MCP Connector Instability Between Salesforce and Copilot Studio.

(0) Share

Report

Posted on by FB-01091354-0

We have configured an MCP connection between Salesforce and Microsoft Copilot Studio to leverage Salesforce AI capabilities through MCP integration.

The following configurations have been completed successfully:

Created a Salesforce Agent
Created the required Tool
Created the Connector in Copilot Studio
Established the connection successfully
Validated the integration through testing, and all functionalities are working as expected

Issue:
Although the connection is successfully established and operates correctly, the connector does not remain stable after the session expires or times out. Once the session ends, the existing connector becomes unusable, and we are required to recreate the connector and re-establish the connection to continue using the Salesforce MCP capabilities.

We would like assistance in understanding.

1. Why the connector is not persisting across sessions.
2. Whether there are any known limitations related to MCP authentication/token refresh.
3. If additional configuration is required to maintain a stable long-term connection.
4. Recommended best practices for preventing the connection from being revoked or requiring connector recreation after session timeout

Categories:

Model context protocol

All responses (10)

Answers (0)

Sort by

Suggested answer

Mohsin Ali 1,075 on at

Like
a
(1)

Report
Copy link

Link copied!

Hello @FB-01091354-0 - This appears to be related to the OAuth token refresh behavior of the MCP connection. There is currently no documented Copilot Studio configuration or setting that explicitly enables or controls a generic silent refresh-token flow for MCP tools.

A similar behavior has also been discussed in the following Microsoft Q&A thread, where the MCP connection works initially but requires user intervention after the access token expires:

https://learn.microsoft.com/en-us/answers/questions/5922525/copilot-studio-mcp-server-with-manual-oauth-2-0-pr

However, according to the Copilot Studio MCP documentation, Microsoft does support OAuth 2.0 authentication with token refresh. When using Manual OAuth 2.0, you can configure a Token URL template and a Refresh URL. Microsoft states that the Refresh URL is used to request a new access token using the refresh token, so the user doesn't have to sign in again when the access token expires.

https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent#configure-api-key-authentication

Therefore, I would suggest to verify that Salesforce is issuing a valid refresh token and that the Refresh URL is correctly configured in the MCP OAuth configuration. If both are configured correctly but Copilot Studio still marks the connection as stale or requires the connector/connection to be recreated after token expiry, this may indicate a limitation or issue with the current MCP OAuth refresh behavior and would be worth raising with Microsoft Support.
Suggested answer

sannavajjala87 1,113 Super User 2026 Season 2 on at

Like
a
(0)

Report
Copy link

Link copied!
Hi,

It sounds like the initial MCP setup is working correctly, but the issue is occurring when the authentication session expires.

A few things to check:

Verify what authentication method is being used between Copilot Studio and Salesforce MCP (OAuth, connected app, user-based credentials, etc.). If the access token expires and a refresh token is not being issued or used correctly, the connection can become invalid after the session ends.

Review the Salesforce Connected App policies, especially token timeout, refresh token settings, and revocation behavior.

In Copilot Studio, check whether the connection is showing as disconnected after the timeout or whether the MCP tool simply stops responding. That can help determine if it's an authentication issue or a connector issue.

If the connector must be recreated every time, that is not expected behavior. Normally, connections should persist and renew tokens automatically when the authentication flow supports refresh tokens.

Review any conditional access, session controls, or security policies in Salesforce that may be revoking tokens when a user session ends.

From what you've described, this sounds more like a token refresh or session management issue than an MCP functionality issue itself. If possible, check the connector logs and Salesforce authentication logs around the time the session expires to see whether the access token is expiring, the refresh token is being rejected, or the connection is being explicitly revoked.

If others cannot reproduce the behavior, I would recommend opening a Microsoft support ticket and providing the connector configuration details, authentication type, and any relevant error logs. That will help determine whether you're hitting a known limitation or a configuration-specific issue.

Thanks & Regards,

Manoj Annavajjala

www.powerplatformengineer.com
Suggested answer

11manish 4,802 Super User 2026 Season 2 on at

Like
a
(0)

Report
Copy link

Link copied!

The initial MCP authentication succeeds, but the authentication state is not being successfully maintained after the access token/session expires. The most likely areas are OAuth refresh-token configuration, token lifetime/revocation policy, or a mismatch between the authentication flow supported by the Salesforce MCP endpoint and the flow configured in Copilot Studio.
Suggested answer

M Bilal Khan 384 on at

Like
a
(0)

Report
Copy link

Link copied!
Hi,

Based on the behavior you described, the fact that the MCP connection works initially but becomes unusable after the session expires suggests that the issue may be related to the authentication/token lifecycle between Salesforce and Copilot Studio, rather than the MCP configuration itself.

