Secure GraphRAG: Wiring Microsoft Copilot Studio to Neo4j with per-user Okta SSO

Graph access that knows who you are. A financial advisor asks Copilot,“Which of my clients have more than 30% of their portfolio concentrated in a single sector and haven’t rebalanced in over 90 days?” Answering that means traversing clients to accounts to holdings to securities to transaction history, several hops deep, and the advisor should see exactly their own book of business. Once an LLM is writing the queries, you can’t fully predict or constrain what it will ask for. If the agent connects to Neo4j with a single shared service account, every user’s session inherits whatever that account can reach, and one bad generation can walk straight into a colleague’s clients. Most Copilot-to-database integrations get built this way anyway, because a shared service account is the fastest way to get a demo working. It holds up right until more than one type of user touches it in production. A more robust solution would be to have Copilot Studio calling a Neo4j MCP server that forwards each user’s own…