I'm testing a remotely hosted MCP server in the Copilot Studio. The server is configured to support OAuth through WorkOS with a custom login page which is hosted on our web app. When creating a new connection to the server, the OAuth flow is triggered and i'm redirected the custom login page correctly. However, even before I login, the Copilot Studio already reports that the "The connection consent pop-up window has been closed unexpectedly".
On any traffic to our web app we set "Cross-Origin-Opener-Policy": "same-origin-allow-popups" and this seems to break the tracking of the OAuth flow by the Copilot Studio. I've tested the service on a test environment without this header, and then the flow succeeds. However, we don't want to relax our web app security settings.
Am I correct in assuming that the Copilot Studio MCP OAuth flow requires the window.opener to persist over the redirects? Are there any other workaround to make this flow work without relaxing the security settings. Curious for any pointers here.
Screenshot 2026-0...
Your file is currently under scan for potential threats. Please wait while we review it for any viruses or malicious content.
The OAuth consent flow opens a popup and expects to communicate back to the parent window using window.opener.
With Cross-Origin-Opener-Policy: same-origin-allow-popups, the popup is isolated from the parent, so the parent cannot detect the OAuth completion. Workarounds:
There is currently no supported workaround that preserves full COOP isolation and allows the OAuth flow to work, because the browser security model intentionally blocks this communication.
The only way to make the flow work is to remove or relax the Cross-Origin-Opener-Policy header for the OAuth endpoints involved in the authentication flow (at least for the login and redirect URIs).
Was this reply helpful?YesNo
Under review
Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.
Screenshot 2026-0...
Share
Report
All responses (
Answers (
238
