Copilot Studio new experience: end-user credential tools fail only in Teams and return connect/authorize message as tool output

Question

Hi,

We are seeing what looks like a Copilot Studio new experience / Teams runtime issue with tools configured to use end-user credentials.

The agent is configured with:

Agent authentication: Authenticate with Microsoft

Channel: Microsoft Teams

Test context: Teams 1:1 chat

Tool auth mode: authMode: Invoker

Example connector: Office 365 Users

Example operation: MyProfile_V2 / Get my profile (V2)

The same tool works correctly in:

• Copilot Studio preview pane

Microsoft 365 Copilot

But it fails in:

Microsoft Teams 1:1 chat

In Teams, after the user clicks Allow, the tool does not return the expected connector data. Instead, it returns the same connect/authorize message as the actual tool payload. The agent then receives that message instead of the profile data.

So the loop is:

User calls tool

→ Teams asks user to connect/authorize

→ User clicks Allow

→ Tool runs again

→ Tool returns connect/authorize message as payload

→ No connector data is returned

Minimal Repro

We reproduced this with a minimal new-experience agent:

Create new Copilot Studio agent. Set authentication to Authenticate with Microsoft. Add Office 365 Users → Get my profile (V2). Configure the tool with end-user credentials. Publish to Teams. Test in Teams 1:1 chat. Click Allow when prompted.

Relevant YAML:

kind: ConnectorTool

authMode: Invoker

connectorId: /providers/Microsoft.PowerApps/apis/shared_office365users

operationId: MyProfile_V2

The same issue occurs in multiple environments and with minimal agents, so it does not appear to be caused by complex instructions, orchestration logic, Power Automate, missing connection references, Teams group/channel limitations, or solution complexity.

Entra Agent ID observation

We also checked the Microsoft Entra Agent ID.

In a working classic/reference agent, the agent identity has this delegated API permission:

Resource application: Azure API Connections

Permission: Runtime.All

Display name: Access Azure API Connections runtime service API

Granted through: Admin consent

In the affected new-experience agents, this permission is missing after publish, even though:

the connector tool exists, the connection reference exists, the tool uses authMode: Invoker, the tool works in preview, the tool works in Microsoft 365 Copilot, the failure occurs only in Teams.

This seems relevant because Microsoft documentation says Copilot Studio attaches connector API permissions to the agent’s Entra Agent ID when the agent is published, and that connector-scope enforcement currently applies only in Microsoft Teams:

https://learn.microsoft.com/en-us/microsoft-copilot-studio/requirements-certificates-configuration-values

Also relevant:

https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-use-entra-agent-identities https://learn.microsoft.com/en-us/microsoft-copilot-studio/configure-enduser-authentication https://learn.microsoft.com/en-us/microsoft-copilot-studio/configure-sso-teams

Suspected root cause

Our current hypothesis is that, for new-experience agents, the required connector-runtime permission is not being added to the Entra Agent ID on publish.

This would explain why the tool works outside Teams but fails in Teams:

Copilot Studio preview: works

Microsoft 365 Copilot: works

Microsoft Teams: fails

It looks like the Teams runtime requires the Entra Agent ID connector permission, but the permission is not being created for new-experience agents using end-user credential tools.

Questions

Can Microsoft confirm:

Should new-experience agents with authMode: Invoker connector tools automatically receive connector-runtime API permissions on the Entra Agent ID after publish? For Office 365 Users / Get my profile (V2), should the agent identity receive Azure API Connections / Runtime.All or another equivalent permission? Is there a known issue where new-experience agents do not receive these permissions? Can missing Azure API Connections / Runtime.All cause Teams-only failures for end-user credential tools? Is there a supported way to force refresh or recalculate the connector permissions on the Entra Agent ID? Is manual intervention on the Entra Agent ID supported, or should this only be handled by Copilot Studio on publish?

Any guidance or confirmation would be appreciated.

Answer 1

The issue suddenly disappeared as it suddenly appeared without any changes on our side.

Answer 2

Microsoft documentation states that when an agent is published, Copilot Studio should attach API permissions to the agent’s Entra Agent ID based on the Power Platform connectors configured on the agent. It also notes that connector-scope enforcement currently applies at runtime only in Microsoft Teams, because Teams uses end-to-end authentication with the Entra Agent ID token.

For connector tools, the expected permissions can be connector-specific operation scopes, Operations.Execute.All, or fallback Azure API Connections Runtime.All where granular scopes are not available. These permissions are evaluated and applied during publish, and republishing after adding/removing connector tools should update the scopes.

Since your affected new-experience agents are missing the Azure API Connections / Runtime.All or equivalent connector runtime permission, that could reasonably explain the Teams-only failure, while preview and M365 Copilot continue to work through other connector authentication paths.

Recommended next steps

• Republish the agent after removing and re-adding the Office 365 Users tool, then recheck the Entra Agent ID API permissions.
• Ask users to run a fresh Teams session using start over, or reinstall/reopen the Teams app after republish, since Teams changes can take time to propagate.