Answered

Agent Stalls after Tool Authorizations

(0) Share

Report

Posted on by EG-20041632-0

Hello! I have an agent that has been built to answer benefit questions. There's an issue occurring when a user first installs the agent that I'm struggling to resolve.

This agent has a 'Benefit Questions' topic. That topic uses the Office 365 Users (get my profile V2) tool to get the user's country location and then branches based on that location to use only that location's knowledge sources in Generative answer nodes. The knowledge sources being used are SharePoint knowledge sources (both SharePoint connectors to pages, and the File-type SharePoint connector to document library folders). It uses Microsoft authentication.

When a new user installs the agent and asks a question, the agent:

1. Asks them to authorize the Office 365 connection.

2. After the user authorizes the Office 365 connection, it asks them to authorize the SharePoint connection.

3. After the user authorizes the SharePoint connection, it asks them a second time to authorize the SharePoint connection (this is weird, but not the biggest issue)

3. After the user authorizes the second SharePoint connection, the agent stalls and doesn't answer the original question. If having this discussion in a Teams chat, the agent will just not answer. If having this discussion in Copilot M365 Chat, sometimes it won't answer or it will send a message like "Sorry, I wasn't able to respond to that. Is there something else I can help with?", which is not a message set up in the original topic, Fallback, or On Error topics.

4. If the user sends a new message, or starts a new conversation, the agent is able to continue the conversation just fine.

This is an issue that is difficult to replicate because once those connections are set up and cached, even when removing the agent and re-installing it won't ask for re-authorization for the tools, so it typically requires having a new person install it. I have also never run into this behavior when testing in Copilot Studio even though those connection refresh and ask for re-authorization more often, so I've been unable to debug from there.

Any help would be appreciated!

Categories:

General topics

I have the same question (0)

All responses (3)

Answers (2)

Sort by

Verified answer

Sunil Kumar Pashikanti 2,318 Moderator on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @EG-20041632-0,

Yes, this is a known Copilot Studio behavior. You’ve basically hit the classic authentication wall.

https://community.powerplatform.com/forums/thread/details/?threadid=a73cfe8a-aadf-ef11-a730-6045bdfed6c7

Here’s what’s happening:
When a user asks a question that requires Office 365 or SharePoint, the agent realizes it doesn’t have an access token yet. At that point, the conversation turn is interrupted so the user can authorize the connection. Once the user clicks Accept, authentication succeeds, but the agent does not resume or replay the original request.

The Generative Answer node does not automatically re-run after the auth dialog completes. As a result, the agent either stalls silently or falls back to a generic system message like “Sorry, I wasn’t able to respond”, even if you didn’t configure that text yourself.

Common workarounds the community is using
1. Pre-authentication (recommended)
Treat authentication as a prerequisite. Use a Conversation Start topic or a dedicated “Sign-in / Setup” topic to force Office 365 and SharePoint authorization up front. Only route users to topics with generative answers once they’re already signed in.
2. Duplicate SharePoint consent prompts
If you’re seeing two SharePoint authorization prompts, that’s because SharePoint Pages and SharePoint Files are handled as separate connectors under the hood. It’s annoying, but currently expected behavior.
3. Explicit restart message
If pre-auth isn’t possible, add a message immediately after the auth step such as:
“You’re signed in now. Please ask your question again.”
It feels clunky, but it’s better than the agent appearing to hang.

Bottom line
This is a platform limitation, not a design or configuration mistake. The agent effectively loses conversational state during the authentication handoff. Designing authentication as an upfront requirement instead of a mid-conversation step avoids most of the pain.

✅ If this answer helped resolve your issue, please mark it as Accepted so it can help others with the same problem.
👍 Feel free to Like the post if you found it useful.

Sunil Kumar Pashikanti, Moderator
Blog: https://sunilpashikanti.com/posts/

Was this reply helpful? Yes No
EG-20041632-0 8 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @Sunil Kumar Pashikanti,

This is helpful, thank you!

It is strange because there have been just one or two times where it hasn't happened upon sign-in, which is confusing because I haven't found a pattern. Any idea if that's the orchestrator agent being able to correct itself or something else?

If I was to try to route to auth intentionally from the start, or send a message after the auth that indicates that they need to ask their question again, how would I do that? The users are accessing this agent via Copilot M365 Chat, so the conversation start topic doesn't get triggered. I'm also a bit unclear about what the difference would be between a traditional sign in, and SharePoint authorization - we're using the authenticate with Microsoft method, so the users are already signed in. Is there a way to specifically run authorization for SharePoint apart from the Generative Answers node? I think I'm trying to figure out what we mean by the 'auth step' and how we could run it intentionally at the beginning or send a message after it is complete to make the situation clear to the user.

Thanks for the help!

Was this reply helpful? Yes No
Verified answer

Sunil Kumar Pashikanti 2,318 Moderator on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @EG-20041632-0,

This behavior is something others have also noticed, and it’s usually not caused by an issue in the topic itself. It appears to be related to how authorization is handled implicitly in Copilot Studio, which can feel like a “silent stall.”
One important distinction to keep in mind is that sign‑in (identity) and resource access (authorization) are not the same thing. Even when users are signed in through Entra ID, the specific permissions or scopes needed to read SharePoint content may not be fully established yet. Those are typically requested only when a Generative Answers node or connector actually attempts to access SharePoint.

Why the behavior can feel inconsistent

Perceived stall
When SharePoint is accessed for the first time, the orchestrator may pause the current turn while it acquires or refreshes the required authorization in the background. From the user’s perspective, this can look like the agent has stopped responding.

Second attempt succeeds
If the same question works when asked again, it’s often because the authorization process has completed by that point.

M365 Copilot Chat limitation
When using the M365 Copilot Chat channel, the Conversation Start topic doesn’t run, so there isn’t a supported way to trigger authorization proactively before the first user query.

Possible ways to handle this

Implicit “authorization primer”
One approach is to include a simple Generative Answers node early in the flow that touches SharePoint (for example, retrieving a document title). This can cause the authorization process to occur before the user’s main question is processed.

User-facing clarification
Since the authorization step isn’t directly controllable, another option is to make it explicit in the UX. If the initial request returns no results or appears delayed, a short message such as:

“Access to company documents is being initialized. Please try your question again.”

can help set expectations and reduce confusion.

Overall, this seems to be a platform behavior rather than a configuration error, so designing the conversation flow to account for that initial authorization delay tends to be more effective than looking for a missing setting.

Hope this helps clarify what’s going on.

Was this reply helpful? Yes No