Embedding Copilot Studio agent inside a Power BI report — iframe / auth blocked (X-Frame/CSP / login.microsoftonline refused to connect)

Question

Embedding Copilot Studio agent inside a Power BI report — iframe / auth blocked (X-Frame/CSP / login.microsoftonline refused to connect)

TUSHAR SAKHUJA 5

I published a Copilot Studio agent (demo & custom web app) and am trying to embed it directly inside a Power BI report (Web Content / iFrame / Custom visual). The bot works fine on its demo/live site, but when I add it to Power BI the agent fails to load due to authentication/iframe restrictions — the browser shows framing errors (e.g. “Refused to display” / login.microsoftonline refused to connect) and I suspect X-Frame-Options / Content-Security-Policy frame-ancestors or Azure AD interactive login blocking the iframe.

I’ve already tried:

Using the Copilot demo site embed snippet and a self-hosted web app (both published from Copilot Studio).

Adding it inside Power BI’s Web Content / HTML viewer and a custom visual.

Enabling different agent publish/auth options (demo/no-auth vs Authenticate with Microsoft).

What is the recommended way to embed a Copilot Studio agent inside a Power BI report so it works for authenticated users (best-practice architecture, required authentication flow, and headers/CSP that must be set)? If embedding in an iframe is not supported because of Microsoft login/X-Frame/CSP restrictions, please suggest supported alternatives (Power Apps visual, side-panel web app with token-based auth, or Power BI Embedded with service principal + backend proxy) and any sample config/snippets that have worked for you.

0 comments

2 answers

Your answer

Answer 1

Nivedipa-MSFT 4,251 Microsoft External Staff Moderator

@Tushar Sakhuja - Embedding a Copilot Studio agent in Power BI via iframe isn't supported due to authentication and security restrictions. Instead, use the Power Apps visual to integrate your agent, or consider alternatives like a side web app with token-based authentication, a "No authentication" agent (with limitations), or Power BI Embedded with a backend proxy.

See the references for more details:

Nivedipa-MSFT 4,251 Reputation points Microsoft External Staff Moderator

2025-11-29T06:01:50.53+00:00

@Tushar Sakhuja - Could you please confirm if your issue resolved with above information or are you still looking for additional information?
TUSHAR SAKHUJA 5 Reputation points

2025-12-01T05:12:27.4166667+00:00

Thanks for the clarification. Yes, I do need authentication enabled for my Copilot Studio agent, so the “No authentication” option unfortunately won’t work in my case.

I also tried using the Power Apps visual inside Power BI, but the issue persists, the embedded page stays completely blank/white, and the Copilot Studio agent (or any website connected to the Fabric Data Agent) does not load at all. There are no visible UI elements from the agent, so the Power Apps visual approach isn’t working for me either.

Given these limitations, my next step is to try Power BI Embedded with a backend proxy, as suggested. I haven’t implemented that yet, but it seems like the only option that may handle the authentication flow cleanly without iframe/X-Frame restrictions.

I’ll update once I test the backend proxy approach. If you have a working example or recommended architecture for securely hosting a Copilot Studio agent behind a proxy for Power BI Embedded, please share, it would really help.

Answer 2

Embedding a Copilot Studio agent directly inside a Power BI report using an iframe can be challenging due to authentication and security restrictions such as X-Frame-Options and Content-Security-Policy (CSP) headers. Here are some considerations and recommendations:

Authentication Issues: The automatic authentication capabilities do not work when embedded in applications, including Power BI. This means that users will need to sign in again to access the agent, which can lead to issues with iframe loading.
X-Frame-Options and CSP: If the agent is being blocked due to X-Frame-Options or CSP settings, you may not be able to embed it directly in Power BI. The login.microsoftonline refusal indicates that the authentication flow is being blocked by these security measures.
Alternative Embedding Options:
- Power Apps Visual: Consider using a Power Apps visual within Power BI, which can provide a more integrated experience and may allow for better handling of authentication.
- Side-Panel Web App: You could implement a side-panel web app that communicates with the Power BI report and handles the authentication flow separately.
- Power BI Embedded with Service Principal: This method allows for a backend proxy to manage authentication and can be a more secure way to handle user sessions without exposing sensitive information in the client-side code.
Best Practices: Ensure that your CSP settings on the server hosting the Copilot agent allow for embedding in the required contexts. You may need to adjust the frame-ancestors directive to include the domain of your Power BI report.
Sample Configurations: Unfortunately, specific code snippets or configurations are not provided in the context, but you may want to explore the documentation for Power BI Embedded and how to set up service principals for authentication.

In summary, due to the restrictions around iframes and authentication, it is recommended to explore alternative methods such as Power Apps visuals or Power BI Embedded with a service principal for a more seamless integration.

References: