Microsoft Copilot Studio + Signbee: Custom E-Signature Connector Guide (2026)

1. The Enterprise Microsoft 365 E-Signature Bottleneck

By October 2026, Microsoft Copilot Studio has cemented its position as the default orchestration control plane for Fortune 500 and mid-market enterprises standardizing on Microsoft Entra ID, Microsoft Teams, SharePoint Online, and Microsoft Dataverse. Sales operations teams ask Copilot inside Microsoft Teams to summarize Dynamics 365 Sales opportunities, procurement officers query SharePoint libraries for vendor compliance status, and HR managers generate offer letters directly inside Word Copilot. Yet the moment a commercial agreement must be signed by an external counterparty, enterprise automation hits a costly licensing and architectural wall.

Legacy e-signature connectors listed inside Microsoft AppSource—specifically DocuSign and Adobe Acrobat Sign—were architected during the pre-agentic SaaS era. As detailed in our breakdown of DocuSign API pricing and hidden enterprise lock-in, enabling the official DocuSign Power Automate and Copilot connector across a 250-employee organization typically requires pairing Microsoft Power Platform Premium licenses with per-seat DocuSign Business Pro subscriptions ($40–$65 per user/month) or purchasing rigid annual API envelope tiers that penalize overages at $4.00+ per contract.

Worse still, legacy connectors force developers to maintain brittle Word (.docx) templates littered with proprietary anchor strings (\s1\, \d1\) or hardcoded X/Y pixel coordinates. When an autonomous Copilot agent dynamically adds a custom indemnity table or multi-row pricing schedule to an agreement, fixed coordinate anchors drift onto the wrong page, causing signature blocks to overlap legal text.

Connecting Signbee to Microsoft Copilot Studio eliminates both problems simultaneously. Signbee is built from the ground up as one of the best e-signature APIs for developers in 2026: it accepts native CommonMark markdown generated directly by Azure OpenAI models inside Copilot Studio, compiles typography-grade A4 PDFs with automatic pagination and table rendering in under 240ms, and charges zero per-seat user fees. A single tenant-wide Signbee API key empowers every authorized Microsoft Teams user to trigger contract workflows while maintaining strict Entra ID sender attribution.

2. Two Integration Pathways: OpenAPI Custom Connector vs. Native MCP Server

Following Microsoft's 2025–2026 Wave 2 updates to Copilot Studio, enterprise architects can expose external APIs to Copilot agents via two complementary mechanisms: Power Platform OpenAPI Custom Connectors and Model Context Protocol (MCP) Tool Servers. Choosing the right pathway depends on whether your primary execution surface is conversational generative orchestration in Microsoft Teams or deterministic background automation in Power Automate.

For most enterprise deployments, we recommend registering Signbee as a Solution-Aware OpenAPI Custom Connector inside your Power Platform Dataverse environment. Because Copilot Studio shares the same underlying connector registry as Power Automate and Power Apps, registering the OpenAPI specification once makes Signbee actions immediately callable by conversational Copilot agents in Microsoft Teams and by automated Dataverse triggers when a Dynamics 365 deal stage changes to Contract Sent.

3. Step-by-Step: Importing Signbee's OpenAPI Spec into Copilot Studio

To ensure full compatibility with Power Platform Solution Application Lifecycle Management (ALM)—allowing you to promote your e-signature connector cleanly from Dev to UAT and Production environments—always create your custom connector inside an unmanaged Power Platform Solution rather than the default environment root.

Step 3.1: Provision a Scoped Signbee Production API Key

Navigate to signb.ee/dashboard, open the API Keys tab, and generate a dedicated key named M365-Copilot-Prod. If you are prototyping in a sandbox tenant first, you can start with our free e-signature API tier before upgrading to a high-volume plan. Store the resulting sb_live_... secret inside an Azure Key Vault secret linked to a Power Platform Environment Variable so credentials are never hardcoded inside exported solution zip files.

