Create a Copilot Agent with SSO Authentication

 Steps to Create a Copilot Agent with SSO Authentication

1. Create a New Copilot Agent

• Sign in to Microsoft Copilot Studio: Go to the Copilot Studio portal (https://copilotstudio.microsoft.com/) and sign in with your Microsoft account.
• Create a New Agent:
  • From the home page, select Create in the left navigation.
  • Choose New agent.
  • Provide a name, description, and instructions for your agent (e.g., "Helpdesk Agent" to assist with IT queries). Use conversational language to define its purpose and tone.
  • Select Create to initialize the agent.

2. Set Up Authentication in Copilot Studio

• Navigate to Settings: Open your newly created agent, then go to Settings > Security > Authentication.
• Choose Authentication Option:
  • By default, "No authentication" is selected. For SSO, select Authenticate manually (this allows custom configuration for SSO).
  • Turn on Require users to sign in to ensure authentication is enforced.
• Configure Identity Provider:
  • For Microsoft Entra ID SSO:
    • Service provider: Select "Azure Active Directory v2".
    • You’ll need to provide a Client ID, Client Secret, and Scopes (e.g., profile openid). These will come from an app registration in Azure (see Step 3).
  • For other OAuth2 providers (e.g., Google, Okta), select "Generic OAuth 2.0 provider" and input the provider-specific details (consult your provider’s documentation).

3. Register an App in Microsoft Entra ID

• Go to Azure Portal: Sign in to the Azure portal (https://portal.azure.com/) with an admin account in the same tenant as your Copilot Studio.
• Create an App Registration:
  • Navigate to Microsoft Entra ID > App registrations > New registration.
  • Enter a name (e.g., "CopilotSSOAgent").
  • Set Supported account types to "Accounts in this organizational directory only" (or multi-tenant if needed).
  • Leave Redirect URI blank for now; you’ll add it later.
  • Click Register.
• Configure the App:
  • Go to Authentication > Add a platform > Web.
  • Add a Redirect URI: Use https://unitedstates.token.botframework.com/.auth/web/redirect (or the region-specific URL shown in Copilot Studio’s authentication settings).
  • Enable Access tokens and ID tokens under "Implicit grant and hybrid flows".
  • Save changes.
• Generate a Client Secret:
  • Go to Certificates & secrets > New client secret.
  • Add a description and set an expiry period (e.g., 6 months).
  • Copy the Value immediately (it won’t be shown again).
• Copy the Client ID:
  • From the app’s Overview, copy the Application (client) ID.
• Expose an API (for SSO):
  • Go to Expose an API > Add a scope.
  • Set the scope name (e.g., user_impersonation) and save the full scope URL (e.g., api://<client-id>/user_impersonation).

4. Complete Authentication Configuration in Copilot Studio

• Return to Copilot Studio’s Authentication settings.
• Fill in the fields:
  • Client ID: Paste the Application (client) ID from Azure.
  • Client Secret: Paste the secret value you copied.
  • Scopes: Enter profile openid (add more if needed, like email).
  • Token exchange URL: Paste the scope URL from the "Expose an API" step (required for SSO).
• Click Save.

5. Publish the Agent

• Test the Agent: In Copilot Studio, use the Test your agent pane to verify it prompts for sign-in and works as expected.
• Publish: Go to the top of the page, select Publish, and confirm. Authentication changes take effect only after publishing.

6. Deploy to a Channel (e.g., Teams or Custom Website)

• For Microsoft Teams:
  • Go to Channels > Microsoft Teams > Turn on Teams.
  • If using SSO, ensure the Teams app manifest includes the Client ID and token exchange URL (see Microsoft documentation for Teams SSO setup).
  • Republish after configuration.
• For a Custom Website:
  • Go to Channels > Custom website > Copy the iframe embed code.
  • Implement a custom canvas to handle SSO token exchange (see below).

7. (Optional) Implement SSO on a Custom Canvas

• If deploying to a website, use a custom HTML page to intercept the sign-in prompt and exchange tokens:
  • Use sample code from the Copilot Studio GitHub repo (e.g., https://github.com/microsoft/copilotstudio-samples).
  • Modify it to acquire an Entra ID token for the signed-in user and post it to the secure URL provided by Copilot Studio.
  • This avoids manual login prompts, enabling seamless SSO.