Secure GraphRAG: Wiring Microsoft Copilot Studio to Neo4j with per-user Okta SSO

Neo4j’s guide describes a secure integration between Microsoft Copilot Studio, Okta, and Neo4j that preserves each user’s identity when an AI agent queries graph data. Rather than using a shared database service account, Copilot obtains an Okta OAuth access token for the signed-in user, passes it through a Neo4j MCP server deployed on Google Cloud Run, and Neo4j directly validates the token and maps Okta groups to database roles. This approach prevents an agent’s dynamically generated Cypher queries from exposing data beyond a user’s authorized scope, addressing the “confused deputy” risk associated with shared credentials. The setup requires existing Neo4j Okta SSO, a separate Okta application for Copilot Studio, access-token claims for email and groups, exact role mappings, and Cloud Run deployment configured without database usernames or passwords. The guide also covers optional vector search, with embedding credentials stored in Google Secret Manager, Copilot OAuth configuration and tool synchronization, and a staged verification process for validating tokens, MCP tools, Neo4j access, vector search, and agent responses.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.