Hi everyone,
I am currently developing a Copilot Studio agent that will be deployed on a public website. The requirement is to allow anonymous users (unauthenticated) to interact with the bot. However, the agent needs to query and retrieve data from a Dataverse table to provide specific answers.
The Issue:
By default, when a bot is set to "No Authentication," it operates under the user's context (which is null in this case). To access Dataverse, I need the bot to authenticate as a specific identity - specifically, an Azure App Registration (Service Principal) - to fetch the data without prompting the end-user for any credentials.
Current Approach:
I am exploring the "Manual (for any channel)" authentication setting in Copilot Studio. I want to use the Client ID, Client Secret, and Token URL from my Azure App Registration to establish a Service-to-Service (S2S) connection.
Questions:
- Compatibility: Can I use the "Manual" authentication configuration to handle backend S2S calls while keeping the frontend experience completely anonymous for the web user?
- Configuration Details: In the "Manual" auth settings, what are the specific scopes required for Dataverse when using the Client Credentials flow?
- Application User: Beyond the Azure side, are there specific roles that must be assigned to the Application User in the Power Platform Environment to ensure the bot can successfully "impersonate" this service identity?
- Best Practices: Is it better to handle this via a Power Automate flow configured with a Service Principal connection, or is it possible to achieve this natively within Copilot Studio topics using the Dataverse knowledge source and the Manual Auth token?
Also, I want to avoid a scenario where the bot triggers a sign-in card for a public user. Any insights on the correct "App Registration + Copilot Studio Auth" handshake for this specific architecture would be very helpful!
If someone has achieved the proper configuration for this scenario, I'd ask to please share the steps or documentation.
