Foundry agents published to "People in your organization" never receive messages in Microsoft 365 Copilot ("Just you" works)

Question

Foundry agents published to "People in your organization" never receive messages in Microsoft 365 Copilot ("Just you" works)

woe-adm-shr 0

Since mid-October 2026, every agent we publish from Microsoft Foundry to Microsoft 365 Copilot with scope "People in your organization" (Tenant) shows up in Copilot after admin approval, but never answers. Copilot shows "I wasn't able to generate a response" or "The agent may still be processing your request". The message never reaches the agent: no session is created and nothing appears in Foundry.

What works:

The same agents answer in the Foundry playground and via "Test in Web Chat" on their Azure Bot Service.
New agents published with scope "Just you" (Shared) work in Copilot after a few hours.
An older Tenant-scope agent in the same project, published on 13 Oct 2026, still works for the same users.

Controlled test: two identical new prompt agents created in the Foundry portal at the same time, differing only in publish scope. "Just you": works. "People in your organization", approved in the Microsoft 365 admin center: no response after more than 24 hours.

What we already checked:

Approval in the Microsoft 365 admin center, users assigned individually (same as the working agent).
Approval flow: template "Default policy template for agents", no custom policies, "This agent does not require any special permissions".
Agent settings: all agent types allowed, user access "All users", no gateways. Nothing pending in the Teams admin center. No Conditional Access policies targeting agents.
App manifests, Bot Service settings and channels, agent identity and Azure roles are identical to the working agent. Bot ID, app ID and tenant match.
Removed the new "isolation_key_source" property to match the working agent: no change.
Waited more than 24 hours, re-uploaded the app package, tested with new chats and a second user.

Similar reports:

Question: Is there a known issue with Tenant-scope publishing of Foundry agents to Microsoft 365 Copilot since mid-October 2026, or an additional step required for newly published organization-wide agents? Has anyone found a fix other than switching to Shared scope?

0 comments

1 answer

Your answer

Answer 1

The documented required steps for organization-wide agents are:

Publish the agent at tenant scope by selecting People in your organization or setting publishScope to Tenant.
Have a Microsoft 365 admin approve the request in the Microsoft 365 admin center.
After approval, the agent should appear under Built by your org in the agent store.

If the agent appears in Copilot after approval but users still can’t successfully invoke it, the documented cause is usually endpoint authorization, not store visibility.

For published agents:

Just you / Shared uses BotServiceRbac.
Tenant-wide access for everyone in the organization requires replacing BotServiceRbac with BotServiceTenant.
An endpoint can use either BotServiceRbac or BotServiceTenant, but not both.
Publishing at tenant scope and Microsoft 365 admin approval are required before patching the authorization scheme.

If only selected users should be able to invoke the agent, assign those users the Foundry Agent Consumer built-in role.

A supported end-to-end path is:

Confirm the agent was published with publishScope = Tenant.
Confirm Microsoft 365 admin approval completed in the Microsoft 365 admin center.
Get an access token for the Foundry API:

az account get-access-token \
  --resource https://ai.azure.com \
  --query accessToken \
  --output tsv

Get the agent and inspect its current authorization_schemes:

GET {{endpoint}}/agents/{{agent_name}}?api-version=v1
Authorization: ******

Project endpoint format:

https://<resource-name>.services.ai.azure.com/api/projects/<project-name>

If the endpoint still uses BotServiceRbac, patch it after tenant approval so it uses BotServiceTenant instead, while retaining Entra and any other non-Bot Service schemes the endpoint needs.

Also verify these documented conditions:

Store visibility and endpoint authorization are separate.
If requests reach the Activity Protocol endpoint but are rejected, configure BotServiceRbac or BotServiceTenant, and the caller must sign in from the same tenant as the project.
Guest users can’t call these agents.
If the agent works in the Foundry playground but fails after publishing, assign the required roles to the agent identity for each Azure resource it accesses.
If the conversation appears stuck, start a new conversation. In Teams, /foundry_new_preview resets the conversation.

The provided documentation does not describe a known mid-October 2026 tenant-scope publishing outage. The documented additional step for organization-wide invocation is updating authorization from BotServiceRbac to BotServiceTenant for tenant-wide access, or assigning Foundry Agent Consumer to selected users.