Seamless SSO with Custom Connectors in Copilot Studio
Diesen Beitrag auf Deutsch lesen
Configure Entra ID OAuth, Azure API Connections and connector security so Copilot Studio users can authenticate without the connection manager.
TL;DR
Microsoft Copilot Studio can provide SSO for Entra ID OAuth custom APIs and MCP servers through Custom Connectors. Configure the server and connector app registrations, permissions, Azure API Connections authorization and connector OAuth settings. Users still approve consent once, after which the connection is created and authenticated in the background.
Original by Dave Burman, on The Custom Engine. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Makers: Configure both app registrations, delegated permissions, Azure API Connections authorization and Custom Connector OAuth settings; skipping the authorized-client step can make SSO work for the maker but fail for other users.
- Admins/CoE: Ensure users exist in the environment and have access to the Custom Connector; this supports background connection creation when they invoke the tool.
Frequently asked questions
How does consent work for Entra ID OAuth Custom Connectors in Copilot Studio?
Users approve consent the first time a tool uses their credentials on their behalf. The prompt is expected and currently unavoidable.
Why can Custom Connector SSO work for a maker but fail for another Copilot Studio user?
The Azure API Connections service may not have been added as an authorized client, causing background connection creation to fail for another user.
What does the MCP Onboarding Wizard create for Copilot Studio authentication?
The wizard creates a Custom Connector in the background. Complete its initial authentication, then update the connector security information.