Microsoft Copilot Connectors Update: Shared Catalog, New Data Sources and Admin Controls

Microsoft published the roundup on November 11, 2026. Despite its October title, an introductory heading says “September at a glance.” That inconsistency does not establish September availability. The announcement also provides no universal rollout calendar or per-feature eligibility matrix, so administrators should validate availability in their own environment rather than treat the roundup as a deployment receipt.

One catalog, but two different data paths​

Microsoft says connectors now participate in a shared plugin registry, bringing approved connectors, skills and business data into a consistent catalog across the named Copilot experiences. Sign-in, consent, connection management and authentication recovery are intended to work consistently, rather than leaving users to navigate a different integration experience in each application.

For employees, the appeal is straightforward: finding business context should not require remembering which application exposes which source. For administrators, however, a unified catalog should not be mistaken for identical behavior underneath.

Microsoft Learn distinguishes two architectures:

• Synced connectors crawl external content and index it in Microsoft Graph for search and Copilot.
• Federated connectors retrieve information through Model Context Protocol, or MCP, interfaces in real time, without indexing that content into Microsoft 365.

That distinction helps explain the update. Crawl progress and indexed-content troubleshooting concern synchronization; inline authentication recovery and long-running federated tools address a different retrieval path. As an operational recommendation, identify the connector type before troubleshooting. Waiting for a full crawl is not a sensible first response to every missing answer.

Trello, HR research and life sciences join the expansion​

The new sources reach beyond the usual document repositories.

Trello Enterprise receives what Microsoft describes as a production-supported connector for discovering boards, cards and project context through Copilot and Search. Microsoft says results follow the user’s Trello access. This targets project information that otherwise requires a separate visit to a board or card.

Galileo by The Josh Bersin Company brings the provider’s HR research into Copilot. Microsoft positions it for research-backed strategies, policies, presentations and employee communications. The announcement does not specify account requirements or licensing terms, so organizations should establish those before planning an HR-wide deployment.

The largest specialist expansion is more than 25 healthcare and life-sciences connectors, supplied by Microsoft and partners. The announcement names:

• PubMed, ClinicalTrials.gov, bioRxiv, ChEMBL and Open Targets.
• MedlinePlus, RxNorm and Drug Classes, ICD-10, CMS Coverage, CMS NPI Registry, Drug Pricing using CMS/Medicaid data, and FDA Safety through openFDA.
• Article Galaxy, Scite, Consensus, NyquistAI, PopHIVE, SciLeads and Cortellis Regulatory Intelligence.
• smarts.bio, BioRender, Amass, CAS Connections, DrugBank and Sage Bionetworks.

The breadth matters: Microsoft is extending connector coverage across scientific research, clinical information, regulatory material and drug data, rather than merely adding another general-purpose file store. But these are availability and integration claims—not evidence that generated answers are clinically validated, exhaustive or appropriate for consequential decisions without review. The announcement supplies no such validation.

Skills and Tasks address different workflow problems​

Microsoft introduces connector skills as app-specific knowledge that helps Copilot produce useful workflow-oriented responses without requiring elaborate prompts. The roundup identifies Notion and HubSpot as live examples, with more planned. It does not enumerate every supported operation or establish that every skill can modify records.

Separately, Tasks support allows federated connector tools to run for minutes while displaying progress. Microsoft names LexisNexis, Power BI, Fabric, Bloomberg, Wolters Kluwer and Thomson Reuters among the connectors this capability enables. The company describes the implementation as based on the latest MCP specification with backward compatibility, but gives no specification revision or exact runtime ceiling.

The useful distinction is between app-specific assistance and execution time. Skills aim to make an interaction better suited to an application; Tasks accommodate operations that cannot finish almost instantly. Neither announcement alone establishes universal write access or identical capabilities across providers.

For deployment planning, ask what a particular tool actually does, which account authorizes it, and what completion looks like. A progress indicator is welcome, but it is not a substitute for a documented outcome.

Users get more control over grounding​

The update adds four ways to manage source selection and authentication:

These controls are intended to reduce irrelevant context and authentication interruptions without forcing users to abandon the conversation.

A sensible evaluation exercise is to ask the same business question with and without a selected source, then compare the references and omissions. For example, a team could test whether explicitly selecting its knowledge base produces a more focused policy answer. That is a recommended test, not a measured improvement reported by Microsoft.

The key distinction is source control versus answer correctness. Selecting a repository tells Copilot where to look; it does not independently establish that the answer is complete or that the underlying material is current.

Existing connectors receive substantial changes​

Salesforce: broader coverage needs a careful security review​

Microsoft says Salesforce CRM gains custom fields and additional content, including Tasks, Events, Campaigns, Campaign Members, Comments and Attachments. The announcement also highlights field-level security, record-level access controls and PKCE security readiness.

There is an important qualification in Microsoft Learn’s deployment documentation: FLS-restricted fields are excluded from crawling by default. Administrators can opt individual fields into indexing, but Microsoft warns that doing so exposes those fields to Microsoft 365 users who can access the relevant records, regardless of Salesforce’s field-level restrictions. This is not equivalent to reproducing every Salesforce field-permission rule in Copilot. Obtain the Salesforce administrator’s approval before enabling restricted fields.

