Custom Copilot Studio Agent – MCP Connector Consent Stuck on "Agree" in Microsoft Teams (works fine in Copilot Studio & M365 Copilot Chat)

Question

Issue Description: We've built a custom agent in Copilot Studio with several MCP tools registered (Calendar, Mail, Teams, User, Copilot). The agent works correctly when tested:

• Inside Copilot Studio's own Test pane
• Via Microsoft 365 Copilot Chat

However, when the same agent is added to Microsoft Teams and a user interacts with it, the Work IQ Teams MCP tool shows the standard connector consent message:

"Work IQ Teams MCP – Connecting to other services with your credentials may expose your data to privacy and security risks. Once you connect, we'll remember your settings and use them next time."

with an "Agree" button. Clicking Agree does not proceed to a sign-in/authorization screen — it stays stuck on the same message with no error shown.

Steps Already Verified:

• Admin consent granted for the connector's app registration in Entra ID
• Redirect URIs reviewed and appear correctly configured
• Teams Admin Center → app is approved/allowed, no pending permission requests
• Re-published the agent after tool config changes
• Tested in Teams desktop and Teams web
• Confirmed connection reference exists in Power Platform Connections for this environment

Despite all the above being in order, the issue persists only in the Teams channel — Copilot Studio and M365 Copilot Chat both work fine with the same connector.

Any guidance or troubleshooting steps from someone who's hit this would be appreciated.

Answer 1

Hello @Jagan Manoharan,

Based on the information provided, I understand that you are experiencing an issue when using the Work IQ Teams MCP to connect to a Teams channel.

However, to ensure you receive the most accurate and professional assistance, I recommend posting your query on the Microsoft Power Platform Community Forum Thread. This platform is specifically dedicated to Copilot Studio and is supported by a knowledgeable group of experts and partners who regularly contribute and share insights. 

I suggest creating a new topic in the Power Platform Community rather than posting in the Microsoft Answers forum. The Answers forum primarily focuses on Microsoft 365-related concerns and has limited resources and expertise in Copilot Studio. By posting in the correct community, you’ll likely receive quicker and more precise guidance. 

I apologize for redirecting you, but this approach will help ensure that your query is reviewed by the most qualified Copilot Studio specialists and community members.

Answer 2

For this Teams-only consent stall, the supported checks are the Teams/Microsoft 365 Copilot authentication mismatch items and Teams channel limitations.

1. Verify the OAuth redirect URI used by Teams is registered exactly: https://teams.microsoft.com/api/platform/v1.0/oAuthRedirect If this redirect URI is missing or mismatched, users can’t sign in or token exchange can fail.
2. If the MCP flow uses Microsoft Entra SSO or on-behalf-of flow, verify these Entra app settings:
   • The Application ID URI generated by the Teams developer portal is added to identifierUris.
   • https://teams.microsoft.com/api/platform/v1.0/oAuthConsentRedirect is added under Redirect URIs for the Web platform.
   • The Microsoft Enterprise token store client ID ab3be6b7-f5df-413d-ac2d-abf1e3fd9c0b is added as an allowed client application under Expose an API, and also as an allowed token audience if client app ID validation is enforced. A missing value here can prevent the consent prompt from progressing.
3. In the Teams developer portal, confirm the plugin auth configuration matches the MCP/plugin manifest exactly:
   • Base URL in auth config matches the MCP server url in the plugin manifest.
   • reference_id in runtime authentication matches the auth config ID from Teams developer portal.
   • App restriction (Restrict usage by app) and org restriction (Restrict usage by org) allow the Teams app and tenant.
4. Check whether the OAuth provider returns 307 Temporary Redirect from the token endpoint. That response isn’t supported and can block authentication completion.
5. Since the issue is isolated to Teams while Copilot Studio Test pane and Microsoft 365 Copilot Chat work, treat this as a Teams-surface authentication/configuration issue rather than a Copilot Studio connector issue. A similar pattern is documented where authentication can behave differently across Copilot surfaces.
6. If the tool is specifically Work IQ Teams, also verify the user has the required Microsoft 365 Copilot license. A missing license can cause 403 Forbidden, and after license assignment provisioning can take 15–30 minutes.
7. If users previously connected and the state is stale, force reauthentication:
   • In Microsoft 365 Copilot, users can sign out from Chat settings > Agents.
   • For Entra SSO, stored tokens can persist; forcing reauthentication requires removing user consent or revoking sessions with Microsoft Graph revokeSignInSessions.
8. If all of the above is already correct, the remaining documented path is to capture authentication debug details in Microsoft 365 Copilot by enabling developer mode and inspect the debug information card for one of these specific failures:
   • app ID mismatch
   • base URL mismatch
   • missing/incorrect reference_id
   • org/app restriction
   • sign-in popup failure

Given the exact symptom — Agree loops without advancing only in Teams — the highest-value checks are the Teams redirect URIs, Entra SSO consent settings, and Teams developer portal auth config alignment.

---

References:

• Troubleshoot MCP and API plugin authentication
• Connect and configure an agent for Teams and Microsoft 365
• Connect agents to Microsoft 365 with Work IQ (preview) (vscode)
• M365 Copilot - Cowork cannot make a connection to custom MCP - Microsoft Q&A