Step 3.2: OpenAPI Connector Definition & Generative Orchestrator Hints

Inside Copilot Studio (copilotstudio.microsoft.com), open your target agent, select Tools → Add a tool → New tool → Custom connector, and choose Import an OpenAPI from URL using https://signb.ee/openapi.json. Alternatively, if you use the Microsoft Power Platform CLI (pac connector create) in your GitHub Actions or Azure DevOps pipeline, use the following connector definition with enriched x-ms-summary and description annotations so Copilot's generative orchestrator maps natural-language prompts accurately:

{
  "swagger": "2.0",
  "info": {
    "title": "Signbee E-Signature Engine",
    "description": "Dispatch legally binding agreements from CommonMark markdown or base64 PDF and verify SHA-256 cryptographic signing certificates.",
    "version": "1.0.0"
  },
  "host": "signb.ee",
  "basePath": "/api/v1",
  "schemes": ["https"],
  "consumes": ["application/json"],
  "produces": ["application/json"],
  "securityDefinitions": {
    "BearerAuth": {
      "type": "apiKey",
      "name": "Authorization",
      "in": "header",
      "description": "Enter your Signbee key in the format: Bearer sb_live_xxxxxxxxxxxxxxxx"
    }
  },
  "security": [{ "BearerAuth": [] }],
  "paths": {
    "/send": {
      "post": {
        "operationId": "SendContractForSignature",
        "summary": "Send a contract or agreement for legally binding e-signature",
        "description": "Compiles CommonMark markdown or a base64 PDF into an A4 legal document, records Party A signature, and emails Party B a secure signing ceremony link.",
        "x-ms-visibility": "important",
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "required": true,
            "schema": {
              "type": "object",
              "required": ["title", "sender_name", "sender_email", "recipient_name", "recipient_email"],
              "properties": {
                "title": {
                  "type": "string",
                  "x-ms-summary": "Document Title",
                  "description": "Official legal title of the contract (e.g., 'Master Services Agreement - Contoso Ltd')."
                },
                "markdown": {
                  "type": "string",
                  "x-ms-summary": "Contract Markdown Body",
                  "description": "Full CommonMark markdown body of the agreement including headings, clauses, and pricing tables."
                },
                "sender_name": {
                  "type": "string",
                  "x-ms-summary": "Sender Full Name",
                  "description": "Full legal name of the internal employee sending the agreement (Party A)."
                },
                "sender_email": {
                  "type": "string",
                  "x-ms-summary": "Sender Work Email",
                  "description": "Verified Microsoft Entra ID email address of Party A."
                },
                "recipient_name": {
                  "type": "string",
                  "x-ms-summary": "Recipient Full Name",
                  "description": "Full legal name of the external counterparty signing the contract (Party B)."
                },
                "recipient_email": {
                  "type": "string",
                  "x-ms-summary": "Recipient Email",
                  "description": "Email address where Party B will receive the single-use signing ceremony link."
                },
                "expires_in_days": {
                  "type": "integer",
                  "default": 14,
                  "x-ms-summary": "Expiration Days",
                  "description": "Number of days before the signing link expires (1 to 90)."
                },
                "webhook_url": {
                  "type": "string",
                  "x-ms-summary": "Power Automate Webhook URL",
                  "description": "Optional HTTPS webhook endpoint to receive document.signed events."
                }
              }
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Contract dispatched and Party A signature recorded",
            "schema": {
              "type": "object",
              "properties": {
                "id": { "type": "string", "x-ms-summary": "Document ID" },
                "status": { "type": "string", "x-ms-summary": "Envelope Status" },
                "verify_url": { "type": "string", "x-ms-summary": "Verification URL" },
                "expires_at": { "type": "string", "x-ms-summary": "Expiration Timestamp" }
              }
            }
          }
        }
      }
    }
  }
}

Notice the inclusion of "x-ms-visibility": "important" and explicit x-ms-summary tags on every property. In Copilot Studio's generative orchestration engine, the planner LLM inspects these metadata fields to determine whether it has collected sufficient slot variables from the conversation or if it needs to prompt the user for a missing counterparty email address before invoking the tool.

