Good goal and Microsoft docs confirm this is achievable. Two approaches depending on how much you want to change.
Approach 1 - Use the Dynamics 365 connector instead of HTTP (recommended)
Instead of the HTTP action with AD OAuth app credentials, replace it with the built-in Dynamics 365 connector in Power Automate. The Dynamics 365 connector supports user-delegated connections. When the flow runs as a tool in a Copilot Studio agent that has user authentication enabled, the flow runs under the user's credentials, not the author's.
From Microsoft docs: "In a supported authenticated agent, cloud flows can be configured to use user credentials when they're run as part of a generative orchestration plan or called from a topic."
Steps:
1. In Copilot Studio: Settings > Security > Authentication. Set to "Authenticate with Microsoft" (if Teams only) or "Authenticate manually" with Entra ID V2 and Require users to sign in enabled.
2. In the flow: replace the HTTP action with Perform an unbound action or List rows / Create record from the Dataverse or Dynamics 365 connector.
3. In the flow tool settings in Copilot Studio: set authentication to User authentication instead of Agent author authentication. Users will be prompted to consent to the connection on first use.
Approach 2 - Keep HTTP action, pass user token from Copilot Studio
If you must keep the HTTP action (for example to call F&O OData endpoints not covered by standard connectors):
1. Enable user authentication in Copilot Studio as above.
2. The User.AccessToken variable becomes available in your agent topics once the user is signed in.
3. Pass User.AccessToken as an input parameter to the flow.
4. In the HTTP action, change Authentication type to Raw and set the Authorization header to Bearer {the token input parameter}.
This passes the signed-in user's delegated token directly to the D365 F&O API. The API call executes under that user's identity and D365 security roles apply.
Note: the docs warn not to use User.AccessToken in flows you do not trust, and to scope it carefully. Token expiry also means the flow will fail on longer sessions unless re-auth is triggered.
For Teams deployment specifically, set up SSO (single sign-on) so users are not prompted to sign in manually. The docs confirm Teams SSO with OBO flow means users sign in once and the token passes through without a separate consent prompt.
Best regards,
Valantis
✅ If this helped solve your issue, please Accept as Solution so others can find it quickly.
❤️ If it didn’t fully solve it but was still useful, please click “Yes” on “Was this reply helpful?” or leave a Like :).
🏷️ For follow-ups @Valantis.
📝 https://valantisond365.com/
