Declarative agent with "Microsoft Entra ID SSO authentication" has authentication error

[hk4git]

I have created Declarative Agent with API plugins in agents, My API is in Azure APIM, I want to do "Microsoft Entra ID SSO authentication" configuration to call api in APIM, I followed all the steps mentioned in the section "https://learn.microsoft.com/en-us/microsoft-365-copilot/extensibility/api-plugin-authentication" for "Microsoft Entra ID SSO authentication".

It is proposing for sign-in but nothing happens after sign-in

On browser console I have below error:
"https://titles.msit.mos.microsoft.com/catalog/v1/users/titles/U_{XXX}/signInInfo?authConfigId={myauthConfigId}"

{myauthConfigId} - is present.

I have enabled developer mode on, no error details shown on copilot.

Also, unable to provision from teams toolkit, so had to manually provision above application. getting error - [Error] - code:AppStudioPlugin.ryr, message: Unable to make API call to Developer Portal: API failed, Request failed with status code 404, API name: get-oauth, X-Correlation-ID: . This may be due to a temporary service error. Try again after a few minutes.

[m365-agent-toolkit-assistant]

👋 Hi @hk4git,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 2 business days

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

To troubleshoot the authentication error with your Declarative Agent using "Microsoft Entra ID SSO authentication", here are some steps and recommendations that might help address the issue:

Suggested Steps:

1. Verify Authentication Configuration:

   • Ensure all steps outlined in API Plugin Authentication for Microsoft Entra ID SSO are carefully followed.
   • Double-check authConfigId and other configuration values in your agent setup.

2. Review App Registration:

   • Confirm that your app is registered properly in Azure Active Directory (AAD) with the correct redirect URIs.
   • Ensure that the permissions required for the API in Azure APIM are granted and consented.
   • Verify that you have added the correct identity URIs to the app registration.

3. Inspect Console Logs:

   • Check if there are any additional error messages or details in the browser's developer console that can provide more context.
   • Specifically look for network errors or permission-denied messages that might be impacting the sign-in flow.

4. Developer Mode and SSO Registration:

   • Make sure Developer mode is enabled in Teams settings.
   • Ensure the SSO registration in the app manifest is correctly configured, as missing or incorrect SSO registration can cause such issues.

5. Check Identity URIs Configuration:

   • Confirm that the identity URIs are configured correctly according to the new pattern requirements. Follow guidance similar to what's provided in GitHub issue #12949.

Potential Solutions:

• Update AuthConfigId:

  • Verify that authConfigId is pointing to the correct configuration and is properly set up in Azure AD.

• Redirect URI Validation:

  • Validate that the redirect URI in your AAD app matches the URI used in your Microsoft Teams application settings.

• Detailed Logging:

  • Enhance logging within your application to capture more detailed information on where the process is failing.

Common Pitfalls:

• Redirect URI Mismatch:
  • Ensure the redirect URI configured in AAD exactly matches those defined in your Teams app settings.
• Consent Issues:
  • Ensure admin consent has been granted for all API permissions requested by your app.

If the above steps do not resolve the issue, please share more details such as:

• The specific steps you followed in setting up SSO.
• Detailed snippets of your configuration.

This information will help in providing more tailored troubleshooting steps.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[Nivedipa-MSFT]

@hk4git - Thanks for bringing this issue to our attention. We will test this and update you soon.

[SLdragon]

From your error message, seems something wrong when copilot try to get your auth configuration.

• You can go to developer portal to check whether the configuration Id is correct.

• Make sure that copilot login to the same account which register the auth configuration.

• Make sure that your App can access the auth configuration by update below configurations

  

If issues persist, you can try to use "DA OAuth from scratch" template - this will automatically register the Microsoft Entra app and configure authentication settings correctly, below is the steps:

• "Create new App" -> "Declarative agent" -> "Add an Action" -> "Start with a new API" -> "Microsoft Entra" to create the template project.

• After scaffolding success, click provision, then it will automatically register Microsoft Entra and auth configurations

[hk4git]

@SLdragon Thank you for your troubleshooting steps:

1. configuration Id - this was correct only.
2. Have used the same account configuration.
3. updating configurations as mentioned by you resolved the issue & I am able proceed further to get auth screen & after that below screen:

Is this approval/permission issue from our own Entra app id?

Additionally, should it not function with my current configuration (detailed below) since my Teams app ID was correctly configured?

• Which Microsoft 365 organization will use your app or access API endpoints? -> "My Organization only"
• Which app (client) is this registration for? -> "Existing Teams app"

[SLdragon]

Hi @hk4git, in Microsoft tenants, security policies restrict Graph API usage to a few endpoints (like User.Read) without admin approval. For other permissions, admin consent is required.

If you're developing internal DA tools for a Microsoft tenant, create a first-party app instead of using the app created from Azure Portal.

For development purposes, it's recommended to use a Microsoft 365 development account.

Additionally, should it not function with my current configuration (detailed below) since my Teams app ID was correctly configured?
Which Microsoft 365 organization will use your app or access API endpoints? -> "My Organization only"
Which app (client) is this registration for? -> "Existing Teams app"

I think it should work if you're correcting configured, you can find your teams app id from Teams developer portal

[hk4git]

We are currently only utilizing the default User.Read Graph API endpoint, and no other APIs in use require admin consent. Could you please clarify why an admin approval prompt is appearing? Is it possible that the M365 orchestrator is invoking additional APIs internally that necessitate this consent?

[SLdragon]

In Microsoft tenant, only User.Read doesn't need admin approval, and other permissions needs to approve due to security policy