; security review of MCP server implementations |
| MCP Supply Chain Attack | Malicious package in MCP server registry. Enterprise deploys a compromised MCP server — attacker gains persistent access to the agent's tool layer. | HIGH Persistent backdoor in agent tooling | Defender for Cloud (supply chain scanning); Security Dashboard AI Inventory; GitHub Advanced Security |
| Unreviewed MCP Tool in Copilot Studio | Developer adds a community MCP server to a Copilot Studio agent without security review. Agent runs with maker credentials against unvetted tool surface. | HIGH Uncontrolled action surface | "MCP Tool Configured" Advanced Hunting query; enforce MCP tool lifecycle reviews |
The MCP specification (as of early 2026) does not mandate strong cryptographic authentication for MCP server-to-client binding. Microsoft's official MCP catalog servers use standard OAuth where supported, but third-party and community servers vary widely. There is no platform-enforced way to guarantee the MCP server an agent connects to is the legitimate, unmodified server it expects. This requires defence-in-depth at the network, CASB, and orchestration layers — no single product closes it.
| Layer | What It Covers | Microsoft Control | Status |
|---|---|---|---|
| Catalog governance | Vetting which MCP servers are approved for use; lifecycle reviews | Internal policy + "MCP Tool Configured" Advanced Hunting query | Process control — no product enforcement |
| Network | Control which MCP servers agents can reach; block malicious prompts | Entra Internet Access | GA Mar 31 |
| Identity | Authenticate which agents can invoke which MCP tools; prevent maker credential blast radius | Enforce end-user auth (Power Platform admin) | Available now |
| Orchestration | Whitelist allowed tools per agent (Foundry only) | Foundry Guardrails | Preview · Foundry only |
| Content Inspection | Detect adversarial instructions in MCP tool outputs | Prompt Shields | GA |
| Runtime Protection | Block tool invocations during suspicious Copilot Studio agent activity | Defender for Cloud Apps real-time protection | Preview · Copilot Studio only |
| SaaS Governance | OAuth scope governance; anomalous API usage detection | Defender for Cloud Apps | GA |
| Inventory & Posture | Discover all MCP servers; assess risk | Security Dashboard for AI | Now GA |
| Investigation | NL querying of MCP entity relationships in Sentinel | Sentinel MCP Entity Analyzer | GA April |