Share via

Configure user authentication in Copilot Studio

  • Article

Authentication allows users to sign in, giving your agent access to a restricted resource or information. Users can sign in with Microsoft Entra ID, or with any OAuth2 identity provider such as Google or Facebook.

Note

In Microsoft Teams, you can configure a Copilot Studio agent to provide authentication capabilities, so that users can sign in with a Microsoft Entra ID or any OAuth2 identity provider, such as a Microsoft or Facebook account.

You can add end-user authentication to topics when you edit a topic.

Important

Changes to the authentication configuration only take effect after you publish your agent. Make sure to plan ahead before you make authentication changes to your agent.

Choose an authentication option

Copilot Studio supports several authentication options. Choose the one that meets your needs.

  1. Go to Settings for your agent, and select Security.

  2. Select Authentication.

    The following authentication options are available:

  3. Select Save.

No authentication

No authentication means your agent doesn't require your users to sign in when interacting with the agent. An unauthenticated configuration means your agent can only access public information and resources. Classic chatbots are configured by default to not require authentication.

Caution

Selecting the No authentication option allows anyone who has the link to chat and interact with your bot or agent.

We recommend you apply authentication, especially if you are using your bot or agent within your organization or for specific users, along with other security and governance controls.

Authenticate with Microsoft

Important

When the Authenticate with Microsoft option is selected, all channels except the Teams channel are disabled.

Additionally, the Authenticate with Microsoft option isn't available for agents that are integrated with Dynamics 365 Customer Service.

This configuration automatically sets up Microsoft Entra ID authentication for Teams without the need for any manual configuration. Since Teams authentication itself identifies the user, users aren't prompted to sign in while they're in Teams, unless your agent requires an expanded scope.

Only the Teams channel is available if you select this option. If you need to publish your agent to other channels but still want authentication for your agent, choose Authenticate manually.

If you select Authenticate with Microsoft, the following variables are available in the authoring canvas:

  • User.ID
  • User.DisplayName

For more information about these variables and how to use them, see Add end-user authentication to topics.

User.AccessToken and User.IsLoggedIn variables aren't available with this option. If you need an authentication token, use the Authenticate manually option.

If you change from Authenticate manually to Authenticate with Microsoft, and your topics contain the variables User.AccessToken or User.IsLoggedIn, they're displayed as Unknown variables after the change. Make sure to correct any topics with errors before you publish your agent.

Authenticate manually

Copilot Studio supports the following authentication providers under Authenticate manually option:

  • Azure Active Directory
  • Azure Active Directory v2
  • Azure Active Directory v2 with Certificates
  • Generic OAuth 2 - Any identity provider that complies with the OAuth2 standard

The following variables are available in the authoring canvas after you configure manual authentication:

  • User.Id
  • User.DisplayName
  • User.AccessToken
  • User.IsLoggedIn

For more information about these variables and how to use them, see Add end-user authentication to topics.

Once the configuration is saved, make sure to publish your agent so the changes take effect.

Note

  • Authentication changes only take effect after the agent is published.
  • This setting can be controlled by the corresponding admin control in Power Platform. When the control is enabled, it prevents the Authenticate manually option from being enabled or disabled within Copilot Studio. The control is always enabled, and the Authenticate manually option can't be modified in Copilot Studio.

Required user sign in and agent sharing

Require users to sign in determines whether a user needs to sign in before talking with the agent. We highly recommend that you turn on this setting for agents that need to access sensitive or restricted information.

This option isn't available for the No authentication and Authenticate with Microsoft options.

Note

This option is also not configurable when DLP policy in the Power Platform admin center is configured to require authentication. For more information, see Data loss prevention example - Require end-user authentication in agents.

If you turn off this option, your agent doesn't ask users to sign in until it encounters a topic that requires them to.

When you turn on this option, it creates a system topic called Require users to sign in. This topic is only relevant for the Authenticate manually setting. Users are always authenticated on Teams.

