Create an Azure connection to an Edge or Collibra Cloud site

Prerequisites

In your Collibra environment

• You either created and installed an Edge site or were granted a Collibra Cloud site.
  Note 

  If you have defined an outbound (forward) proxy on your Edge site, the integration will take that configuration into account when connecting to the AI platform. The following proxies are supported, using either a HTTP or HTTPS proxy URL:

  • Pass through (No authentication)
  • Pass through (Basic authentication)
  • No proxy for noProxy hosts defined by Edge
  • Man-in-the-middle (MITM)
If you want to add connection values from a vault, you have added the vault to your Edge site. If your data source connection requires a file from your vault, the file must be encoded into Base64 and stored as a regular secret in your vault. For more information, go to the Vault documentation.
Note  Vaults are not supported on Collibra Cloud sites.
• You have a global role that has the Manage connections and capabilities global permission, for example, Edge integration engineer.
• To integrate Microsoft Copilot Studio or Microsoft Agent Builder assets, you need Collibra version 2026.09 or newer.

In your Azure AI environment

To integrate Azure AI Foundry assets, ensure the following

• You registered your Azure application.
• You created a secret for your Azure application.
• You created a custom role with the following Azure AI Foundry permissions:
  • Microsoft.MachineLearningServices/workspaces/serverlessEndpoints/read
  • Microsoft.MachineLearningServices/workspaces/onlineEndpoints/read
  • Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments/read
  • Microsoft.MachineLearningServices/workspaces/read
  • Microsoft.MachineLearningServices/workspaces/connections/read
  • Microsoft.MachineLearningServices/workspaces/*/read
  • Microsoft.Insights/Metrics/Read
  • Microsoft.Insights/Logs/Read
  • Microsoft.CognitiveServices/accounts/deployments/read
  • Microsoft.CognitiveServices/accounts/models/read
  • Microsoft.CognitiveServices/accounts/OpenAI/assistants/read
  • Microsoft.CognitiveServices/accounts/OpenAI/assistants/files/read
  • Microsoft.CognitiveServices/accounts/OpenAI/assistants/vector_stores/read
  • Microsoft.CognitiveServices/accounts/OpenAI/assistants/vector_stores/files/read
  • Microsoft.CognitiveServices/accounts/OpenAI/files/read
  • Microsoft.CognitiveServices/accounts/OpenAI/fine-tunes/read
  • Microsoft.CognitiveServices/accounts/OpenAI/1p-jobs/read
  • Microsoft.CognitiveServices/accounts/OpenAI/*/read
• You assigned your custom role to your Azure application.
• You have an Azure AI User role in your Azure application.

In your Dataverse environment

To integrate Microsoft Copilot Studio agents, the Azure AI Foundry integration connects to your Dataverse environments with a service principal. This is a registered application in Microsoft Entra ID that has read-only access to each Dataverse environment from which you want to integrate assets. Only Dataverse environments in the Microsoft public (commercial) cloud are supported. Sovereign clouds such as US government (GCC High and DoD) and China aren't supported.

• If you already have an Azure connection configured for Azure AI Foundry, you can reuse the same app. Ensure that it has the Dataverse permissions in addition to its existing Azure permissions.
  1. Register an app in Microsoft Entra ID and create a client secret. Enter its tenant ID, client ID and client secret in the Azure connection. For more information, go to the Microsoft documentation.
  2. Create a read-only security role in each Dataverse environment from which you want to integrate Microsoft Copilot Studio agents. Grant it the Read privilege on the Bot and Botcomponent tables at the Organization level. Use the Organization level for Read, a lower level hides agents that the app doesn't own. For more information, go to the Microsoft documentation.
  3. Add the app as an application user in each environment and assign it the read-only security role you created in step 2. For more information, go to the Microsoft documentation on managing application users and assigning security roles.

In your Microsoft Entra environment

To integrate Microsoft Agent Builder agents, the Azure AI Foundry integration uses the same service principal as the other tabs. You can reuse the same registered application. Ensure that it has the following permissions:

• The AI Reader Microsoft Entra role, assigned at the directory scope. The integration needs it to list Agent Builder agents across your tenant, and synchronization fails without it. AI Reader is the least privileged role that works. You can also use another Entra role that can view the whole Power Platform inventory instead, such as Power Platform Administrator, Dynamics 365 Administrator, Global Reader, or AI Administrator. For more information on the AI Reader role, go to the Microsoft documentation.
• The Microsoft Graph User.Read.All application permission, with admin consent. The integration uses it to look up the names of each agent's owner and creator. Without it, the agents are still integrated, but the owner and creator names are empty and synchronization completes with errors.

If you use a proxy allowlist, allow login.microsoftonline.com, management.azure.com, and graph.microsoft.com.