A drop-in SharePoint communication-site template for organizations rolling out Microsoft 365 Copilot, Copilot Chat, Microsoft 365 Agents, and Microsoft Copilot Studio agents — modeled after the Power Platform adoption hub template and adapted for the Copilot product family.
Two design principles:
- Least privilege by default — no tenant-wide
Sites.FullControl.Allgrant, no certificates, no stored secrets. A one-time Entra app registration creates a delegated-permission app — meaning at deploy time it can only do what the signed-in user can do. You sign in interactively as a SharePoint Administrator, and authorization lasts only for that session. - Config-driven — every tenant-specific value (company name, site URL, owner, app id) lives in a single
Config.psd1file. You never edit the XML, and you never pass long parameter lists.
Why an Entra app at all? As of September 2024, Microsoft retired the shared "PnP Management Shell" multi-tenant app. PnP PowerShell now requires each tenant to register its own app — even for interactive sign-in. The registration is one-time and uses delegated permissions only (no
Sites.FullControl.All).
- What you get
- Site structure
- Training tracks
- Prerequisites
- Configure
- Deploy
- How it works
- Customizing the template
- Updating an existing deployment
- Troubleshooting
- Roadmap
- References
- License
CopilotHub/
├── Config.psd1 # ← edit this once
├── Register-PnPApp.ps1 # One-time: registers an Entra app for PnP sign-in
├── Deploy-CopilotHub.ps1 # Hybrid deploy: site + columns + lists (native) + pages/nav/Events (template)
├── Seed-LearningPaths.ps1 # Reads Config.psd1, seeds 9 Microsoft Learn courses
├── template.pnp # PnP provisioning template — 25 rich pages, Events list, nav, 23 stock photos
├── assets/ # Branded PNGs uploaded to /SiteAssets/CopilotHub/ at deploy time
│ ├── site-logo.png # 96×96 — official M365 Copilot ribbon glyph
│ ├── welcome-banner.png # 1345×436 — hero on the home page
│ ├── icon-copilot-chat.png # 600×600 — product card
│ ├── icon-m365-copilot.png # 600×600 — product card
│ ├── icon-m365-agents.png # 600×600 — product card
│ └── icon-copilot-studio.png # 600×600 — product card
└── README.github.md
Type: Communication site (SITEPAGEPUBLISHING#0)
Default URL: /sites/copilothub
Home
├── Products
│ ├── Copilot Chat
│ ├── Microsoft 365 Copilot
│ ├── Microsoft 365 Agents
│ └── Copilot Studio Agents
├── Governance
│ ├── Responsible AI & Acceptable Use
│ ├── Data Security & Sensitivity Labels
│ ├── DLP for Copilot & Agents
│ ├── Agent Lifecycle & Approval
│ └── Environments
├── Learn
│ ├── Getting Started
│ ├── Guided Learning ← training tracks live here
│ ├── Help & Learning
│ ├── Office Hours
│ ├── Consultation
│ └── Internal Communities
├── Community
│ ├── Champion of the Week (+ Adele Vance, James Williams seeded)
│ ├── Success Stories (+ Finance Copilot Studio Build seeded)
│ ├── Hackathons (+ Research & Innovation hackathon seeded)
│ └── News & Announcements
├── Copilot at {CompanyName}
├── Get a License
└── Support
Hidden under /SitePages/Templates/. Use as starting points when posting community content:
Templates/News- News story templateTemplates/Story-template- Success story templateTemplates/Champion- Champion of the Week templateTemplates/Hackathon- Hackathon event template
| List | Purpose | Provisioned by |
|---|---|---|
| Learning Paths | Microsoft Learn courses (Product / Audience / Requirement / Duration / Level / URL) | Native cmdlets |
| Agent Catalog | Registered declarative, Agent Builder, and Copilot Studio agents | Native cmdlets |
| Approved Connectors | Connectors approved under DLP for use by agents | Native cmdlets |
| Prompt Library | Vetted, shareable prompts | Native cmdlets |
| Events | Office hours, training sessions, community events | CopilotHub.pnp template |
CopilotProduct, CopilotAudience, CopilotRequirement, CopilotDurationMinutes, CopilotLevel, CopilotLearnUrl, CopilotOwner, CopilotConnector, CopilotApprovalState — all grouped under Copilot Hub in the site column gallery.
