The Microsoft 365 Copilot Retrieval API gives developers a direct path to retrieval-augmented generation on organizational content — no chunking pipeline, no vector store, no sync job — by exposing the semantic index Microsoft 365 already maintains for Copilot across SharePoint, OneDrive, and connector content. This post covers the complete request and response shape, the delegated-only auth constraint that rules out daemon integrations, the 200-request-per-user-per-hour rate limit strategy, and a clear decision boundary between the Retrieval API and the beta Search API.
Copilot APIs
Microsoft 365 Copilot API Auth, Permissions, and Production Readiness: The Foundation Before You Build
Most developers hit a 403 on their first Copilot API call — not because of a misconfiguration, but because the Retrieval and Search APIs are delegated-only by design. This post maps the auth model, exact permission scopes per API surface, app registration choices, and SDK options into a single decision-support guide you can work through before writing your first integration call.
Microsoft 365 Copilot APIs: What They Are, Why They Exist, and When to Use Them
Microsoft 365 Copilot APIs expose AI reasoning capabilities directly through Microsoft Graph, with your tenant's security and compliance controls inherited at the API layer. This post maps the eight API surfaces in the series, makes the GA-versus-preview boundaries explicit, and establishes the licensing prerequisites — before you evaluate a single endpoint.