Hi, The issue you're encountering with OAuth2.0 in your custom MCP server setup seems to stem from how Copilot Studio handles token persistence after the initial authentication. While the OAuth "dance" completes and the `initialize` call includes a valid Bearer token, subsequent calls—such as `tools/list`—fail to include it, resulting in authentication errors. Here are a few points to consider: 1. **Token Endpoint Correction**: In your Swagger definition, the `tokenUrl` is currently set to the authorization endpoint: ```yaml tokenUrl: https://login.windows.net/common/oauth2/authorize ``` This should be: ```yaml tokenUrl: https://login.microsoftonline.com/common/oauth2/token ``` The `authorize` endpoint is used for user consent, while the `token` endpoint is where the access token is actually retrieved. 2. **Scope Configuration**: Ensure that the scope `https://graph.microsoft.com/.default` is correctly configured in Azure Entra ID and granted to the application. Also, verify that the token returned includes this scope. 3. **Copilot Studio Token Handling**: According to [Microsoft's documentation](https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent), Copilot Studio should automatically attach the Bearer token to all subsequent MCP calls. If this doesn’t happen, it may be due to: - A misconfigured redirect URI. - The token not being stored or refreshed correctly. - A limitation in how Copilot Studio handles OAuth2.0 for streamable MCP connectors. 4. **Connector Setup**: If you created the connector via UI rather than Swagger code, ensure that the security definitions are properly bound to the operations. Sometimes UI-generated connectors may not fully respect the OAuth2.0 flow unless manually adjusted. 5. **Debugging**: Try inspecting the failing requests using a proxy or logging middleware to confirm whether the `Authorization: Bearer` header is present. If it's missing, Copilot Studio may not be binding the token correctly to the session. Please verify if this response was helpful. Thanks and best regards, Daniele *Note: This response was prepared with support from Copilot to ensure clarity and completeness.*
Under review
Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.
As AI tools become more common, we’re introducing a Responsible AI Use…
We are honored to recognize Tom Macfarlan as our Community Spotlight for October…
These are the community rock stars!
Stay up to date on forum activity by subscribing.
Romain The Low-Code... 523 Super User 2025 Season 2
Michael E. Gernaey 378 Super User 2025 Season 2
DAnny3211 132
