403 Forbidden on _api/contextinfo for non-Copilot licensed users via usePwBrokeredAuth=true

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

None

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

Environment

SPFx version: 1.24.0-beta.2
Tenant: Production M365 tenant
Working account: M365 Business Premium + M365 Copilot add-on ✅
Failing account: M365 Business Premium only (no Copilot add-on) ❌
Browser: Edge / Chrome
Surface: Microsoft 365 Copilot Chat (copilot.microsoft.com and Teams)
Root cause hypothesis

The usePwBrokeredAuth token issued by Copilot Chat for non-Copilot licensed users does not include SharePoint API permission scopes. M365 Copilot licensed users receive a richer token that includes these scopes.

Describe the bug / error

Actual behavior

The PortableComponent.aspx loads with &usePwBrokeredAuth=true. The brokered auth token provided for non-Copilot users does not include
SharePoint API scopes, causing:
POST https://[tenant].sharepoint.com/_api/contextinfo → 403 Forbidden
POST https://[tenant].sharepoint.com/_api/web/GetClientSideComponents → 403 Forbidden

Console evidence:
portable-component-assembly...js:221
POST https://communityessentials.sharepoint.com/_api/contextinfo 403 (Forbidden)

portable-component-assembly...js:221
POST https://communityessentials.sharepoint.com/_api/web/GetClientSideComponents 403 (Forbidden)

Additional context

The root SharePoint site has "Everyone except external users" as Site Members, so SharePoint permissions are not the issue. The failing account can browse SharePoint normally when not using the brokered auth flow.

See attached screenshots:

shows clean console with M365 Copilot license (no 403s, AppBridge initialized); [screenshot-failing.png] shows 403s with Business Premium only."

Steps to reproduce

Steps to reproduce

Deploy my-day.sppkg to the tenant App Catalog and sync to Teams
Sign into Microsoft 365 Copilot Chat as a user with only M365 Business Premium (no Copilot add-on)
Invoke the My Day agent: "What does my day look like?"
Component fails to render — "An error has occurred on the server"
Expected behavior

Per Microsoft's own blog post (devblogs.microsoft.com):

"No license barrier to start – built on declarative agents, which enable baseline agent experiences with simply a Microsoft 365 user license."

The component should render for any user with a standard M365 license that includes SharePoint Online.

Expected behavior

The My Day portable component should render for any user with a Microsoft 365 license that includes SharePoint Online, even without a Copilot add-on.

When a Business Premium user invokes the agent in Copilot Chat:

1. The component loads with brokered authentication and valid SharePoint API scopes.
2. POST /_api/contextinfo and POST /_api/web/GetClientSideComponents return 200 OK.
3. The component renders correctly, similar to a Copilot-licensed account.

This is supported by Microsoft’s guidance indicating no licensing barriers. If a Copilot add-on is required, documentation must clarify this, and licensing errors should be more specific instead of showing a generic message.