Why This Matters

Custom Extensions unlock Copilot integration with internal services. Architecture determines security, scalability, and maintainability.

Concept Explained

An Extension is a service that Copilot calls via @participant. Architecture: manifest (describes Extension), hosting (where it runs), OAuth (auth), security model.

How It Works

Design manifest (name, scopes, callbacks). Choose hosting (local, cloud, on-prem). Implement OAuth flow. Threat-model. Document architecture.

Step-by-Step Tutorial

1. Design manifest

2. Choose hosting

3. Plan OAuth

4. Threat model

5. Document

Real-World Example

A team built a custom Extension for their internal service catalog. Architecture: cloud-hosted (AWS Lambda), OAuth via GitHub Apps, scopes limited to read-only catalog access. Threat model identified: token leakage (mitigated by short-lived tokens), unauthorized access (mitigated by scopes).

Example Prompts / Commands / Code

graph TB
    A[Copilot Chat] -->|@my-extension| B[Copilot Service]
    B -->|HTTPS| C[Extension Host: AWS Lambda]
    C -->|OAuth| D[GitHub OAuth]
    C -->|API| E[Internal Service Catalog]

    F[Manifest] -.-> A
    G[OAuth Scopes] -.-> C
    H[Threat Model] -.-> C

{
  "name": "my-service-catalog",
  "display_name": "Service Catalog",
  "description": "Query internal service catalog from Copilot",
  "hooks": {
    "participant": "@my-catalog"
  },
  "oauth": {
    "client_id": "YOUR_CLIENT_ID",
    "scopes": ["read:catalog"]
  },
  "endpoints": {
    "base_url": "https://my-extension.example.com"
  }
}

Common Mistakes

• Over-scoped OAuth — Extension can do more than needed.
• No threat model — security gaps.
• Hosting without considering scale — Extension breaks under load.
• No documentation — team can't maintain.

Best Practices

• Design manifest carefully (name, scopes, callbacks).
• Choose hosting based on scale and security needs.
• Plan OAuth with minimal scopes.
• Threat-model before implementing.
• Document architecture.

Troubleshooting

Practical Exercise

Professional Challenge

Frequently Asked Questions

Further Reading

• Building Copilot Extensions

Official References

• Building Extensions

Related lessons: IN-35, PR-21