The Guided Learning page hosts four role-based tracks. Every URL is a verified Microsoft Learn resource.
| Course | Length | Level |
|---|---|---|
| Transform ideas into action with Copilot Chat (Basic) | 1h 23m · 3 modules | Beginner |
| Get started with Microsoft 365 Copilot | 1h 31m · 3 modules | Beginner |
| Course | Length | Level |
|---|---|---|
| Create agents in Microsoft Copilot Studio | 4h 5m · 5 modules | Intermediate |
| Declarative agents for Microsoft 365 Copilot (overview) | Docs | Intermediate |
| Agent Builder in Microsoft 365 Copilot | Docs | Beginner |
| Course | Length | Level |
|---|---|---|
| Prepare your organization for Microsoft 365 Copilot | 1h 20m · 2 modules | Intermediate |
| Prepare security and compliance to support Microsoft 365 Copilot | 6h 27m · 7 modules | Intermediate |
| Implement Microsoft 365 Copilot | 51 min · 10 units | Intermediate |
| MS-4017: Manage and extend Microsoft 365 Copilot | 1 day (ILT) | Intermediate |
Install-Module PnP.PowerShell -Scope CurrentUserRequires PnP.PowerShell 2.x on PowerShell 7.2+.
| Role | What they do | When |
|---|---|---|
| Global Administrator | Runs Register-PnPApp.ps1 to register the Entra app |
One time, per tenant |
| SharePoint Administrator (or Global Admin) | Runs the deployment interactively | Each deploy run |
| Site owner | The UPN listed in Config.psd1 as Owner |
At site creation |
You do not generate certificates, store secrets, or grant Sites.FullControl.All. The Entra app uses delegated permissions only — authorization at deploy time comes from your SharePoint Admin role in the browser sign-in, and lasts only for that session.
Open Config.psd1 and fill in your tenant values (leave ClientId empty for now — you'll fill it in after the one-time app registration):
@{
TenantUrl = "https://contoso.sharepoint.com"
SiteUrl = "https://contoso.sharepoint.com/sites/copilothub"
SiteTitle = "Copilot Hub"
CompanyName = "Contoso"
Owner = "admin@contoso.onmicrosoft.com"
Tenant = "contoso.onmicrosoft.com"
ClientId = "" # filled in by step 1 below
RegisterAsHub = $true
}Both Deploy-CopilotHub.ps1 and Seed-LearningPaths.ps1 read from this file. There are no other tenant-specific values anywhere in the repo, and the XML template is never edited.
You have two options. Pick whichever works on your machine.
Option A — Script (PowerShell 7.2+ with PnP.PowerShell 2.x):
.\Register-PnPApp.ps1 -Tenant contoso.onmicrosoft.comA browser opens. Sign in as a Global Administrator. The script calls Register-PnPEntraIDAppForInteractiveLogin and prints the ClientId.
If you see
The term 'Register-PnPEntraIDAppForInteractiveLogin' is not recognized, you're on Windows PowerShell 5.1 / PnP.PowerShell 1.x. The script will detect this and print Option B for you.
Option B — Entra portal (any PowerShell version):
- Open https://entra.microsoft.com and sign in as Global Administrator.
- Identity → Applications → App registrations → New registration:
- Name:
PnP-CopilotHub-Deploy - Account types: Accounts in this organizational directory only (single tenant)
- Redirect URI: Public client/native (mobile & desktop) →
http://localhost - Click Register.
- Name:
- On the Overview page, copy the Application (client) ID.
- API permissions → Add a permission:
- SharePoint → Delegated →
AllSites.FullControl - Microsoft Graph → Delegated →
User.Read - Remove the default
User.Readif it was auto-added twice. - Click Grant admin consent for (tenant).
- SharePoint → Delegated →
- Authentication → Advanced settings → "Allow public client flows" → Yes → Save.
These are the minimum permissions PnP needs for this workflow. Both are delegated, meaning the app inherits the signed-in user's scope. There is no
Sites.FullControl.Allapplication permission and no tenant-wide grant.Why not Graph
Sites.FullControl.All? PnP PowerShell uses SharePoint REST endpoints (not Microsoft Graph) for site creation, template apply, and hub registration in this workflow. The SharePointAllSites.FullControldelegated permission is sufficient on its own. GraphUser.Readis included only so Entra can resolve the signed-in user's identity during the interactive sign-in flow.
