Connect Copilot Studio to Atlassian MCP v2 in five steps

November 06, 2026

The official Atlassian MCP server at https://mcp.atlassian.com/v2/mcp gives Copilot Studio agents access to Jira, Confluence, Jira Service Management, Bitbucket Cloud, Loom, Goals, Projects, Teams, and Teamwork Graph. Every call runs as the signed-in user with that user’s Atlassian permissions.

The quickest way to connect is the Copilot Studio Add MCP wizard. It takes five steps and needs no files. If you want a connector you can version and deploy across environments, the Atlassian MCP V2 connector covers that later in this post.

Connect in five steps

1. In Copilot Studio, open your agent and go to Tools > Add a tool > New tool > Model Context Protocol.
2. Enter a name such as Atlassian, a description, and the server URL https://mcp.atlassian.com/v2/mcp.
3. For authentication, choose OAuth 2.0 and select Dynamic discovery. If discovery fails, try Dynamic.
4. Select Create, then Create new connection, and sign in to Atlassian. Approve the consent screen for your site.
5. Select Add and configure.

The wizard creates the connector and registers the OAuth client with Atlassian for you. If your Atlassian admin blocks sign-in, see Troubleshooting.

If you work in Microsoft 365 Copilot or Copilot Cowork instead, the Atlassian plugin covers that surface with sixteen skills.

How the server exposes tools

Atlassian doesn’t send its whole tool catalog up front. The server lists a handful of primary tools, such as getJiraIssue, searchJiraIssuesUsingJql, createJiraIssue, getConfluenceContent, and searchConfluence. Everything else is reachable through four meta tools:

Your agent calls discover, then runs the tool it returns. New Atlassian tools show up without any change to the connector.

Some tools, including search, searchAtlassian, and the Teamwork Graph tools, use Rovo credits from your organization’s shared pool. See Rovo usage limits before you enable them for a large group.

Deploy a versioned connector

The connector in the repo is for teams that want to version, share, and deploy the same connector across environments. It has one operation, InvokeMCP, and no script.csx, so Power Platform sends MCP traffic straight to Atlassian and there’s no code to maintain.

Why there’s a registration script

Atlassian has no developer console app for its MCP server. Clients come from dynamic client registration (DCR), where you post your redirect URL to the authorization server and get a client ID back.

Register-AtlassianClient.ps1 reads the registration endpoint from the server’s metadata, posts your callback URL, and prints the client_id. With -Confidential it requests a client secret instead, copies it to your clipboard, and never prints it.

Choose an identity provider

oauth2pkcewithdcr and oauth2pkce are hidden Power Platform identity providers that you can only set in apiProperties.json. They aren’t documented, so test sign-in and token refresh in a non-production environment first.

Deploy with a public client

Run these commands from the connector folder and replace <ENV> with your environment ID or URL.

1. Deploy the connector. Leave [YOUR_CLIENT_ID] and [YOUR_REDIRECT_URL] as they are. Power Platform replaces the redirect URL with the callback URL it generates.

   pac connector create `
       --environment <ENV> `
       --api-definition-file .\apiDefinition.swagger.json `
       --api-properties-file .\apiProperties.json
   

   Don’t pass --script-file. Note the connector ID that PAC returns.

2. Download the deployed connector and read its callback URL.

   pac connector download --environment <ENV> --connector-id <CONNECTOR_ID> --outputDirectory .\deployed
   (Get-Content .\deployed\apiProperties.json -Raw | ConvertFrom-Json).properties.connectionParameters.token.oAuthSettings.redirectUrl
   

   The URL looks like https://global.consent.azure-apim.net/redirect/<your-connector> and is specific to this connector and environment.

3. Register an Atlassian client for that URL.

   .\Register-AtlassianClient.ps1 -RedirectUrl "<CALLBACK_URL>"
   

   Copy the client_id it prints.

4. Put the client ID in a working copy of apiProperties.json and update the connector.

   $props = Join-Path $env:TEMP 'apiProperties.json'
   (Get-Content .\apiProperties.json -Raw).Replace('[YOUR_CLIENT_ID]', '<CLIENT_ID>') | Set-Content $props
   pac connector update `
       --environment <ENV> `
       --connector-id <CONNECTOR_ID> `
       --api-definition-file .\apiDefinition.swagger.json `
       --api-properties-file $props
   

5. Create the connection. In Power Automate, open Custom connectors, edit Atlassian MCP V2, go to the Test tab, select New connection, and sign in to Atlassian. Leave any client secret field blank.

6. Add the connector to your agent. In Copilot Studio, go to Tools > Add a tool > Connector, choose Atlassian MCP V2, and select the connection.

If you change the connector later, delete and recreate any connection made before the change.

Deploy with a client secret

Follow the public client steps with these differences:

• Use apiProperties.oauth2pkce.json in place of apiProperties.json.
• In step 3, run Register-AtlassianClient.ps1 with -Confidential.
• After step 4, open the connector in Power Automate, go to the Security tab, enter the client ID and client secret, and select Update connector. Clear your clipboard afterward.

Set scopes to set limits

Scopes are what the token can do, so they cap the connector no matter what an agent attempts. These settings apply to the versioned connector. The default set is:

For a read-only connector, remove the two write: scopes. To add more, append them to the scopes array in apiProperties.json and to both securityDefinitions.oauth2_auth.scopes and security[0].oauth2_auth in apiDefinition.swagger.json. Then update the connector and recreate your connections.

Leave out delete:jira:agent-interface and manage:jira:agent-interface unless you need them. Atlassian disables those tool groups by default, and an admin must enable them.

Your Atlassian organization admin also controls which tools, scopes, and client domains are allowed under Atlassian Administration > Rovo MCP server.

Tell the agent how the server works

Add instructions that explain the discovery pattern. For example:

Start every Atlassian task by calling getAccessibleAtlassianResources to get the cloudId. If the tool you need isn’t listed, call discover with your goal, then run the tool it returns with executeRead for reads or executeWrite for changes. Confirm with me before any write.

Troubleshooting

Good to know

• Atlassian plans to move v1 callers to v2 tools on March 1, 2027. This connector targets v2 only.
• Gateways that need every tool in one tools/list response use https://mcp.atlassian.com/v2/mcp?tools=all. A connector’s base path can’t carry a query string, so that URL isn’t available here.
• Atlassian records every call in your organization’s audit log.

Resources

• Atlassian MCP V2 source
• Atlassian MCP V2 Copilot plugin
• Atlassian remote MCP server
• PAC CLI introduction