SPFx AadTokenProvider cannot acquire CopilotStudio.Copilots.Invoke scope — AADSTS65002 preauthorization error blocks @microsoft/agents-copilotstudio-client usage from SPFx

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

None

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• SPFx version: 1.22.2
• Node.js version: 22.14
• etc

Describe the bug / error

Using @microsoft/agents-copilotstudio-client from an SPFx solution using aadtokenprovider is impossible because the SPFx first-party app principal ( SharePoint Online Client Extensibility Web Application Principal) is not preauthorized for the CopilotStudio.Copilots.Invoke scope on the Power Platform API resource (https://api.powerplatform.com).

Steps to reproduce

Repro Steps:

1. Create an SPFx web part or ACE
2. Add @microsoft/agents-copilotstudio-client as a dependency
3. Add the following to config/package-solution.json:

   {
     "resource": "Power Platform API",
     "scope": "CopilotStudio.Copilots.Invoke"
   }

4. Deploy the .sppkg to the app catalog
5. Approve the API permission in SharePoint Admin Center → Advanced → API access (status shows Approved)
6. Verify admin consent has been granted in Entra ID → Enterprise Applications → SharePoint Online Client Extensibility Web Application Principal → Permissions for CopilotStudio.Copilots.Invoke on Power Platform API
7. Acquire token via SPFx using aadtokenprovider:

const aadTokenProvider = await this.context.aadTokenProviderFactory.getTokenProvider();
const token = await aadTokenProvider.getToken("https://api.powerplatform.com", false);

8. Decode the JWT — scp claim only contains PowerVirtualAgents.Tokens.Read, not CopilotStudio.Copilots.Invoke
9. Pass token to CopilotStudioClient → API returns 403 Forbidden

Workaround Attempted

• Tried using IGetTokenOptions.scopes (marked @internal) to explicitly request the scope:

const token = await aadTokenProvider.getToken("https://api.powerplatform.com", {
  useCachedToken: false,
  scopes: ["https://api.powerplatform.com/CopilotStudio.Copilots.Invoke"],
} as any);

• This produces a different error — AADSTS65002:

Consent between first party application '08e18876-6177-487e-b8b5-cf950c1e598c'
and first party resource '8578e004-a5c6-46e7-913e-12f58912df43' must be
configured via preauthorization — applications owned and operated by Microsoft
must get approval from the API owner before requesting tokens for that API.

This confirms the SPFx first-party app is not preauthorized by the Power Platform API for this scope. Tenant admin consent alone is insufficient for first-party-to-first-party authorization.

Expected behavior

aadTokenProvider.getToken("https://api.powerplatform.com")should return a token that includes CopilotStudio.Copilots.Invoke in the scp claim when:

• The permission is declared in package-solution.json
• The permission is approved in SharePoint Admin Center
• Admin consent is granted in Entra ID