Then for either option:
Paste the ClientId into Config.psd1 → ClientId. Wait ~1 minute for Entra propagation.
If you later see
AADSTS700016: Application with identifier ... was not foundwhen running Deploy, theClientIdinConfig.psd1is missing, wrong, or from a different tenant.
.\Deploy-CopilotHub.ps1A browser window opens. Sign in as a SharePoint Administrator (or Global Admin). Your role authorizes the deployment for the duration of the session — nothing is granted permanently.
The script is fully idempotent. Re-run it any time to push template changes; existing list data is preserved.
Deploy-CopilotHub.ps1 runs a hybrid deployment — native PnP cmdlets for structured data (giving per-step error messages), and Invoke-PnPSiteTemplate for rich modern pages (giving News carousels, Events web parts, QuickLinks, and full navigation that can't be replicated cleanly via cmdlets alone):
| # | Phase | How | What it does |
|---|---|---|---|
| 1 | Module check | cmdlet | Verifies PnP.PowerShell is installed |
| 2a | Connect to -admin endpoint |
cmdlet | Interactive browser sign-in as SharePoint Admin |
| 2b | Register as hub site | cmdlet | Only if RegisterAsHub = $true (runs in admin context so no extra login) |
| 3 | Ensure site exists | cmdlet | Creates the communication site if missing |
| 4 | Connect to site | cmdlet | Reconnects to the new site URL |
| 5 | Apply PnP template | Invoke-PnPSiteTemplate |
Provisions 25 rich pages (News carousel, Events, QuickLinks, People, hero layouts), the Events list with its calendar view, and top navigation — from CopilotHub.pnp |
| 6 | Site columns | cmdlet | Creates 9 Copilot Hub site columns via Add-PnPField |
| 7 | Lists | cmdlet | Creates 4 lists (Learning Paths, Agent Catalog, Approved Connectors, Prompt Library) via New-PnPList and wires field refs — Events list is handled by phase 5 |
| 8 | Views | cmdlet | Creates By Audience, By Product, Required Only views on Learning Paths |
| 9 | Branded assets | cmdlet | Uploads assets/*.png to /SiteAssets/CopilotHub/ and sets the site logo |
| 10 | Seed Learning Paths |
script | Adds 9 Microsoft Learn courses (idempotent on Title) |
Every phase is idempotent. Safe to re-run — existing columns, lists, pages, and list items are skipped.
Why the hybrid approach?
Invoke-PnPSiteTemplategives rich web parts (News carousel, Events, QuickLinks, People) that are impossible to reproduce cleanly via cmdlets alone — and the.pnptemplate carries 23 stock photos and the full navigation tree. Native cmdlets handle Copilot-specific lists and columns because they give a real error per step (template engine only reports "Template is not valid" with no detail when any element fails).
Pages and navigation live inside CopilotHub.pnp. To modify them you'll need to:
- Unzip
CopilotHub.pnp(it's a standard zip archive — rename to.zipif needed). - Edit the main provisioning XML (named by GUID — check
ProvisioningTemplate/files-map.xmlto findtemplate.xml). - Re-zip with the same internal structure and rename back to
.pnp.
For most branding changes, only three things need editing:
| What | Where |
|---|---|
| Company name substitution | Config.psd1 → CompanyName (injected by Deploy into site metadata and description) |
| Site logo | Replace assets/site-logo.png and re-run Deploy |
| Hero banner image | Replace assets/welcome-banner.png and re-run Deploy |
The assets/ folder ships with self-generated PNG icons in Copilot colors. They are intentionally self-contained — no external CDN dependencies — so the site renders correctly on tenants with restrictive egress policy (e.g., GCC).
To replace them, drop new PNGs of the same name into assets/ and re-run Deploy-CopilotHub.ps1:
| File | Size | Used for |
|---|---|---|
site-logo.png |
96×96 | Site logo |
welcome-banner.png |
1345×436 | Hero banner on the home page |
icon-copilot-chat.png |
600×600 | Product card |
icon-m365-copilot.png |
600×600 | Product card |
icon-m365-agents.png |
600×600 | Product card |
icon-copilot-studio.png |
600×600 | Product card |
Deploy uploads everything in assets/ to /SiteAssets/CopilotHub/ and the .pnp template references them by site-relative path — so they work on every tenant URL without edits. The 23 stock photo backgrounds (hero and section images) come bundled inside CopilotHub.pnp itself and are uploaded to /SiteAssets/Images/ automatically.