Microsoft’s troubleshooting guidance adds two practical limits. Newly selected custom fields require at least one completed full crawl before they appear; renamed or deleted fields can be deselected on the next crawl. Salesforce attachments contribute extracted text, not the original downloadable file. Attachment ingestion is capped at 20 MB per record, processed from smaller files upward; remaining attachments receive filename-only indexing once the limit is reached.

These details make useful acceptance tests: verify a newly added field after crawling, inspect the cited record, and check whether an attachment’s contents—not merely its filename—are available.

ServiceNow: longer properties and larger KB attachments​

For ServiceNow tickets, Microsoft removes the former 32-character property-name limit. The connector also gains expanded access-control-list field support and stores system tags as collections, improving how source metadata is represented.

For ServiceNow Knowledge Base, the attachment maximum rises from 20 MB to 64 MB. This is specifically a ServiceNow KB change, not a new universal ceiling for Copilot connectors. Salesforce’s separately documented per-record attachment limit illustrates why administrators should check each connector’s rules independently.

A targeted pilot should therefore include a previously excluded larger KB document and a ticket property that exceeded the old name limit. Confirm successful ingestion before assuming the expanded support has resolved an existing gap.

Confluence: distinguish cloud content from on-premises operations​

Confluence Cloud gains page comments, attachments and attachment metadata. Microsoft also reports more accurate identity matching and improved authentication-refresh reliability, including for organizations with large groups.

For Confluence on-premises, the roundup specifically highlights clearer sign-in and crawl errors, troubleshooting instructions and progress tracking on every full crawl. These are operational improvements; the announcement should not be read as assigning every cloud content addition to the on-premises connector.

For validation, use a page whose important context appears in comments or an attachment, alongside restricted content that an ordinary test account should not discover. Test both retrieval and exclusion—not just whether the connector returns something.

Connection management becomes less disruptive​

Published connections can now be edited rather than deleted and rebuilt, according to Microsoft. The company says this preserves the connection ID and accumulated activity signals, avoiding unnecessary recreation and disruption to agents that depend on that identity.

The timing varies by change:

• Metadata edits save immediately.
• Permission or ACL changes trigger a short ad hoc crawl.
• Other configuration changes can be applied through an immediate crawl or the next scheduled crawl.

The sensible reading is “less destructive configuration management,” not “every change requires no processing.” Microsoft does not enumerate every setting in each category. Before changing a production connection, establish what processing the interface proposes and whether dependent agents need validation.

Administrators also receive organization-specific connector recommendations instead of a fixed list. Improved diagnostics explain failures using information returned by the source and suggest corrective steps. Microsoft says that diagnostic coverage is expanding, rather than claiming every connector already offers identical detail.

Crawl visibility expands beyond initial ingestion: subsequent scheduled full crawls show automatically refreshed progress for items, groups and group memberships. Lifecycle emails cover new Microsoft Graph connector agent releases, upgrade reminders and completion of the first full crawl.

Those changes make a useful operational distinction possible: a crawl can be progressing, failing or complete. A completed crawl, however, should trigger validation—not automatically close the deployment checklist.

A practical rollout and validation sequence​

Treat this roundup as a reason to review existing connections before enabling everything in the catalog. The following sequence is an operational recommendation based on the announced changes and Microsoft’s deployment guidance.

1. Inventory affected connections. Record owners, authentication methods, dependent agents and whether each connection uses synchronization or federation. Prioritize systems where missing fields, attachments or authentication failures already affect users.
2. Verify availability and prerequisites. Confirm the desired connector and features appear in the tenant, then establish source-account and licensing requirements. For Salesforce, Microsoft documents administrator access, an instance URL, OAuth credentials, and an authorizing account with the necessary API and object permissions.
3. Start with a limited audience. Microsoft’s Salesforce deployment path is Copilot > Connectors > Gallery > Salesforce CRM. Its setup supports a limited rollout to selected users and groups. Complete identity mapping before deployment where needed; do not use a broadly privileged administrator account as the sole retrieval test.
4. Define expected results before testing. Choose representative records, custom fields, attachments and restricted items. Write down which accounts should see each item and what evidence would demonstrate success.
5. Validate source selection and authentication. Exercise Source Filter and the available Sources settings. For federated connections, verify that session recovery preserves the interaction as expected. Microsoft announces these controls, but their presence alone does not demonstrate that a particular workflow succeeds.
6. Check ingestion before rewriting prompts. For missing Salesforce custom fields, confirm the field still exists, a full crawl completed after selection, and schema-property limits were not exceeded. These are documented failure points that more elaborate prompting cannot resolve.
7. Recheck dependent agents after edits. Confirm the connection identity remains intact, required processing completes, and representative answers still cite the expected content. Capture failures with the new diagnostic detail rather than recording only “Copilot did not find it.”

The real opportunity: better access with better verification​

Microsoft’s October connector roundup combines wider source coverage with more usable controls over retrieval and connection maintenance. Trello and specialist research sources broaden the available knowledge; Salesforce, ServiceNow and Confluence changes deepen existing integrations; source filtering and administration improvements make that knowledge easier to manage.

The strongest deployment strategy is not to maximize the connector count. It is to establish that the right information reaches the right people, with understandable references and predictable maintenance. Salesforce’s documented field-security behavior is a particularly clear reminder: a reassuring feature label still deserves a configuration review. Connect broadly if the business needs it—but validate precisely.