Microsoft Copilot Studio SSO Error: IntegratedAuthenticationNotSupportedInChannel

Question

Context

I'm implementing a chat widget using Microsoft Copilot Studio with Single Sign-On (SSO) through Microsoft Authentication Library (MSAL). The implementation follows the official documentation for SSO configuration, but we're encountering an authentication channel support issue.

The aim is to have a custom application created in React, using a Copilot Studio agent configured for manual authentication but using SSO so that you don't have to use the code to log in, but rather the user's Microsoft account.

Current Implementation

Authentication Flow

1. User authentication is handled through MSAL
2. The chat widget uses DirectLine API for bot communication
3. We're using a custom web implementation with the following components:

Code Structure

• auth.service.ts: Handles MSAL authentication and token management
• chat.service.ts: Manages DirectLine API communication
• LoginScreen.tsx: Handles user authentication UI and flow

Current Authentication Process

1. MSAL initialization is successful:

const msalConfig = {
    auth: {
        clientId: 'CLIENT_ID',
        authority: 'https://login.microsoftonline.com/APP_ID',
        redirectUri: window.location.origin,
    },
    cache: {
        cacheLocation: 'sessionStorage',
        storeAuthStateInCookie: false,
    },
    system: {
        allowRedirectInIframe: false,
        asyncPopups: true,
    },
};

2. User authentication succeeds and returns valid tokens, which we include in our headers:

// Headers configuration
private getHeaders(token: string): Record<string, string> {
    const headers: Record<string, string> = {
        'Content-Type': 'application/json',
    };

    if (this.aadToken) {
        headers.Authorization = `Bearer ${token}`;
        headers['x-ms-token-aad-id-token'] = this.aadToken;
    } else {
        headers.Authorization = `Bearer ${token}`;
    }

    return headers;
}

Error Details

After successful authentication, when trying to start a conversation, we receive the following error:

Sorry, something unexpected happened. We're looking into it. 
Error code: IntegratedAuthenticationNotSupportedInChannel
Conversation ID: 4rNOj*****************
Time (UTC): 3/15/2025 11:20:02 AM

Logs

auth.service.ts:170 ✅ MSAL initialized successfully
auth.service.ts:174 ✅ Redirect promise handled
LoginScreen.tsx:16 🔐 Starting Microsoft authentication...
auth.service.ts:34 🔑 Generating Power Platform token...
LoginScreen.tsx:19 ✅ Authentication successful
auth.service.ts:34 🔑 Generating Power Platform token...
chat.service.ts:102 ❌ Error: IntegratedAuthenticationNotSupportedInChannel

Questions

1. Why is integrated authentication not supported in our channel configuration?
2. Do we need to enable specific features in Microsoft Copilot Studio to support SSO?
3. Is there a specific channel configuration required for integrated authentication?
4. Are we missing any required permissions or settings in the both app registrations?

What We've Tried

1. Verifying MSAL configuration and tokens
2. Implementing the authentication flow as described in the documentation
3. Checking Microsoft Copilot Studio channel configuration
4. Reviewing app registration settings

References

• Microsoft Documentation: Configure SSO with Microsoft Entra ID
• Receive activities from the bot in Direct Line API 3.0
• Enable Single Sign On for Copilot Studio Bot

Any guidance on resolving this authentication channel support issue would be greatly appreciated.