The Require users to sign in topic is automatically triggered for any user who talks to the agent without being authenticated. If the user fails to sign in, the topic redirects to the Escalate system topic.

The topic is read-only and can't be customized. To see it, select Go to the authoring canvas.

Control who can chat with the agent in the organization

Your agent's authentication and Require user to sign in setting in combination determines whether you can share the agent to control who in your organization can chat with it. The authentication setting doesn't affect sharing an agent for collaboration.

  • No authentication: Any user who has a link to the agent (or can find it; for example, on your website) can chat with it. You can't control which users in your organization can chat with the agent.

  • Authenticate with Microsoft: The agent works only on the Teams channel. Since the user is always signed in, the Require users to sign in setting is turned on and can't be turned off. You can use agent sharing to control who in your organization can chat with the agent.

  • Authenticate manually:

    • If the service provider is either Azure Active Directory or Microsoft Entra ID, you can turn on Require users to sign in to control who in your organization can chat with the agent using agent sharing.

    • If the service provider is Generic OAuth2, you can turn Require users to sign in on or off. When turned on, a user who signs in can chat with the agent. You can't control which specific users in your organization can chat with the agent using agent sharing.

When an agent's authentication setting can't control who can chat with it, if you select Share on the agent's overview page a message informs you that anyone can chat with your agent.

Manual authentication fields

The following are all the fields you can see when you're configuring manual authentication. Which fields you see depends on your choice for service provider.

Field name Description
Authorization URL template The URL template for authorization, as defined by your identity provider. For example, https://login.microsoftonline.com/common/oauth2/v2.0/authorize
Authorization URL query string template The query template for authorization, as provided by your identity provider. Keys in the query string template vary, depending on the identity provider (?client_id={ClientId}&response_type=code&redirect_uri={RedirectUrl}&scope={Scopes}&state={State}).
Client ID Your client ID, obtained from the identity provider.
Client secret Your client secret, obtained when you created the identity provider app registration.
Refresh body template The template for the refresh body (refresh_token={RefreshToken}&redirect_uri={RedirectUrl}&grant_type=refresh_token&client_id={ClientId}&client_secret={ClientSecret}).
Refresh URL query string template The refresh URL query string separator for the token URL, usually a question mark (?).
Refresh URL template The URL template for refresh; for example, https://login.microsoftonline.com/common/oauth2/v2.0/token.
Scope list delimiter The separator character for the scope list. Empty spaces aren't supported in this field.1
Scopes The list of scopes that you want users to have after they've signed in. Use the Scope list delimiter to separate multiple scopes.1 Only set necessary scopes and follow the least privilege access control principle.
Service provider The service provider you want to use for authentication. For more information, see OAuth generic providers.
Tenant ID Your Microsoft Entra ID tenant ID. Refer to Use an existing Microsoft Entra ID tenant to learn how to find your tenant ID.
Token body template The template for the token body. (code={Code}&grant_type=authorization_code&redirect_uri={RedirectUrl}&client_id={ClientId}&client_secret={ClientSecret})
Token exchange URL (required for SSO) This optional field is used when you're configuring single sign-on.
Token URL template The URL template for tokens, as provided by your identity provider; for example, https://login.microsoftonline.com/common/oauth2/v2.0/token.
Token URL query string template The query string separator for the token URL, usually a question mark (?).

1 You can use spaces in the Scopes field if the identity provider requires it. In that case, enter a comma (,) in Scope list delimiter, and enter spaces in the Scopes field.

Turn off authentication

  1. With your agent open, select Settings on the top menu bar.

  2. Select Security, then select Authentication.

  3. Select No authentication.

    If authentication variables are used in a topic, they become Unknown variables. Go to the Topics page to see which topics have errors and fix them before publishing.

  4. Publish the agent.

Important

If your agent has actions configured to use end-user credentials, don't turn off authentication at the agent level, since this would prevent these actions from working.