Power Platform Community Forum Thread Details

Hello Team,

We are currently working on integrating Microsoft Copilot Studio with our web application using the Microsoft 365 Agents SDK, following the documentation provided at:
https://learn.microsoft.com/en-gb/microsoft-copilot-studio/publication-integrate-web-or-native-app-m365-agents-sdk?tabs=dotnet&source=docs#configure-your-app-registration-for-service-principal

The current documentation recommends using App Client Secrets for authentication when configuring the Azure Active Directory (AAD) App Registration for service principal authentication. However, we wanted to inquire if there are any alternative authentication methods available that we could consider instead of using client secrets since, the use of client secrets is disable for our tenant.

Could you please provide guidance on:
- Whether alternative authentication methods are supported for Copilot Studio integration
- If available, documentation or examples for implementing these alternatives

We would greatly appreciate any information or resources you can share regarding secure authentication alternatives for this integration.

Thank you for your time and assistance. We look forward to your response.

Categories:

Publish & channel management

Hi,

If client secrets are disabled in your tenant, check whether certificate-based authentication is supported for your Microsoft Entra app registration. Many organizations prefer certificates over client secrets because they provide stronger security and align better with enterprise governance requirements.
You should also verify the authentication requirements of the Microsoft 365 Agents SDK endpoint you're using, as some scenarios may currently document client secrets as the primary approach. If certificate authentication isn't supported for that specific integration path yet, it would be worth raising a feature request or support case to confirm the roadmap.
In short, I'd recommend:

Testing certificate-based authentication with your app registration.
Reviewing the SDK authentication requirements for your specific scenario.
Opening a Microsoft support ticket if the documentation only references client secrets and doesn't clarify alternative supported methods.

A support engineer should be able to confirm whether certificate-based authentication is officially supported for Copilot Studio integrations using the Microsoft 365 Agents SDK.

Thanks & Regards,

Manoj Annavajjala