Microsoft 365 Copilot Chat API returns 403 Forbidden despite successful authentication and delegated permissions

Assign a Microsoft 365 Copilot add-on license to every user who invokes the Chat API; Microsoft 365 Business Standard provides Copilot Chat access but, by itself, does not currently qualify a user for the Microsoft 365 Copilot Chat API. ^1^

Resolve the 403

For the Microsoft Graph /beta/copilot Chat API:

1. Purchase and assign the add-on
   • Assign a Microsoft 365 Copilot add-on license to the signed-in user whose delegated token is sent to the API.
   • Business Standard can provide the eligible base subscription, but the API documentation explicitly says that users without the Copilot add-on aren't currently supported.
   • This differs from the interactive Copilot Chat product, which is included for eligible Microsoft 365 users. Without the add-on, interactive Copilot Chat cannot access shared enterprise, personal, or Graph-connector data except through separately metered Copilot Studio agents. ^2^
2. Configure every required delegated Graph permission The Graph Chat API requires all of these delegated permissions:
   • Sites.Read.All
   • Mail.Read
   • People.Read.All
   • OnlineMeetingTranscript.Read.All
   • Chat.Read
   • ChannelMessage.Read.All
   • ExternalItem.Read.All
   Application permissions and personal Microsoft accounts aren't supported. Granting only the permissions needed by your existing Teams or Calendar integration is insufficient for this API. ^3^
3. Grant tenant consent and obtain a new delegated token
   • In Microsoft Entra admin center → App registrations → your application → API permissions, add the seven delegated Microsoft Graph permissions.
   • Grant admin consent where required.
   • Have the licensed user complete the delegated sign-in flow again so the issued token contains the newly consented scopes.
   • Inspect the token’s scp claim and verify that all seven scopes are present. Successful token acquisition confirms authentication, not API entitlement or authorization.
4. Call the documented endpoint

      POST https://graph.microsoft.com/beta/copilot/conversations/{conversationId}/chat
      Authorization: Bearer {delegated-user-token}
      Content-Type: application/json
   
      {
        "message": {
          "text": "Summarize the relevant client information."
        },
        "locationHint": {
          "timeZone": "UTC"
        }
      }
   

   The successful result is 200 OK. The /beta API is preview and isn't supported for production applications, which is important for a financial-data portal. ^3^

If you are actually calling the separate Work IQ Chat API at workiq.svc.cloud.microsoft, do not apply the seven Graph scopes: that endpoint requires delegated WorkIQAgent.Ask, and application permissions are likewise unsupported. ^4^

Recommended MySQL architecture

The Chat API does not connect directly to MySQL. Choose the integration pattern based on data freshness and whether financial records may be copied into Microsoft 365.

Live portfolio and financial queries: Copilot Studio plus an API connector

For current balances, portfolio calculations, predictions, and transactional operations:

1. Place a controlled REST API in front of MySQL; don't expose the database directly.
2. Enforce user/tenant authorization, row-level access, query allowlists, auditing, and output minimization in that API.
3. Define the API through OpenAPI and add it to Copilot Studio as a custom Power Platform connector.
4. Use the connector as real-time knowledge or an agent tool.

Power Platform connectors call systems at runtime under the connection identity and are the recommended option for current facts, no-copy access, and read/write operations. Real-time knowledge is currently preview, and connector availability can require premium Power Platform or Copilot Studio licensing not included with standard Microsoft 365 licensing. ^5^

For an on-premises or private-network MySQL server, the on-premises data gateway supports MySQL connections; use standard gateway mode and account for the required gateway-capable license. ^6^

Searchable business knowledge: Microsoft 365 Copilot connector

For relatively stable records or documents that should be semantically searchable:

1. Build or configure a Copilot connector.
2. Map searchable and retrievable properties, semantic labels, source URLs, and access-control lists.
3. Index the permitted content into Microsoft Graph.
4. Add that enterprise connection as a Copilot Studio knowledge source.

This copies and indexes content in Microsoft 365, while preserving source-level permissions. It is appropriate for broad knowledge discovery and citations, but less suitable for rapidly changing balances or especially sensitive data that shouldn't be replicated. ^7^

MCP option

Copilot Studio can also add a custom MCP server by HTTPS URL:

Copilot Studio → agent → Build → Tools → Add → Model Context Protocol

Supply the server URL and supported authentication configuration, review the discovered tools, and save them. The MCP server can expose narrowly scoped operations such as getPortfolioSummary rather than unrestricted SQL. This Copilot Studio capability is preview, so production use should account for possible changes and restricted functionality. ^8^

For the stated workload, the strongest design is usually:

• Copilot connector for stable, searchable portal knowledge.
• Custom Power Platform connector or MCP tools for live MySQL facts and calculations.
• Your existing RAG service behind a secured API when custom retrieval, financial computation, or model orchestration is required.
• Chat API only for supported Microsoft 365/web-grounded conversational scenarios, after assigning the Copilot add-on and required delegated scopes.

References

1. Overview of the Microsoft 365 Copilot Chat API (preview)
2. Frequently asked questions about Copilot Chat
3. copilotConversation: chat
4. Work IQ - copilotConversation: chat (work-iq-rest-prod)
5. Copilot connectors versus Power Platform connectors as knowledge sources
6. Manage an on-premises data gateway in Power Automate
7. Add Copilot connectors as a knowledge source
8. Add a Model Context Protocol (MCP) server to your agent as a tool (GitHub Copilot) (preview)