Copilot Studio MCP tool fails to load tools after OAuth sign-in

Question

Copilot Studio MCP tool fails to load tools after OAuth sign-in

Florence Kai 0

We added a remote MCP server to a Copilot Studio agent with the MCP onboarding wizard, with OAuth 2.0 and Dynamic discovery. The sign-in works and the connection shows Connected. Then Copilot Studio cannot load the tools and shows an HTTP 400 error. I will add the details in a comment.

Florence Kai 0 Reputation points

2026-10-02T12:07:13.3066667+00:00

ERROR DETAILS

The message in Copilot Studio is: Couldn't load MCP tools. The MCP server rejected the request (HTTP 400).

The 400 does not come from the MCP server. The response of the Copilot Studio call names the Power Platform token service as the source: host brazil-001.token.azure-apim.net, an address that ends in "exchange", with the message "An error has occurred" and the operation InvokeServer.

Support IDs shown by Copilot Studio:

58040f65-6357-4afb-896f-01b37e3843a9 (2026-10-01, about 00:25 UTC)

45e1d24c-29d3-4232-9310-1541df4b70e7 (2026-09-30, 21:59 UTC)

Environment ID: 1c4ac13f-44f7-e718-ad5e-583bb94f0fe5 (Developer environment, region brazil-001)

MCP server host: staging.app.olakai.ai (Streamable HTTP, OAuth 2.1 with dynamic client registration)
Florence Kai 0 Reputation points

2026-10-02T12:07:39.9066667+00:00
WHAT THE MCP SERVER LOGS SHOW (THE SAME IN TWO RUNS)

Power Platform reads the two OAuth discovery documents. Both return 200.

Power Platform registers a client with dynamic client registration. The server returns 201. The client name is Credential Manager, and the redirect address is on global.consent.azure-apim.net.

The user signs in. The server issues an authorization code. PKCE with S256 is present.

Power Platform exchanges the code at the token endpoint. The server returns 200 with an access token and a refresh token.

After that, Power Platform sends no more requests to the server: no MCP request, no refresh request, no retry. In run 2 the last request was at 00:22:04 UTC, and the failed tool load was at about 00:25 UTC.

So the OAuth flow with our server completes, and the 400 is produced inside the Power Platform token store, without a call to our server.
Florence Kai 0 Reputation points

2026-10-02T12:08:02.9166667+00:00
FACTS THAT MAY MATTER

The registration returns a public client. The token endpoint authentication method is none, and there is no client secret (RFC 7591). The same server works with other MCP clients, for example Claude and ChatGPT.

The token response is about 2,400 bytes including headers. The access token is an encrypted JWT with a lifetime of 1 hour.

In the Power Apps maker portal the connection shows Connected. In the classic custom connector editor, the Security tab of this connector shows No authentication.

No data policy blocks the connector.
Florence Kai 0 Reputation points

2026-10-02T12:08:21.4966667+00:00
OTHER MODES WE TRIED (2026-10-01)

OAuth 2.0 Dynamic, with the authorization and token addresses entered by hand, two attempts at about 18:50 and 19:00 UTC. Creating the connection fails with HTTP 500 from brazil-001.consent.azure-apim.net, with the message "An error has occurred".

OAuth 2.0 Manual, with a client ID and a secret, at about 19:13 UTC. The callback address was registered exactly as Copilot Studio generated it. The authorization request from Power Platform has no PKCE code challenge. Our server requires PKCE (OAuth 2.1 and the MCP authorization specification), so it refuses the request. We found no PKCE option in the connector Security settings.
Florence Kai 0 Reputation points

2026-10-02T12:08:56.56+00:00
QUESTIONS

What does the 400 from the token service mean for a connection whose authorization code grant completed with HTTP 200? Can Microsoft read the service logs for the two support IDs?

Does the MCP onboarding wizard with Dynamic discovery support public clients, registered by dynamic client registration with no client secret? Does the connector token store need a client secret to do the exchange?

Is there a limit on the token size, or a required field in the token response, that could cause this 400?

In Dynamic mode, what exact value does the Authorization URL field expect, and why does the consent service return 500?

Can Manual mode send PKCE with S256?

1 answer

Your answer

Florence Kai 0 Reputation points

2026-10-02T12:07:13.3066667+00:00

ERROR DETAILS

The message in Copilot Studio is: Couldn't load MCP tools. The MCP server rejected the request (HTTP 400).

The 400 does not come from the MCP server. The response of the Copilot Studio call names the Power Platform token service as the source: host brazil-001.token.azure-apim.net, an address that ends in "exchange", with the message "An error has occurred" and the operation InvokeServer.

Support IDs shown by Copilot Studio:

58040f65-6357-4afb-896f-01b37e3843a9 (2026-10-01, about 00:25 UTC)

45e1d24c-29d3-4232-9310-1541df4b70e7 (2026-09-30, 21:59 UTC)

Environment ID: 1c4ac13f-44f7-e718-ad5e-583bb94f0fe5 (Developer environment, region brazil-001)

MCP server host: staging.app.olakai.ai (Streamable HTTP, OAuth 2.1 with dynamic client registration)
Florence Kai 0 Reputation points

2026-10-02T12:07:39.9066667+00:00

WHAT THE MCP SERVER LOGS SHOW (THE SAME IN TWO RUNS)

Power Platform reads the two OAuth discovery documents. Both return 200.

