Microsoft 365 Copilot Chat API returns 403 Forbidden despite successful authentication and delegated permissions

Gulshan Kumar 0 Reputation points
2026-11-04T11:35:23.76+00:00

Hello Microsoft Team,

We are integrating the Microsoft 365 Copilot Chat API into our private company web portal, Consultique.

Our current environment:

  • Microsoft 365 Business Standard.

Microsoft Entra ID authentication.

Microsoft Graph API integration.

Teams and Calendar integrations are working successfully.

Delegated authentication and permissions have been configured.

Our portal uses a MySQL database containing client portfolios, financial information, business records and other company data.

The issue:

When attempting to access the Microsoft 365 Copilot Chat API, we consistently receive a 403 Forbidden response.

Authentication appears successful, but the Copilot API request is rejected.

Our intended architecture:

We want to integrate Microsoft 365 Copilot with our existing portal so users can ask natural-language questions and receive answers based on:

Client portfolios and financial information stored in MySQL.

Other business records and structured database information.

Information available across the portal's pages and modules.

Analytical insights, summaries and predictions generated from company data.

We are also developing an advanced agentic RAG architecture to retrieve relevant information from our existing MySQL database and provide contextual answers.

Questions for Microsoft:

Does the Microsoft 365 Copilot Chat API require a separate Microsoft 365 Copilot add-on licence? Is Business Standard sufficient?

Does the API require a specific Microsoft Entra ID application permission, delegated permission or additional entitlement?

Is there a specific licensing or tenant-level requirement that causes a 403 Forbidden response?

What is the recommended Microsoft-supported architecture for connecting an external MySQL database to Microsoft 365 Copilot?

Can Microsoft Copilot Studio, custom connectors or MCP-based integrations provide access to our existing MySQL database and enable users to query its data through Copilot?

We would appreciate clear guidance on the required licensing, permissions, API eligibility and recommended integration architecture.

Thank you.Hello Microsoft Team,

We are integrating the Microsoft 365 Copilot Chat API into our private company web portal, Consultique.

Our current environment:

Microsoft 365 Business Standard.

Microsoft Entra ID authentication.

Microsoft Graph API integration.

Teams and Calendar integrations are working successfully.

Delegated authentication and permissions have been configured.

Our portal uses a MySQL database containing client portfolios, financial information, business records and other company data.

The issue:

When attempting to access the Microsoft 365 Copilot Chat API, we consistently receive a 403 Forbidden response.

Authentication appears successful, but the Copilot API request is rejected.

Our intended architecture:

We want to integrate Microsoft 365 Copilot with our existing portal so users can ask natural-language questions and receive answers based on:

Client portfolios and financial information stored in MySQL.

Other business records and structured database information.

Information available across the portal's pages and modules.

Analytical insights, summaries and predictions generated from company data.

We are also developing an advanced agentic RAG architecture to retrieve relevant information from our existing MySQL database and provide contextual answers.

Questions for Microsoft:

Does the Microsoft 365 Copilot Chat API require a separate Microsoft 365 Copilot add-on licence? Is Business Standard sufficient?

Does the API require a specific Microsoft Entra ID application permission, delegated permission or additional entitlement?

Is there a specific licensing or tenant-level requirement that causes a 403 Forbidden response?

What is the recommended Microsoft-supported architecture for connecting an external MySQL database to Microsoft 365 Copilot?

Can Microsoft Copilot Studio, custom connectors or MCP-based integrations provide access to our existing MySQL database and enable users to query its data through Copilot?

We would appreciate clear guidance on the required licensing, permissions, API eligibility and recommended integration architecture.

Thank you.

Microsoft Copilot | Microsoft 365 Copilot | Development
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ashlesha Pawar (Tata Consultancy Services Limited) 565 Reputation points Microsoft External Staff
    2026-11-05T05:04:11.2433333+00:00

    Hi Gulshan,

    The AI response correctly identifies the documented licensing and permission requirements for the Microsoft Graph /beta/copilot Chat API. However, we need the exact error details before confirming why your request returns 403.

    Please share the endpoint URL, HTTP method, sanitized error response, response request-id, and UTC timestamp. Also confirm that the signed-in user has a Microsoft 365 Copilot add-on license and that the delegated token has the required Graph scopes and correct audience. Please do not share access tokens, secrets, or client financial information.

    One additional option relevant to your existing RAG architecture: the Chat API supports additionalContext. Your backend can retrieve the records the signed-in user is authorized to access from MySQL and provide selected text as grounding. This is not a direct database connection, and your application remains responsible for enforcing access controls before sending that data.

    For live database operations, use a secured API exposed through a Copilot Studio tool/custom connector or an appropriate MCP integration. For indexed, searchable business knowledge, consider a synchronized Copilot connector. These integrations do not automatically become tools available through the Graph Chat API.

    Finally, the Graph Chat API remains under /beta, with production use unsupported. Its documented capabilities also exclude code interpreter and action execution, so financial calculations or predictions should run in your validated backend, with the agent summarizing the results.

