Identity before tools
Microsoft Entra blocks users without an assigned role before gateway code runs. The pilot group received Reader access only.
- Entra authentication
- Assigned app roles
- Dedicated API identity
Case study · Stellar Systems
Giving Copilot controlled, read-only access to ConnectWise
DataMust deployed a live Model Context Protocol gateway pilot in Stellar Systems’ Azure environment, giving trusted users access to 44 ConnectWise read tools while keeping all 12 write tools blocked.
- Client
- Stellar Systems
- Industry
- Managed IT services
- Engagement
- AI gateway pilot
- Status
- Deployed and live · read-only
Technology usedMicrosoft 365 CopilotCopilot StudioMicrosoft TeamsMicrosoft Entra IDAzure FunctionsAzure Key VaultApplication InsightsConnectWise PSA
Pilot evidence
What was delivered
Live
Gateway deployed and responding in Azure
44
ConnectWise read tools enabled for pilot users
12 blocked
Write tools deployed but unavailable to users
Entra
Authentication and application roles control access
Checked
Coverage verdicts expose partial or incomplete queries
Scoped
Hardening and broader rollout remain explicit next decisions
The challenge
Useful AI access without putting another provider in the data path
ConnectWise PSA holds high-value operational context: tickets, client activity, service history, agreements, invoices, projects and time entries. Stellar Systems wanted trusted employees to query that information through Microsoft Copilot without routing sensitive PSA data through a separate third-party MCP provider.
The real question was not whether an AI assistant could call an API. It was whether Stellar could test the value while keeping identity, access, credentials and operational ownership inside its existing Microsoft environment.
The first release therefore needed a hard boundary: useful read access for a small pilot group, with no ability to change ConnectWise records.
The approach
Prove useful access before enabling write-back
DataMust treated the work as a controlled pilot, not a production AI platform. The architecture was sized to answer one decision: is tenant-hosted AI access to ConnectWise useful enough to justify hardening and broader rollout?
- Deploy the gateway as an Azure Function in Stellar’s environment
- Use Microsoft Entra authentication and assigned application roles
- Connect directly to ConnectWise through a dedicated API member
- Start with a limited group holding the Reader role only
- Document production hardening and write-back as later decisions
Entra-authenticated MCP gatewayAzure Functions · Stellar environment
Connects to
Trusted pilot users
Microsoft 365 Copilot and Teams
44 read tools enabled
ConnectWise PSA
12 write tools blocked
The solution
Control identity, tool access and answer completeness inside the gateway
The gateway does more than translate natural-language questions into API calls. It contains the controls that stop a useful pilot from becoming an ungoverned integration.
Correctness before confidence
Counting, aggregation and coverage checks run inside the function so the model does not mistake a partial record set for a complete answer.
- Server-side aggregation
- Coverage verdicts
- Field projection
Write capability contained
Twelve write tools were deployed for a possible later phase, but every call remained blocked because nobody held the Operator role.
- Read-only pilot
- Forbidden by role
- Application Insights audit trail
The result is a live pilot that can answer useful operational questions without giving the AI interface permission to alter the system of record.
Strategic impact
A real decision point, not a production-readiness claim
Trusted users gained a working path from Microsoft 365 Copilot and Teams to ConnectWise information across service desk, clients, agreements, invoices, projects, opportunities and time entries.
Stellar also gained evidence for the next decision: extend Reader access, selectively enable governed write workflows, harden the service for production, or stop without having committed to a broader platform build.
Before“A community server or third-party proxy between the AI interface and the PSA.”
After“A live, client-environment pilot controlled through Entra roles and a read-only boundary.”
Production hardening, broad staff rollout, additional systems and enabled write-back remained outside the pilot scope.
Why it matters
The dangerous AI answer is not always wrong. Sometimes it is incomplete.
A thin API wrapper can return hundreds of records and leave the model to count, rank or sum them. If pagination drops rows, the answer can still sound authoritative. During development, one scan returned 984 of 6,077 matching records and could have been presented as complete.
DataMust moved counting, aggregation, invoice logic and coverage verification into the gateway. The model receives the computed result plus an explicit COMPLETE, PARTIAL or UNVERIFIED verdict. Governance here is not a policy slide. It is behaviour engineered into the path between the assistant and the system of record.
Similar priority?
Does an AI assistant need controlled access to a business-critical system?
Book a 30-minute fit call to decide whether the use case needs an AI readiness roadmap or is narrow enough for a controlled implementation sprint.