Use service principal authentication for Copilot Studio MCP servers
Diesen Beitrag auf Deutsch lesen
Configure an MCP server as a Power Platform custom connector with app-only authentication, then use a maker-provided shared connection in Copilot Studio.
Original article from March 19, 2026: Secure Your MCP Server with Service Principal Authentication for Copilot Studio, by Mohamed Ashiq Faleel, on Mohamed Ashiq Faleel. Read the original
Source may be outdated. The original article is more than 60 days old. Dates and availability refer to the state of the source.
This is our own summary, not a republication or full translation.
TL;DR
Copilot Studio can connect to an MCP server through a Power Platform custom connector using OAuth 2.0 service principal support. Create an application app role, grant the Copilot client application permission and admin consent, add x-ms-agentic-protocol: mcp-streamable-1.0, create the shared connection, then select Maker provided credentials for the agent tool.
Why it matters
- Makers: Build the MCP custom connector with OAuth 2.0 service principal support, add the MCP protocol extension, then attach its connection as an existing MCP server tool.
- Admins/IT: Create the MCP API application role, assign the application permission to the Copilot client and grant admin consent before the shared connection is created.
- Leadership/Business: Use app-only authentication for shared or background tools that do not require individual user identity, avoiding per-user connection creation.
Frequently asked questions
How do I use a service principal with a Copilot Studio MCP server?
Create a Power Platform custom connector with OAuth 2.0 service principal support, then create and select its shared connection in Copilot Studio.
Which permission does the Copilot client need for the MCP Server API?
The Copilot client needs the MCP Server application's api.server.access application permission. An administrator must grant consent for that permission.
Which Copilot Studio credential setting keeps an MCP tool on one connection?
Select Maker provided under Credentials to use after adding the MCP tool. This makes the agent use the same shared connection rather than prompting each user.