❗️Dev Tunnel CLI Permission Issue – Missing Host/Manage Scopes on Work Account 🚨

Hi all,

I'm currently working through the Microsoft Copilot Studio lab for consuming a custom connector and stuck at the step where I need to configure a dev tunnel using the devtunnel CLI.

When I try to host the tunnel, I get this error in PowerShell:

Tunnel service error: Request not permitted. Unauthorized tunnel access:
Authenticated user has scopes [create, connect]; expected one or more of [manage, ports, host].

I'm using a Microsoft 365 work account (not a personal one), and I've already installed and updated the CLI tool.

From what I understand, this issue is due to missing scopes (like Tunnel.Manage, Tunnel.Host, and Tunnel.Port) that must be granted by a tenant admin in Azure/Microsoft Entra ID.

❓My Ask:

• Can someone walk me through how a tenant admin can grant these permissions in Azure?
• I’ve checked under Microsoft Entra ID > Enterprise Applications, but I can’t find a clear place to enable or consent to these scopes.

Any help or direct steps for granting the necessary API permissions for Dev Tunnels would be super appreciated!

Thanks 🙏

Review the linked Copilot Studio custom-connector lab and its devtunnel CLI step first, then verify how work-account scopes and tenant-admin consent are documented. Done means adding clear, project-appropriate guidance for the required permissions or explicitly documenting the limitation and escalation path.