What it does

The Service app packages Service Agent and Customer Service plugins for supported Copilot experiences, and you manage it as a single app in the Microsoft 365 admin center: install it, choose who gets it, restrict it, block it or remove it. Installing it doesn't prove Chat or Cowork is switched on for the people you assign it to.

Key facts

• Deployment is managed at app level. There's no separate targeting for individual Service components, and removing Service can affect more than one experience.
• Installing from Microsoft Marketplace needs permissions equivalent to the tenant administrator and a paid licence for the capabilities. Check the entry is named Service and published by Microsoft Corporation. It might already be installed, so look in Agents > All agents > Registry first.
• Four controls are separate and none grants another: Microsoft 365 administrator roles, Service app assignment and Entra groups, Dynamics 365 security roles and data access, and host access, licensing and billing.
• Two scopes live on the Users tab: Installed to (preinstallation) and Available to (who can install or use it). They're independent. Preinstallation can include users outside the availability scope, and organisation-wide installation can override a limited scope.
• Block prevents installation and use and removes the app from users who already have it. Uninstall removes the shared package but doesn't delete Dynamics 365 records, remove host licences or reverse completed actions.
• Adding Microsoft Copilot to a Customer Service environment is a separate in-app Service Agent configuration task.
• Customer Service MCP configuration and data access are coordinated with the Dynamics 365 administrator.

When to use / skip

Use it for any tenant rolling out Service Agent or the Customer Service skills in Copilot Cowork. It's the control point for who is in the pilot cohort.

Skip it as a way to grant data access. Assigning the app gives nobody records; and giving someone an admin role to make the plugin appear is the wrong fix.

Configuration decisions

• Cohort. Decide the pilot users or Entra group before installing, because the default install scope may not match a limited rollout.
• Both scopes, aligned. For a restricted rollout set Installed to and Available to to the same cohort. Setting only one leaves a gap.
• Host policy and billing. Confirm licences and the organisational spending policy for the host, and check where service data will be processed.
• Admin role design. Use the least-privileged verified role per task, and limit the duration of elevated access.

Gotchas

• Changing only Available to doesn't narrow a broader deployment. Excluded users who still have access usually have a previous or organisation-wide installation.
• Overlapping Entra group membership is the first thing to check when access is unexpected.
• A read-only role isn't enough to install or consent. Failures there usually trace to the Marketplace role requirement.
• If the host opens but records or tools are missing, the cause is the account, environment, mapped Dynamics 365 privileges or MCP configuration. Not a missing Microsoft 365 admin role.
• Test with the user's ordinary account. The admin seat hides every consent and permission problem the pilot users will meet.
• Service information can leave the Dynamics 365 compliance or geographic boundary when another experience processes it, and external services can add cost. Read the destination terms first.

Consultant notes

• The tenant admin and the Customer Service admin are usually different people. Get both in the room before the install, since one holds the Marketplace rights and the other the MCP and data decisions.
• Build the pilot cohort as an Entra group and use it for both scopes. It makes "who has this?" answerable in one place and makes withdrawal a group change.
• Put an excluded-user test in UAT. Checking that the right people have access is only half of it; the group that should not have it is where mistakes appear.
• Warn service owners before any uninstall. It hits the shared package, not one skill or host, and people find out when their agent stops working.

---

Admin steps move with the Microsoft 365 admin center agent registry — worth revisiting after its next update.