Copilot Studio MCP Server with Manual OAuth 2.0 prompts re-authentication on every access token expiry instead of using refresh token

Question

Environment

Field	Value
Product	Microsoft Copilot Studio (Agent with MCP tool)
MCP server exposed via	Azure API Management
Auth type	OAuth 2.0 - Manual configuration
Identity provider	Azure Active Directory
Token endpoint	Custom /token endpoint deployed in APIM, calling Azure AD internally

---

Problem Description

I have a Copilot Studio agent connected to a remote MCP server protected by OAuth 2.0 (manual configuration). The initial authentication flow works correctly: the user authenticates, the agent receives an access token, and tool calls succeed.

However, when the access token expires, Copilot Studio displays the following dialog to the user:

"Let's get you connected first, and then I can find that info for you. Open connection manager to verify your credentials. Once the connection is ready, retry your request."

The user is forced to manually reconnect every time the token expires.

---

Expected Behavior

When the access token expires and a refresh token is available, Copilot Studio should automatically call the configured token endpoint with grant_type=refresh_token to silently obtain a new access token — without interrupting the user.

---

Observed Behavior

Copilot Studio does not attempt a token refresh at all. From APIM logs, no request is made to the /token endpoint when the access token expires. Copilot Studio silently drops the connection and immediately surfaces the re-authentication prompt to the user, without ever attempting to contact the token endpoint.

---

Why This Is a Client-Side Issue

The same /token endpoint works correctly in other MCP clients:

Client	Behavior on token expiry
Claude (Anthropic)	Calls /token silently, no user prompt
VS Code MCP client	Calls /token silently, no user prompt
Copilot Studio	Makes no request to /token, prompts user to reconnect

This confirms the APIM setup and the Azure AD token endpoint are correctly configured. The complete absence of any request to APIM on token expiry confirms the problem is Copilot Studio not implementing the refresh token grant flow.

---

What I Have Tried

• Verified the refresh token is issued and available after initial auth
• Confirmed the /token endpoint responds correctly to grant_type=refresh_token requests (validated via Claude and VS Code)
• Checked APIM logs on token expiry: zero incoming requests from Copilot Studio
• Confirmed offline_access scope is requested to ensure refresh token issuance

---

Questions

1. Is there any Copilot Studio configuration that enables silent token refresh via the refresh token grant?
2. Is this a known limitation currently tracked for a fix?

Answer 1

1. There is no Copilot Studio configuration in the provided documentation that enables a generic, silent refresh-token grant flow for MCP tools when using OAuth 2.0 – Manual. The MCP onboarding wizard and manual OAuth configuration for MCP servers only define:
   • Authorization URL
   • Token URL template
   • Refresh URL
   • Scopes
   These fields describe where tokens are obtained and refreshed, but there is no documented setting that forces Copilot Studio to automatically invoke the refresh endpoint on access-token expiry for MCP connections. The separate "Manual authentication fields" for user authentication (Login URL, Refresh body template, Refresh URL template, etc.) apply to Copilot Studio’s own user-auth configuration, not specifically to MCP server connectors, and the MCP guidance does not document using those to drive an automatic refresh-token grant for MCP tools.
2. The behavior described is consistent with a current limitation rather than a misconfiguration:
   • The MCP onboarding wizard for enterprise and remote/self-hosted MCP servers documents OAuth 2.0 setup (Authorization URL, Token URL template, Refresh URL, scopes) but does not describe any automatic refresh-token grant behavior or additional flags to enable it.
   • The guidance for calling tools from a Copilot Studio agent focuses on initial sign-in and connection creation; it does not mention silent token renewal or refresh-token usage for MCP tools after expiry.
   Within the provided material, there is no indication that Copilot Studio currently supports a generic, automatic refresh-token grant flow for MCP tool connections, nor any mention of a known issue or fix tracking for this scenario.

Given the documentation, this should be treated as a product limitation rather than a configuration issue. Escalation through official support channels would be required to confirm status and track any future fix.

---

References:

• Connect your agent to an existing Model Context Protocol (MCP) server
• Use Microsoft MCP Server for Enterprise from Copilot Studio
• Configure user authentication in Copilot Studio
• Deploy a self-hosted remote Azure MCP Server and connect to it using Copilot Studio

Answer 2

Hello Cesare Farina Busetto ,
Based on the available documentation, Copilot Studio's MCP OAuth configuration exposes both a Token URL and a Refresh URL, and the documentation states that refresh tokens are intended to be used to obtain new access tokens when the access token expires. However, I couldn't find any documentation that explicitly describes a setting to enable or disable automatic refresh behavior. Connect your agent to an existing Model Context Protocol (MCP) server - Microsoft Copilot Studio | Microsoft Learn states that refresh tokens are used to obtain new access/refresh tokens after expiry, but it doesn't document any configuration switch for silent refresh.

Answer 3

Hey @Cesare Farina Busetto ,

I ran into the same behavior initially, but I was able to get refresh tokens working with Entra ID.

In my case, the fix was ensuring both of the following were configured:

Include the offline_access scope in the OAuth authorization request.

Ensure offline_access is admin-consented in the Entra app registration used by the MCP server (API permissions → Microsoft Graph → Delegated → offline_access), not just requested in the scope.

One other thing that caught me out: if you're using the On-Behalf-Of (OBO) flow anywhere in the authentication chain, make sure the OBO token request also includes offline_access in its scope parameter. Otherwise, Entra won't issue a refresh token.

Interestingly, this wasn't working for me until fairly recently. Initially, I was seeing the same behavior you described, where Copilot Studio prompted for reconnection after the access token expired. At some point it started working, so I'm not sure whether Microsoft rolled out a fix or whether it was related to the configuration changes above.

Just curious, have you had a chance to try this recently? If so, is it working for you now, or did you end up finding a different solution?