4. Enforcing Human-in-the-Loop Approvals with Microsoft Teams Adaptive Cards

In an enterprise legal or sales environment, an AI agent should never dispatch a binding commercial contract to an external vendor or customer without deterministic human review. Even when an account executive instructs Copilot inside Microsoft Teams, “Draft an SOW for Fabrikam for 120 hours of cloud migration at $185/hr and send it to David Park,” a typographical error in hourly rate or payment terms could bind the organization prematurely.

To enforce strict governance, insert a Microsoft Teams Adaptive Card v1.5 confirmation step inside your Copilot Studio Topic or Agent Flow immediately prior to executing the SendContractForSignature action. Using Power FX, you bind the generated contract summary, total contract value, and Entra ID user context into a structured visual card rendered inline in Teams:

{
  "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
  "type": "AdaptiveCard",
  "version": "1.5",
  "body": [
    {
      "type": "Container",
      "style": "emphasis",
      "items": [
        {
          "type": "TextBlock",
          "text": "SIGNBEE E-SIGNATURE DISPATCH GATE",
          "weight": "Bolder",
          "size": "Small",
          "color": "Warning"
        },
        {
          "type": "TextBlock",
          "text": "${Topic.ContractTitle}",
          "weight": "Bolder",
          "size": "Large",
          "wrap": true
        }
      ]
    },
    {
      "type": "FactSet",
      "facts": [
        {
          "title": "Party A (Sender):",
          "value": "${System.User.DisplayName} (${System.User.Email})"
        },
        {
          "title": "Party B (Recipient):",
          "value": "${Topic.RecipientName} (${Topic.RecipientEmail})"
        },
        {
          "title": "Contract Value:",
          "value": "${Topic.FormattedTotalValue}"
        },
        {
          "title": "Governing Law:",
          "value": "England and Wales / Delaware (Standard Playbook)"
        },
        {
          "title": "Expiration Window:",
          "value": "14 Calendar Days (SHA-256 Sealed)"
        }
      ]
    },
    {
      "type": "TextBlock",
      "text": "Preview of Generated CommonMark Clause Summary:",
      "weight": "Bolder",
      "spacing": "Medium"
    },
    {
      "type": "TextBlock",
      "text": "${Left(Topic.ContractMarkdown, 420)}...",
      "fontType": "Monospace",
      "size": "Small",
      "isSubtle": true,
      "wrap": true
    }
  ],
  "actions": [
    {
      "type": "Action.Submit",
      "title": "Approve & Dispatch via Signbee",
      "style": "positive",
      "data": {
        "decision": "APPROVE_DISPATCH",
        "approvedByEntraObjectId": "${System.User.Id}"
      }
    },
    {
      "type": "Action.Submit",
      "title": "Edit Clauses in Teams",
      "data": {
        "decision": "REQUEST_REVISION"
      }
    }
  ]
}

Notice how the Adaptive Card automatically populates ${System.User.DisplayName} and ${System.User.Email} directly from the authenticated Microsoft Entra ID session token. When the employee clicks Approve & Dispatch via Signbee, Copilot Studio passes those verified identity claims into the sender_name and sender_email fields of the Signbee API call. Even though the tenant authenticates with a single shared organizational API key—saving thousands of dollars per month as shown in our 2026 e-signature API pricing comparison—every individual contract carries the exact legal identity of the employee who approved it.

5. Automated Post-Signature Archiving to SharePoint & Dataverse

Dispatching the agreement is only the first half of the enterprise contract lifecycle. Once the external counterparty clicks the signing link in their email and completes Signbee's mobile-responsive signing ceremony, your Microsoft 365 environment needs immediate notification so it can mark the Dynamics 365 opportunity as Closed Won, store the cryptographic SHA-256 hash in Dataverse, and deposit the immutable PDF into the client's SharePoint Online folder.

