Building a Federated Copilot: Part 4, Making Copilot Studio Accept the Right Token

说明与用途

将 Copilot Studio 与 Power Platform 集成需要精确的 OAuth 配置和正确的令牌处理，成功实现身份验证并解决了 400/401 错误。

问题

Copilot Studio returned HTTP 400 or 401 when using a Microsoft endpoint token, indicating the credential was not accepted for the intended operation.

结果

The integration achieved successful token validation and sign‑in, resolving earlier HTTP 400/401 errors by correcting OAuth configuration and ensuring proper credential usage.

工作流

• Establish Microsoft environment and verify licensing and maker access
• Expose only necessary Power Platform endpoints via Cloudflare Tunnel and DNS
• Configure Generic OAuth 2.0 client with correct scopes, URLs, and PKCE
• Separate and document four credential types and their roles
• Use the fresh OAuth card with the exact tokenPostResource.sasUrl
• Diagnose HTTP 400 responses by inspecting token validity and request details
• Prove connector headers and authorization by testing with synthetic values

证据

The most time‑consuming part of the integration was not generating another JWT. It was proving that the particular credential sent to a Microsoft endpoint belonged at that endpoint.

来源

We created a small budget with notifications. That budget was an alert mechanism, not a spending cutoff.

来源

The backend extracts content.tokenPostResource.sasUrl from an attachment with content type application/vnd.microsoft.card.oauth.

来源

A later approved test with a 60‑minute PF A provider token returned HTTP 200 and the published signed‑in diagnostic succeeded.

来源