Append to $courses in Seed-LearningPaths.ps1:
@{
Title = "Contoso Copilot Onboarding (instructor-led)"
Product = "Microsoft 365 Copilot"
Audience = "End User"
Requirement = "Required"
Duration = 60
Level = "Beginner"
Url = "https://contoso.sharepoint.com/sites/copilothub/SitePages/Onboarding.aspx"
}Re-run — it skips existing titles.
# Push template changes (pages, columns, lists, nav)
.\Deploy-CopilotHub.ps1
# Refresh just the Learning Paths list
.\Seed-LearningPaths.ps1Deploy-CopilotHub.ps1 is idempotent — each phase skips resources that already exist and only creates what's missing. Existing list data is always preserved.
| Symptom | Fix |
|---|---|
PnP.PowerShell is not installed |
Install-Module PnP.PowerShell -Scope CurrentUser |
Config.psd1 is missing required value: X |
Open Config.psd1 and fill in the missing value |
template.pnp not found |
Ensure template.pnp is in the same folder as Deploy-CopilotHub.ps1 |
AADSTS700016: Application with identifier ... was not found |
You haven't done the one-time app registration yet, or ClientId in Config.psd1 is wrong / from a different tenant |
Register-PnPEntraIDAppForInteractiveLogin is not recognized |
You're on Windows PowerShell 5.1 / PnP.PowerShell 1.x. Use Option B (Entra portal) under Step 1, or upgrade to PowerShell 7.2+ and Install-Module PnP.PowerShell -Force |
Sign-in works but Connect-PnPOnline returns AccessDenied |
Wait ~1 minute after registration for Entra propagation, then retry. If still failing, confirm admin consent was granted on all 3 delegated permissions |
AADSTS65001: The user or administrator has not consented to use the application |
Open the app in Entra portal → API permissions → click Grant admin consent for (tenant) |
| Browser prompt loops on sign-in | Make sure your account holds the SharePoint Administrator role |
Get-PnPTenantSite returns 403 |
You're not signed in as a SharePoint Admin — re-run and sign in with the correct account |
New-PnPSite : {"RawSiteProvisionState":1,"SiteId":"","SiteStatus":3,"SiteUrl":""} |
A previous create attempt left state behind, OR the Owner UPN isn't valid in your tenant. The current Deploy-CopilotHub.ps1 auto-detects deleted/errored sites and verifies the owner UPN before retrying — re-pull the latest script. If you still hit it, open the SharePoint admin center → Active sites AND Deleted sites and check whether /sites/copilothub already exists; remove it manually, wait ~1 minute, then re-run |
| Site creation: "Owner UPN ... could not be resolved" | Owner in Config.psd1 is a placeholder (admin@contoso.onmicrosoft.com) or a user that doesn't exist in your tenant. Set it to a real licensed UPN (often your own) |
List 'Learning Paths' not found |
Run Deploy-CopilotHub.ps1 before the seed script |
Pages show {parameter:CompanyName} literally |
CompanyName is blank in Config.psd1 |
| Welcome page shows broken image icons | Asset upload phase (phase 9) failed. Confirm assets/*.png exists next to the deploy script, then re-run. /SiteAssets/CopilotHub/ should contain the PNGs |
| Pages or sections are missing after deploy | Invoke-PnPSiteTemplate (phase 5) failed silently. Re-run with -Verbose to see which web part caused the error. If a stock photo is missing, the template will not apply — ensure CopilotHub.pnp is not corrupt |
| Edits to page content aren't showing | Pages and nav are owned by the .pnp template. Edit template.xml inside CopilotHub.pnp (it's a zip), re-zip, re-run Deploy |
Register-PnPHubSite fails |
Confirm RegisterAsHub = $true and that your account is a SharePoint Admin |
- Power Automate flow: auto-assign required training when a Copilot license is requested
- Power BI report on training completion rates
- Sample declarative agent definition + Copilot Studio solution under
/samples - Localized content packs (es-ES, fr-FR, de-DE)
- PnP PowerShell docs
- PnP provisioning schema
- Power Platform site template (origin model)
- Microsoft Copilot learning hub
MIT — provided as-is. Microsoft, M365 Copilot, Copilot Studio, and SharePoint are trademarks of the Microsoft group of companies.