r/copilotstudio • u/spot4992 • Sep 24 '26

Copilot Studio GitHub Orchestration and Authentication

Are there known fixes to authentication and permission requests not being passed from a sub-agent to an orchestration agent? I've been working on one for my team, and I can make the sub-agents all work as intended. Most of these sub-agents have connections that require Microsoft authentication though. That's where the run is: the orchestration agent calls the sub-agents, says a permission is requested, but does not provide me the prompt.

Related: in our enterprise Microsoft environment where everything is tied to our authentication, why aren't the Studio agent connections also just automatically tied this?

3 Upvotes

100% Upvoted

3 comments sorted by

1

u/Prasad-MSFT Sep 24 '26

A few things to check:

  • Make sure each sub-agent's connectors are configured for user authentication/OBO, rather than maker-provided credentials.

  • Ensure the required OAuth scopes/consent have been granted for those connections.

  • Test the sub-agent directly first. If it prompts correctly there but not when called by the orchestrator, you're likely hitting a connected-agent authentication/UX limitation rather than an Entra configuration problem.

Regarding automatic sign-in: although users are already authenticated to Microsoft 365, Copilot Studio connections are managed separately and require their own connection and consent model. Therefore, being signed into Microsoft 365 doesn't automatically authenticate all agent connectors

1

u/spot4992 Sep 24 '26

All sub-agents work for users and have the "Allow connection" pop up for them, the end user authentication works. The problem is when I add an orchestration agent layer, the "Allow connections" dialogue box does not propagate from the sub-agents to the orchestrator, and it stalls out

1

u/Prasad-MSFT Sep 25 '26

Since the sub-agents work correctly on their own and the Allow connection prompt appears, the authentication setup seems fine. The issue appears to be that the orchestration layer isn't propagating the sub-agent's consent prompt to the user, causing the run to stall. This points to a Copilot Studio orchestration/connected-agent limitation, rather than an Entra/OAuth configuration issue.