The 403 VoiceProvisioningForbidden error with message User doesn't have enough rights to assign role b24988ac-6180-42a0-ab88-20f7382dd24c to service principal <Power Virtual Agents Service> indicates a permission issue in Azure when Copilot Studio tries to complete the WhatsApp–ACS wiring.
To resolve the Copilot Studio error “Error connecting to WhatsApp phone number. Please try again.” in this scenario, ensure the following are in place and then retry the WhatsApp channel configuration in Copilot Studio:
- In Azure, assign the required role to the Power Virtual Agents Service enterprise application
- Identify the service principal shown in the error (the enterprise application “Power Virtual Agents Service”).
- In the Azure portal, on the subscription or resource group that contains the Azure Communication Services (ACS) resource, assign the built‑in Contributor role (ID
b24988ac-6180-42a0-ab88-20f7382dd24c) to this service principal. - This allows Copilot Studio to perform the provisioning operations against ACS and the phone number on your behalf.
- Verify ACS and WhatsApp channel prerequisites are fully satisfied
- Confirm the WhatsApp Business Account is correctly connected as a channel in the ACS resource and that the channel status is Active, as required in the WhatsApp channel prerequisites.
- Ensure the phone number used is the same one that was provisioned in ACS and linked in Meta’s WhatsApp Business Manager. The number must be unique to this WhatsApp Business Account and not used elsewhere.
- Make sure the Event Grid Viewer and SMS Received event subscription are still active so that verification codes and events can flow correctly while connecting WhatsApp to ACS.
- Reconnect the Copilot Studio agent to WhatsApp
- In Copilot Studio, set the agent authentication to either No authentication or Authenticate manually, as required for WhatsApp.
- Publish the agent.
- Go to Channels → WhatsApp, select the same Azure subscription and ACS resource, then select the phone number and choose Deploy.
- After permissions are corrected, the deployment should complete and display the QR code for testing the WhatsApp channel.
- If the number was previously used only via Dynamics 365 Customer Service
- Ensure the ACS WhatsApp channel remains active and correctly configured there (channel ID, Event Grid app ID, tenant ID, connection string, and channel ID all matching the ACS resource details).
- Disconnecting the agent from the Dynamics workstream is fine, but the underlying ACS configuration must remain valid so Copilot Studio can bind directly to the same ACS WhatsApp channel.
Once the Contributor role is granted to the Power Virtual Agents Service service principal and all ACS/WhatsApp prerequisites are intact, the Copilot Studio WhatsApp channel deployment should succeed and allow use of adaptive cards over the WhatsApp channel as described in the publication guidance.
References: