You want to embed a Copilot chatbot on your internal WordPress site that uses a Graph connector to the same internal site, and you need it to work without asking users to log in. Follow these steps: 1. In Copilot Studio, set the authentication method to Authenticate manually in the bot settings. 2. In Azure AD, create two app registrations — one for the chatbot and one for the WordPress frontend — and configure them for single sign-on. 3. In the chatbot app registration, add the redirect URI https://token.botframework.com/.auth/web/redirect and configure the required credentials. 4. Grant delegated Microsoft Graph API permissions like profile, openid, and ExternalItem.Read.All for the Graph connector. 5. In the WordPress frontend, use MSAL (Microsoft Authentication Library) to silently acquire an access token for logged-in users (after their first login). 6. Embed the chatbot using Direct Line JS, and after the chat connects, send the acquired token to the bot using a tokenExchange event: const userToken = await msalInstance.acquireTokenSilent({ scopes: ['openid', 'profile'] }); window.WebChat.renderWebChat({ directLine: window.WebChat.createDirectLine({ token: botToken }), store: window.WebChat.createStore({}, ({ dispatch }) => next => action => { if (action.type === 'DIRECT_LINE/CONNECT_FULFILLED') { dispatch({ type: 'WEB_CHAT/SEND_EVENT', payload: { name: 'tokenExchange', value: { token: userToken } } }); } return next(action); }) }, document.getElementById('webchat')); 7. This configuration allows the chatbot to work behind the firewall with silent SSO and use the Graph connector without requiring users to log in again.