    Once we have the error details, we can distinguish an entitlement/permission issue from a potential service defect.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-04T11:36:33.8366667+00:00

    Assign a Microsoft 365 Copilot add-on license to every user who invokes the Chat API; Microsoft 365 Business Standard provides Copilot Chat access but, by itself, does not currently qualify a user for the Microsoft 365 Copilot Chat API. ^1^

    Resolve the 403

    For the Microsoft Graph /beta/copilot Chat API:

    1. Purchase and assign the add-on
      • Assign a Microsoft 365 Copilot add-on license to the signed-in user whose delegated token is sent to the API.
      • Business Standard can provide the eligible base subscription, but the API documentation explicitly says that users without the Copilot add-on aren't currently supported.
      • This differs from the interactive Copilot Chat product, which is included for eligible Microsoft 365 users. Without the add-on, interactive Copilot Chat cannot access shared enterprise, personal, or Graph-connector data except through separately metered Copilot Studio agents. ^2^
    2. Configure every required delegated Graph permission The Graph Chat API requires all of these delegated permissions:
      • Sites.Read.All
      • Mail.Read
      • People.Read.All
      • OnlineMeetingTranscript.Read.All
      • Chat.Read
      • ChannelMessage.Read.All
      • ExternalItem.Read.All
      Application permissions and personal Microsoft accounts aren't supported. Granting only the permissions needed by your existing Teams or Calendar integration is insufficient for this API. ^3^
    3. Grant tenant consent and obtain a new delegated token
      • In Microsoft Entra admin center → App registrations → your application → API permissions, add the seven delegated Microsoft Graph permissions.
      • Grant admin consent where required.
      • Have the licensed user complete the delegated sign-in flow again so the issued token contains the newly consented scopes.
      • Inspect the token’s scp claim and verify that all seven scopes are present. Successful token acquisition confirms authentication, not API entitlement or authorization.
    4. Call the documented endpoint 
         POST https://graph.microsoft.com/beta/copilot/conversations/{conversationId}/chat
   Authorization: Bearer {delegated-user-token}
   Content-Type: application/json

   {
     "message": {
       "text": "Summarize the relevant client information."
     },
     "locationHint": {
       "timeZone": "UTC"
     }
   }
      The successful result is 200 OK. The /beta API is preview and isn't supported for production applications, which is important for a financial-data portal. ^3^

    If you are actually calling the separate Work IQ Chat API at workiq.svc.cloud.microsoft, do not apply the seven Graph scopes: that endpoint requires delegated WorkIQAgent.Ask, and application permissions are likewise unsupported. ^4^

    The Chat API does not connect directly to MySQL. Choose the integration pattern based on data freshness and whether financial records may be copied into Microsoft 365.

    Live portfolio and financial queries: Copilot Studio plus an API connector

    For current balances, portfolio calculations, predictions, and transactional operations:

    1. Place a controlled REST API in front of MySQL; don't expose the database directly.
    2. Enforce user/tenant authorization, row-level access, query allowlists, auditing, and output minimization in that API.
    3. Define the API through OpenAPI and add it to Copilot Studio as a custom Power Platform connector.
    4. Use the connector as real-time knowledge or an agent tool.

    Power Platform connectors call systems at runtime under the connection identity and are the recommended option for current facts, no-copy access, and read/write operations. Real-time knowledge is currently preview, and connector availability can require premium Power Platform or Copilot Studio licensing not included with standard Microsoft 365 licensing. ^5^

    For an on-premises or private-network MySQL server, the on-premises data gateway supports MySQL connections; use standard gateway mode and account for the required gateway-capable license. ^6^

    Searchable business knowledge: Microsoft 365 Copilot connector

    For relatively stable records or documents that should be semantically searchable:

    1. Build or configure a Copilot connector.
    2. Map searchable and retrievable properties, semantic labels, source URLs, and access-control lists.
    3. Index the permitted content into Microsoft Graph.
    4. Add that enterprise connection as a Copilot Studio knowledge source.

    This copies and indexes content in Microsoft 365, while preserving source-level permissions. It is appropriate for broad knowledge discovery and citations, but less suitable for rapidly changing balances or especially sensitive data that shouldn't be replicated. ^7^

    MCP option

    Copilot Studio can also add a custom MCP server by HTTPS URL:

    Copilot Studio → agent → Build → Tools → Add → Model Context Protocol

    Supply the server URL and supported authentication configuration, review the discovered tools, and save them. The MCP server can expose narrowly scoped operations such as getPortfolioSummary rather than unrestricted SQL. This Copilot Studio capability is preview, so production use should account for possible changes and restricted functionality. ^8^

    For the stated workload, the strongest design is usually:

    • Copilot connector for stable, searchable portal knowledge.
    • Custom Power Platform connector or MCP tools for live MySQL facts and calculations.
    • Your existing RAG service behind a secured API when custom retrieval, financial computation, or model orchestration is required.
    • Chat API only for supported Microsoft 365/web-grounded conversational scenarios, after assigning the Copilot add-on and required delegated scopes.

    References

    1. Overview of the Microsoft 365 Copilot Chat API (preview)
    2. Frequently asked questions about Copilot Chat
    3. copilotConversation: chat
    4. Work IQ - copilotConversation: chat (work-iq-rest-prod)
    5. Copilot connectors versus Power Platform connectors as knowledge sources
    6. Manage an on-premises data gateway in Power Automate
    7. Add Copilot connectors as a knowledge source
    8. Add a Model Context Protocol (MCP) server to your agent as a tool (GitHub Copilot) (preview)
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.