Power Platform Community Forum Thread Details

ustomerHi all,

We're working with a con a project that is a top priority for them. It involves deploying an MCP server on Container Apps and a chat interface. They're evaluating options for the interface, but we think a Copilot agent makes the most sense. I'm trying to use your Copilot Studio MCP lab as a POC and everything works as expected following the steps you provide, but the customer has a firm requirement for Entra auth on the container app and I'm struggling to get that working with the custom connector.

What I've tried following already:

Lab MCS5 - Consuming a custom connector - Copilot Developer Camp

Create a custom connector for a web API | Microsoft Learn

https://learn.microsoft.com/en-us/azure/container-apps/authentication-entra#-option-2-use-an-existing-registration-created-separately

Any assistance you could provide with this would be greatly appreciated. The project has high visibility and a fairly tight timeline.

Thanks!

Categories:

Model context protocol

Hi @JH-24071535-0,

Thanks for sharing the details—this is a great use case

Key Considerations

Container App Authentication
When you enable Entra auth on Container Apps, the app is protected by Azure AD. Any incoming request must include a valid Bearer token issued by Entra.
Custom Connector Authentication
The connector needs to acquire a token from Entra and attach it to requests. This usually involves:
- Registering an App Registration in Entra.
- Configuring the connector with OAuth 2.0 settings (Authorization URL, Token URL, Client ID, Secret, Scopes).
- Ensuring the resource URI matches the Container App’s protected endpoint.
Copilot Studio Connector Behavior
Copilot Studio supports OAuth 2.0 for custom connectors, but the tricky part is aligning the connector’s token acquisition with the Container App’s expected audience.

Recommended Steps
1. App Registration

Create an App Registration in Entra for the Container App.
Note the Client ID, Tenant ID, and Client Secret.
Under Expose an API, set the Application ID URI (e.g., api://<your-app-id>).
Add required permissions (usually user.read or custom scopes).

2. Enable Authentication on Container App

In Azure Portal → Container App → Authentication, select Microsoft Entra ID.
Use the App Registration created above.
Ensure the redirect URI matches what Copilot Studio expects (usually https://global.consent.azure-apim.net/redirect for connectors).

3. Configure Custom Connector

In Copilot Studio:
- Auth type: OAuth 2.0
- Authorization URL: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize
- Token URL: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
- Scope: api://<your-app-id>/.default
- Resource: api://<your-app-id> (if required)
Test the connector to ensure token acquisition works.