Configure Microsoft Entra ID authentication

Microsoft Copilot Studio agents created from Power Pages use Generic OAuth 2 authentication with implicit flow by default. This configuration limits access to the Power Pages site and supports all configured identity providers.

If your organization requires Microsoft Entra ID-exclusive authentication and you need to test agents directly in Copilot Studio, you can configure Microsoft Entra ID authentication. This configuration enables:

• Secure authentication through Microsoft Entra ID
• Direct testing capabilities in Copilot Studio
• Single sign-on (SSO) integration with Power Pages

This article walks you through the configuration process, which involves creating app registrations, configuring permissions, and updating site settings to establish secure authentication between your Power Pages site and Copilot Studio agent.

Prerequisites

Before you begin, ensure that:

• You created or added a site agent to Power Pages. For more information, see Add an agent from the setup workspace.
• You have a Microsoft 365 administrator account with permission to create and manage app registrations in Microsoft Entra ID.

Overview of configuration process

This configuration uses two app registrations. One app registration is preconfigured during Power Pages site provisioning (site app), and you create the other app registration during setup (agent app) to use for configuring the agent. The configuration process consists of the following steps:

1. Create a new app registration for Copilot Studio authentication.
2. Update the Power Pages site–associated app registration to pass the SSO token.
3. Configure authentication settings in Copilot Studio.
4. Update Power Pages site settings.
5. Add the Copilot authentication app client ID to the bot consumer record.

Step 1: Update the Power Pages site app registration

1. Sign in to Power Pages.
2. Select + Edit.
3. Go to the Set up workspace.
4. Copy the Application ID associated with the site.
5. In the Azure portal, find the app registration with the same Application ID.

Add required API permissions

Add the following delegated permissions:

1. Under Manage, select API Permissions.
2. Select Add permission and then select Microsoft Graph.
3. Select Delegated permissions.
4. Expand OpenId permissions and turn on openid and profile.
5. Select Add permissions.
6. Select Add permission and select APIs my organization uses.
7. Search Power Platform API and select it.
8. Select Delegated permissions.
9. Expand CopilotStudio and select CopilotStudio.Copilots.Invoke.
10. Select Add permissions.
11. Select Grant admin consent.

Step 2: Configure Microsoft Entra ID for agent

Refer to detailed steps in Configure user authentication with Microsoft Entra ID for configuring authentication for an agent associated with Power Pages.

The app registration you use to configure the agent should allow token exchange between Power Pages site and agent. Follow these steps to enable it:

Add the redirect URL

Add the Power Pages site URL as the redirect URL to the app you configured for the agent.

1. Under Manage, select Authentication.
2. Under Redirect URI Configuration, select Add Redirect URI , and then select Single-page Application.
3. Enter the Power Pages site URL (for example, https://contoso.powerappsportals.com).

Add API permissions

1. Under Manage, select API Permissions.
2. Select Add permission and select APIs my organization uses.
3. Search for Power Platform API and select it.
4. Select Delegated permissions.
5. Expand CopilotStudio and select CopilotStudio.Copilots.Invoke.
6. Select Add permissions.
7. Select Add a permission and select APIs my organization uses.
8. Search for Power Pages site Application (client) ID and select it.
9. Select Delegated permissions.
10. Expand Permissions and select scope name defined in Agent App (for example, user_impersonation).
11. Select Add permission.
12. Select Grant admin consent.

Enable single sign-on

1. Under Manage, select Expose an API.
2. Under Authorized client applications, select Add a client application.
3. Add the Power Pages site Application (client) ID.
4. Select Authorized scopes checkbox.
5. Select Add permission.
6. Copy the scope.

Step 3: Update custom scopes of Power Pages site app registration

This step is optional and required to call Power Pages API from the agent. If you created an agent from a Power Pages site, you must:

1. In the Azure portal, select Site App registration.

2. Under Manage, select API permissions.

3. Select Add a permission and select APIs my organization uses.

4. Search for Agent App Application (client) ID and select it.

5. Select Delegated permissions.

6. Expand Test and select scope name defined in Agent App (for example, Test.Read).

7. Select Add permission.

8. Select Grant admin consent.

9. Select Expose an API and select the Edit button next to Application ID URI.

   Note

   The Application ID URI must be in the format api://<client id of the current application>. This value might be different. Modify this value to properly reflect the current application.

10. Copy the scope.

Step 4: Update scopes in Agent security configuration

You copied two scopes, one from each app registration. These scopes enable single sign-on (SSO) for the Power Pages site and grant the agent permission to access the Power Pages Web API.

1. Open Agent added to site.
2. Under Settings, select Security > Authentication.
3. Paste the Agent App scope under Token exchange URL (required for SSO).
4. Paste the Site App scope next to the existing scope.
5. Select Save.
6. Close the Settings page.
7. Publish agent.

Step 5: Configure Power Pages site settings

In Power Pages, add or update the following site settings:

Name	Value
Authentication/BearerAuthentication/Enabled	true
Authentication/BearerAuthentication/Provider	AzureAD
Authentication/BearerAuthentication/UseEntraV2Issuer	true
Authentication/BearerAuthentication/ValidIssuer	https://login.microsoftonline.com/<tenant-id>/v2.0
SiteCopilot/PVA/AuthenticationMethod	OpenIdConnect

Step 6: Add the Copilot authentication client ID to the bot consumer

1. Open the Power Pages site in edit mode.
2. Determine site datamodel.
3. Go to the Data workspace.
4. Update Agent App ClientId to corresponding agent record.

Standard data model

1. Search for and select the Bot consumer table.

2. Locate the row with the selected website name and agent schema name.

3. Add the following value "clientId": "<AgentAppClientID>" as shown in the following example.

     {"botSchemaName":"cr720_agentSchema","clientId":"00000000-0000-0000-0000-000000000000"}
   

4. Save the record.

Enhanced data model

1. Search for and select the Site Component table.

2. Find the Component Type column and select the filter icon next to it.

3. Filter the records by selecting the Bot Consumer option.

4. Locate the row with the selected website name in the Power Pages Site id column and agent schema name.

5. Choose Edit row using form.

6. In Content, add the following value to the configjson node: "clientId": "<AgentAppClientID>" as shown in the following example.

     {"botschemaname":"cr720_agentSchema","configjson":"{\"clientId\":\"00000000-0000-0000-0000-000000000000\",\"version\":\"v2\" }" ,"adx_botconsumer_adx_webrole":["00000000-0000-0000-0000-000000000000"] } 
   

7. Choose Save & Close.

Related information

• Add an agent - overview
• Add an agent to your Power Pages site
• Overview of AI-powered and Copilot features in Power Pages
• Responsible AI: FAQ for site agent
• Configure user authentication for an agent