Power Platform registers a client with dynamic client registration. The server returns 201. The client name is Credential Manager, and the redirect address is on global.consent.azure-apim.net.

The user signs in. The server issues an authorization code. PKCE with S256 is present.

Power Platform exchanges the code at the token endpoint. The server returns 200 with an access token and a refresh token.

After that, Power Platform sends no more requests to the server: no MCP request, no refresh request, no retry. In run 2 the last request was at 00:22:04 UTC, and the failed tool load was at about 00:25 UTC.

So the OAuth flow with our server completes, and the 400 is produced inside the Power Platform token store, without a call to our server.
Florence Kai 0 Reputation points

2026-10-02T12:08:02.9166667+00:00

FACTS THAT MAY MATTER

The registration returns a public client. The token endpoint authentication method is none, and there is no client secret (RFC 7591). The same server works with other MCP clients, for example Claude and ChatGPT.

The token response is about 2,400 bytes including headers. The access token is an encrypted JWT with a lifetime of 1 hour.

In the Power Apps maker portal the connection shows Connected. In the classic custom connector editor, the Security tab of this connector shows No authentication.

No data policy blocks the connector.
Florence Kai 0 Reputation points

2026-10-02T12:08:21.4966667+00:00

OTHER MODES WE TRIED (2026-10-01)

OAuth 2.0 Dynamic, with the authorization and token addresses entered by hand, two attempts at about 18:50 and 19:00 UTC. Creating the connection fails with HTTP 500 from brazil-001.consent.azure-apim.net, with the message "An error has occurred".

OAuth 2.0 Manual, with a client ID and a secret, at about 19:13 UTC. The callback address was registered exactly as Copilot Studio generated it. The authorization request from Power Platform has no PKCE code challenge. Our server requires PKCE (OAuth 2.1 and the MCP authorization specification), so it refuses the request. We found no PKCE option in the connector Security settings.
Florence Kai 0 Reputation points

2026-10-02T12:08:56.56+00:00

QUESTIONS

What does the 400 from the token service mean for a connection whose authorization code grant completed with HTTP 200? Can Microsoft read the service logs for the two support IDs?

Does the MCP onboarding wizard with Dynamic discovery support public clients, registered by dynamic client registration with no client secret? Does the connector token store need a client secret to do the exchange?

Is there a limit on the token size, or a required field in the token response, that could cause this 400?

In Dynamic mode, what exact value does the Authorization URL field expect, and why does the consent service return 500?

Can Manual mode send PKCE with S256?

Answer 1

Hello Florence,

Thank you for the detailed logs and support IDs. Based on the sequence described, the message “The MCP server rejected the request” appears misleading.

OAuth discovery, dynamic client registration, PKCE authorization, and the token exchange all completed successfully. Because no subsequent request reached the MCP server, the HTTP 400 appears to occur inside the Power Platform token service while processing, storing, or retrieving the token.

A dynamically registered public client using token_endpoint_auth_method=none is valid under OAuth/MCP standards. Copilot Studio documentation does not state that Dynamic discovery requires a client secret. Since the token exchange succeeded without one, this should not currently be classified as a server configuration error or by-design limitation. It is more likely a Power Platform interoperability issue, although internal telemetry is required to confirm it.

There is also no published token-size limit indicating that a response of approximately 2,400 bytes is excessive. Please verify that the response contains a string access_token, token_type: "Bearer", numeric expires_in, if supplied, and valid JSON with Content-Type: application/json.

For the other modes:

The exact meaning of Authorization URL in Dynamic mode is insufficiently documented. An HTTP 500 from the Power Platform consent service requires examination of its internal logs.
Manual mode does not expose a PKCE option, and the observed request did not contain a PKCE challenge. It therefore cannot currently be relied upon for an OAuth 2.1 MCP server that requires PKCE. Disabling PKCE on the server is not recommended.
The classic connector editor showing No authentication is not conclusive because the MCP onboarding wizard can manage authentication separately.

At this stage, this should be treated as a suspected Power Platform token-service defect, not confirmed by-design behavior.

Florence Kai 0 Reputation points

2026-10-05T15:53:36.1233333+00:00

Hello Ashlesha,

Thank you for the clear analysis. It agrees with what our server logs show.

I verified the token response of our server today with a real request. It has all the fields you listed:

HTTP status 200, Content-Type application/json, valid JSON

access_token: a string (an encrypted JWT, 926 characters)

token_type: "Bearer"

expires_in: a number, 3600

refresh_token: a string

scope: a string, for example "read write assistive agentic coding"

Two details, in case they matter to the token service: the response is sent with chunked transfer encoding, so it has no Content-Length header. It has the header Cache-Control: no-store, and it does not have the header Pragma: no-cache.

So I think the response is correct, and the suspected defect in the Power Platform token service is still the most probable cause.

Our problem is that we cannot open a formal support request. The test tenant has no support plan for Copilot Studio, so the Power Platform admin center refuses the request. Can you help with one of these?

Can you send this case to the Power Platform or Copilot Studio product team, with the two support IDs, so that they can read the internal logs of the token service?

58040f65-6357-4afb-896f-01b37e3843a9 (2026-10-01, about 00:25 UTC)

45e1d24c-29d3-4232-9310-1541df4b70e7 (2026-09-30, 21:59 UTC)

If the logs for those dates are no longer available, I can reproduce the problem at a time that you choose, and send you a new support ID.

Is there a known workaround for an MCP server that uses dynamic client registration with a public client and requires PKCE?

Thank you for your help!