I would check the following:

Authentication method – Verify which OAuth/authentication flow is being used by the Salesforce MCP connection and whether it supports refresh tokens. If the access token expires and there is no valid refresh mechanism, the connection may need to be reauthenticated.

Salesforce session/token policies – Check Salesforce security policies, connected app settings, session timeout, refresh-token policies, and whether refresh tokens are being revoked or invalidated.

Connection reference – In Copilot Studio/Power Platform, verify that the agent is using the existing connection/connection reference rather than creating a new connection during each test or deployment.

Test after token expiration – It would be useful to determine exactly what happens after the timeout. For example, does the connection show as disconnected, does the MCP tool return an authentication error (401/403), or does Copilot Studio simply fail to invoke the tool? The exact error can help identify which layer is failing.

Environment and ownership – Make sure the connection is owned by an appropriate service account or identity intended for long-running workloads, rather than relying on an individual user's interactive session, where applicable.

I would avoid recreating the connector as a long-term workaround. If the connection is genuinely being invalidated after token expiry, recreating it only resets the authentication state and doesn't address the underlying issue.

If you can provide the exact error shown after the session expires, along with the authentication method being used (OAuth/client credentials/etc.) and whether the Salesforce Connected App is involved, it should be easier to determine whether this is an authentication configuration issue or a limitation/bug in the current MCP connector implementation.
FB-01091354-0 6 on at

Like
a
(0)

Report
Copy link

Link copied!
Thank you all — @Mohsin Ali, @Manoj Annavajjala, @11manish, and the others — for the detailed responses. You've correctly identified this as a token-refresh / authentication-lifecycle issue rather than an MCP-configuration problem. Let me share the specifics you asked for.

Authentication method

OAuth 2.0 via a Salesforce External Client App (ECA).

Connector identity provider: initially Generic OAuth 2, and I've also tested the native Salesforce identity provider.

Scopes on the ECA: mcp_api, api, refresh_token, openid, sfap_api.

Authorization/Token URLs point to our sandbox: https://<domain>.sandbox.my.salesforce.com/services/oauth2/authorize and .../token.

Salesforce side (confirmed healthy)

Refresh Token Policy: Valid until revoked.

IP restrictions relaxed; JWT-based access tokens enabled.

Salesforce login/auth history shows no revocation events at the time the connection drops — from Salesforce's side the refresh token appears valid and is not being explicitly revoked. So the refresh does not seem to be rejected at the IdP.

Exact behavior after expiry

The connection works perfectly initially (initialize → tools/list → tool calls all succeed).

After the access token expires, the MCP tool call fails with HttpStatusCode: unauthorized (401), with mcpMethod: initialize and errorResponse: [{"jsonrpc":"2.0"}].

In Copilot Studio the connection is effectively treated as stale/invalid, and it only recovers after the connection is deleted and recreated (re-authorized).

Given Salesforce confirms the refresh token is valid and not revoked, but Copilot Studio still returns 401 after access-token expiry and requires re-auth, this does look like a limitation in the current MCP OAuth silent-refresh behavior on the Copilot Studio side.
Suggested answer

Mohsin Ali 1,075 on at

Like
a
(1)

Report
Copy link

Link copied!

Hello @FB-01091354-0 - You can provide refresh URL to copilot agent so that you every time the agent get latest token in case its expired,

https://learn.microsoft.com/en-us/microsoft-copilot-studio/mcp-add-existing-server-to-agent#dynamic
FB-01091354-0 6 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Mohsin Ali,

I have already provided the Refresh URL for our sandbox but still we are hitting error.
Mohsin Ali 1,075 on at

Like
a
(1)

Report
Copy link

Link copied!

Hello @FB-01091354-0 - Just wanted to follow-up, if suggestions provided above really helped you to sort the issue or pointed in right directions.

Please feel free to ask any further questions.
FB-01091354-0 6 on at

Like
a
(0)

Report
Copy link

Link copied!

Does anyone know How to raise a ticket to Power Platform? I don't have option to raise it.
Suggested answer

Mohsin Ali 1,075 on at

Like
a
(1)

Report
Copy link

Link copied!
Hello @FB-01091354-0 - Please refer below documentation to raise a support ticket with Microsoft.

https://learn.microsoft.com/en-us/power-platform/admin/get-help-support#use-the-support-agent

Adding steps here for reference.

Login to Power Platform admin (https://admin.powerplatform.com)

Click on Support from left navigation

Click on Support Request > Select Get Support, this will open up side navigation on same page

You can continue to seek assistance from support agent, otherwise, you can click on Three dot to load older experience and raise a support incident