Answered

D365 Copilot: ‘IntegratedAuthenticationNotSupportedInChannel’ Error

(1) Share

Report

Posted on by CuriousMind

I am encountering the error “IntegratedAuthenticationNotSupportedInChannel” when invoking a custom agent within the out‑of‑the‑box (OOB) Copilot for Finance and Operations.

The parent agent is the standard OOB Copilot for Finance and Operations, and a custom child agent is being triggered from the Sidecar ( I connected the custom agent as a child to the parent OOB D365 Copilot agent)

The setup functions correctly within Copilot Studio test panel. However, on publishing, when accessed through the Sidecar in Finance and Operations, the invocation fails with the authentication error mentioned above.

What is the recommended approach to handle or resolve authentication mismatches between parent and child agents in this scenario?

Categories:

Bot extensibility

I have the same question (0)

All responses (7)

Answers (1)

Sort by

Suggested answer

11manish 3,333 on at

Like
a
(0)

Report
Copy link

Link copied!

This is most likely a channel authentication compatibility issue.

The Finance & Operations Sidecar does not support the authentication mechanism required by your child agent, even though it works in the Copilot Studio test

panel. Review the child agent's connectors, actions, and authentication configuration, and where possible move to application-based authentication (service

principal/managed identity) rather than delegated or integrated authentication. Also verify that the specific connector and authentication type are supported in

the Finance & Operations Copilot channel, as support can differ from the Copilot Studio testing experience.

Was this reply helpful? Yes No
Suggested answer

Haque 3,653 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @CuriousMind,

Just of confirm, did you make sure that the way of authentication that you're using is being supported in the channel? Can you please share what guide you are following for authentication stuff?

Was this reply helpful? Yes No
Suggested answer

Haque 3,653 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @CuriousMind,

The recomended approach is to configure custom child agent to also use Integrated Authenticaiton, aligning with the parent agent’s authentication mode.

Can you please check if this thread is helpful for you?

Was this reply helpful? Yes No
Verified answer

Sayali-MSFT Microsoft Employee on at

Like
a
(0)

Report
Copy link

Link copied!

Hello @CuriousMind,

The IntegratedAuthenticationNotSupportedInChannel error is likely caused by an authentication mismatch between the OOB Finance & Operations Copilot (parent) and the custom child agent. While the child agent works in Copilot Studio testing, the F&O Sidecar enforces its own user identity and authentication model during runtime. The OOB F&O Copilot uses Microsoft-managed authentication and cannot be switched to manual authentication, so the child agent should use a compatible authentication configuration.
Verify whether the child agent uses manual authentication, a Sign-in topic, custom OAuth, or actions requiring a separate login. Aligning the child agent's authentication with the parent agent's Microsoft authentication model is the recommended approach.
Reference Document-
Configure user authentication - Microsoft Copilot Studio | Microsoft Learn

Was this reply helpful? Yes No
CuriousMind 2 on at

Like
a
(0)

Report
Copy link

Link copied!

@11manish @Haque @Sayali-MSFT
Thank you for the responses. I'm using 'Authenticate with Microsoft' option for both the OOB copilot for finance and operations agent and the custom agent connected to it and still encountering the error.

Was this reply helpful? Yes No
Suggested answer

11manish 3,333 on at

Like
a
(0)

Report
Copy link

Link copied!

CuriousMind Since both agents already use "Authenticate with Microsoft", focus your investigation on the child agent's actions, connectors, and plugins, and

whether they require delegated user authentication.

The fact that the solution works in the Copilot Studio test panel but fails only through the Finance & Operations Sidecar strongly indicates a channel

authentication propagation limitation rather than a configuration issue.

If possible, redesign downstream integrations to use service principal or managed identity authentication, and consider opening a Microsoft support case

because the IntegratedAuthenticationNotSupportedInChannel error in an OOB F&O Copilot → Child Agent scenario may be a known product limitation that only

Microsoft can definitively confirm.

Was this reply helpful? Yes No
Suggested answer

Haque 3,653 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @CuriousMind,

Apparently its not a parent-child or orchestration issue, its a clear authenticaiton issue.

Some of us has explained the reason here thsi way "This error appears because in your Copilot agent database you have at least one knowledgs which requires authentification, In my case I was a sharepoint connexion which was required MS identification" -could you please check if it relates with your case. It's here.

We have a close resovled thread here, can you please check here if there is a luck (though its bit of orchestration related).

To narrow down the issue, one idea can be create a simple child agent with some basic actions and integrated authentication to isolate if specific actions cause the issue - and slowly impose your other actions one by one. This is something tedious if we are edged!.

I drilled it a bit deeper:

The error IntegratedAuthenticationNotSupportedInChannel in Microsoft Copilot Studio (or Power Virtual Agents) occurs when your chatbot has single sign-on (SSO) or Microsoft Entra ID authentication enabled, but you are testing it on a channel or environment that does not support integrated user authentication. Can you please confirm? So analogy with your case is: your solution works in the Copilot Studio test panel but fails only through the Finance & Operations Sidecar - does it equal to Finance and Operations Sidecar doesn't support integrated user authentiction?

I see here is a kind of close scenario where the same error was thrown and resolution was given.

Finally we can review a MS pattern here.

I am sure some clues I tried to give. If these clues help to resolve the issue brought you by here, please don't forget to check the box Does this answer your question? At the same time, I am pretty sure you have liked the response!

Was this reply helpful? Yes No