Credential issue for tool call with copilot studio agent

Question

Agent has been working great up until today. Would ask user to allow tool and then run

Now when it uses a query power bi data set tool

1. agent asks user to allow tool
2. says it couldn't connect. Open connection manager to verify your credentials.
3. credential shows as being stale or disconnected even when having just been connected
4. changing to "maker-provided credentials" does not solve, teams still asks for credentials and refuses connection

Answer 1

It usually happens when someone is trying to access the agent first time, also if you made any changes to your agent and republished it , it could show the same error.

Answer 2

Rob Maher, The previous answers cover the admin policy check well — worth doing if you haven't yet. But your specific symptom of "stale even when just reconnected" points to a token refresh problem at the connector level, which is a separate issue. Here's what to try:

1. Check Microsoft Service Health first Since this broke on a specific date with no changes on your end, check if there was a service incident:

• M365 Admin Center → Health → Service health → filter by Power Platform / Power BI
• Check around April 28 for any connector or authentication incidents

2. Force a full token refresh on the connection The stale-on-reconnect symptom usually means the OAuth token is cached in a broken state:

• Go to make.powerapps.com → Connections
• Find the Power BI connection → Delete it completely
• Create a brand new connection (don't edit the existing one)
• Go back to Copilot Studio → Tools → Power BI tool → relink to the new connection → republish

3. Check connection sharing If the tool uses maker credentials, the connection must be explicitly shared with the agent:

• In make.powerapps.com → Connections → select the Power BI connection → Share → add the agent's service principal

→ Share connections with agents

Answer 3

The behavior matches an authentication/credentials policy change in the environment rather than a problem with the Power BI tool itself.

Key points from the current platform behavior:

1. Check if maker-provided credentials have been disabled
   • Admins can now control whether tools in Copilot Studio are allowed to use maker-provided credentials or must use end-user credentials only.
   • If the environment (or its environment group) has been configured to prevent maker-provided credentials, then:
     • Any existing tools that were using maker credentials are forced to use end-user credentials at runtime.
     • The UI in Copilot Studio will hide/disable maker-credential options, or force a change before publishing.
     • Agents require each user to authenticate for the tool, and background/autonomous runs fail.
   • This would explain:
     • Teams always asking for credentials.
     • Connections appearing stale/disconnected even after reconnecting, because the policy enforces end-user auth and the tool can no longer run with the original maker connection.
2. Confirm the environment policy in Power Platform admin center Ask an Environment Admin / Power Platform Administrator / Global Admin to:
   1. Go to the Power Platform admin center.
   2. Select Manage → Environments (or Environment groups if used).
   3. Open the target environment (or environment group) details.
   4. Go to Settings → Product → Features.
   5. In Copilot Studio agents → Control maker credential options, verify which options are enabled:
      • End-user credentials
      • Maker-provided credentials
   6. If the intention is to allow the agent to run with the maker’s connection, ensure Maker-provided credentials is enabled and save.
   7. Wait for propagation, then republish and retest the agent.
3. Recheck the tool configuration in Copilot Studio After confirming the admin setting:
   1. Open the agent in Copilot Studio.
   2. Go to Tools → select the Power BI dataset tool.
   3. In Details → Additional details → Authentication / Credentials to use, ensure it is set to Maker-provided credentials (if allowed by policy).
   4. Publish the agent again and test in Teams.
4. If end-user credentials are enforced by design If the admin policy intentionally enforces End-user credentials only:
   • Every user must sign in and maintain their own connection for the Power BI tool.
   • The action runs strictly under the end-user’s identity; if they lack access to the dataset, the tool will fail.
   • Autonomous/background usage of the agent for that tool will not work; an active user session is required.
5. Check for environment group override
   • If the environment is part of an environment group, the group’s settings override the individual environment.
   • In that case, the admin must change the Control maker credential options at the environment group level; the options will be read-only on the single environment page.

If the issue started “today” without changes in the agent, the most likely cause is that an admin recently enabled enforcement of end-user credentials (disabling maker-provided credentials) at the environment or environment-group level, which changed how your existing Power BI tool authenticates.

---

References:

• Control maker-provided credentials for authentication
• Configure user authentication for tools
• Configure and manage connections
• Add tools to custom agents
• Use Power Platform connectors as tools