Rather than polling GET /api/v1/documents/{id} on a timer, pass a Power Automate HTTP Webhook trigger URL in the webhook_url field when dispatching the document. For high-security environments, you can also deploy a lightweight Azure Functions middleware or custom Power Automate code action that verifies Signbee's X-Signbee-Signature HMAC-SHA256 header before writing to Dataverse and SharePoint via Microsoft Graph:

import { app, HttpRequest, HttpResponseInit, InvocationContext } from "@azure/functions";
import crypto from "node:crypto";

interface SignbeeWebhookPayload {
  event: "document.signed" | "document.viewed" | "document.expired";
  document_id: string;
  title: string;
  recipient_email: string;
  signed_at: string;
  sha256_hash: string;
  verify_url: string;
  download_url: string;
}

export async function signbeeSharePointSync(
  request: HttpRequest,
  context: InvocationContext
): Promise<HttpResponseInit> {
  const signatureHeader = request.headers.get("x-signbee-signature") ?? "";
  const rawBody = await request.text();
  const webhookSecret = process.env.SIGNBEE_WEBHOOK_SECRET!;

  // 1. Verify HMAC-SHA256 signature using constant-time comparison
  const expectedHmac = crypto
    .createHmac("sha256", webhookSecret)
    .update(rawBody, "utf8")
    .digest("hex");

  const sigBuffer = Buffer.from(signatureHeader, "utf8");
  const expectedBuffer = Buffer.from(expectedHmac, "utf8");
  if (
    sigBuffer.length !== expectedBuffer.length ||
    !crypto.timingSafeEqual(sigBuffer, expectedBuffer)
  ) {
    context.warn("Rejected webhook with invalid X-Signbee-Signature");
    return { status: 401, jsonBody: { error: "Invalid HMAC signature" } };
  }

  const payload = JSON.parse(rawBody) as SignbeeWebhookPayload;
  if (payload.event !== "document.signed") {
    return { status: 200, jsonBody: { received: true, ignored: payload.event } };
  }

  // 2. Fetch the executed PDF binary (with appended A4 SHA-256 Certificate)
  const pdfResponse = await fetch(payload.download_url, {
    headers: { Authorization: `Bearer ${process.env.SIGNBEE_API_KEY}` },
  });
  if (!pdfResponse.ok) {
    throw new Error(`Failed to download signed PDF: ${pdfResponse.status}`);
  }
  const pdfBuffer = Buffer.from(await pdfResponse.arrayBuffer());

  // 3. Upload sealed PDF to SharePoint Online Site Library via Microsoft Graph
  const safeFileName = `${payload.document_id}-${payload.title.replace(/[^a-zA-Z0-9-_]/g, "_")}.pdf`;
  const graphUploadUrl = `https://graph.microsoft.com/v1.0/sites/${process.env.SPO_SITE_ID}/drive/root:/ExecutedContracts/${safeFileName}:/content`;

  const uploadRes = await fetch(graphUploadUrl, {
    method: "PUT",
    headers: {
      Authorization: `Bearer ${process.env.MS_GRAPH_ACCESS_TOKEN}`,
      "Content-Type": "application/pdf",
    },
    body: pdfBuffer,
  });

  if (!uploadRes.ok) {
    throw new Error(`SharePoint upload failed: ${uploadRes.status}`);
  }

  const driveItem = (await uploadRes.json()) as { webUrl: string; id: string };
  context.log(`Archived signed PDF ${payload.document_id} (SHA-256: ${payload.sha256_hash}) to ${driveItem.webUrl}`);

  return {
    status: 200,
    jsonBody: {
      archived: true,
      document_id: payload.document_id,
      sha256_hash: payload.sha256_hash,
      sharepoint_url: driveItem.webUrl,
    },
  };
}

app.http("signbeeSharePointSync", {
  methods: ["POST"],
  authLevel: "anonymous",
  handler: signbeeSharePointSync,
});

This event-driven pipeline completes in under 1.2 seconds from the moment Party B clicks “Complete Signature.” Furthermore, if your enterprise requires custom portal branding or embedded signing inside a Power Pages customer portal, you can combine this webhook pipeline with our white-label e-signature API architecture or compare self-hosted compliance trade-offs in our open-source e-signature API comparison.

6. Power Platform DLP Governance, Entra ID Security & TCO Economics

Enterprise InfoSec teams rightly scrutinize every custom connector introduced into a Microsoft 365 tenant. In Power Platform Admin Center (admin.powerplatform.microsoft.com), administrators classify connectors into three Data Loss Prevention (DLP) buckets: Business, Non-Business, and Blocked.

Because Signbee's Custom Connector communicates strictly over TLS 1.3 with https://signb.ee/api/v1/*, you can place the Signbee connector into your Business data group alongside Microsoft Dataverse, SharePoint Online, Office 365 Outlook, and Microsoft Teams—while adding a DLP Connector Endpoint Filtering rule that explicitly permits https://signb.ee/* and blocks unapproved external HTTP destinations.

3-Year Enterprise Total Cost of Ownership (250 M365 Copilot Users, 1,500 Contracts/Month)

When evaluating an affordable e-signature API integration for Microsoft 365 Copilot, the financial impact of eliminating per-seat e-signature licensing across a 250-seat commercial team is substantial:

7. Alternative Setup: Connecting signbee-mcp Directly in Copilot Studio

For engineering teams building autonomous agents that do not require legacy Power Apps canvas bindings, Microsoft Copilot Studio's native Model Context Protocol (MCP) client offers an even faster integration path than Swagger 2.0 custom connectors. Instead of maintaining static OpenAPI definitions inside Dataverse solutions, Copilot Studio connects to an MCP endpoint over Server-Sent Events (SSE) or Streamable HTTP and dynamically discovers every tool, parameter schema, and prompt template exposed by the server at runtime.

Signbee ships an official zero-dependency MCP server (signbee-mcp) that exposes send_document, get_document_status, list_documents, and verify_certificate tools. When deployed as an Azure Container App inside your corporate Azure Virtual Network (VNet), Copilot Studio communicates with your MCP bridge over private backbone routing while authenticating outbound requests to https://signb.ee/api/v1:

kind: TaskDialog
modelDisplayName: Signbee Contract Execution MCP
modelDescription: Dispatches legally binding CommonMark or PDF agreements and verifies SHA-256 audit trails via Signbee.
action:
  kind: InvokeMcpServerAction
  mcpServerEndpoint: https://mcp-signbee-bridge.internal.contoso.com/sse
  authentication:
    kind: BearerToken
    tokenVariable: Environment.cr8a2_SignbeeProductionApiKey
  tools:
    - name: send_document
      requiresConfirmation: true
      confirmationMode: AdaptiveCard
      inputMapping:
        title: =Topic.ContractTitle
        markdown: =Topic.ContractMarkdown
        sender_name: =System.User.DisplayName
        sender_email: =System.User.Email
        recipient_name: =Topic.RecipientName
        recipient_email: =Topic.RecipientEmail
        expires_in_days: =Coalesce(Topic.ExpirationDays, 14)
        webhook_url: =Environment.cr8a2_PowerAutomateWebhookUrl
onError:
  - kind: SendActivity
    activity: "Contract dispatch encountered an API validation error ({System.Error.Message}). Your draft has been saved to Dataverse for manual review."

Notice how the onError handler captures transient validation errors—such as a malformed counterparty email domain or an expired Azure Key Vault rotation—and gracefully falls back by persisting the generated CommonMark markdown draft inside Dataverse rather than losing the conversational state. Furthermore, because Signbee's POST /api/v1/send endpoint supports idempotency keys via the X-Idempotency-Key HTTP header, Power Automate's automatic exponential retry policy (4 retries at 20-second intervals) will never send duplicate signing invitation emails to an external executive if a transient network blip occurs between Azure Front Door and your tenant.

8. Frequently Asked Questions: Microsoft Copilot Studio & Signbee