How To bypass the connector consent card for Copilot Studio agents

Microsoft has finally made available functionality for administrators to bypass the consent card displayed to end user when they use a Copilot Studio agent.

When does a consent card appear?

A consent card is displayed when all of the following are true:

• The agent invokes a connector that uses end-user authentication.
• The connector is acting as the user, not using maker-provided credentials.
• The user does not already have an approved connection for that connector.
• The connector supports Microsoft Entra ID-based authentication.

Typical examples:

• Outlook actions
• Teams actions
• SharePoint actions
• Dataverse actions configured to run as the user
• Other Microsoft and third-party connectors that require the user’s identity

But now an administrator can run a PowerShell script to bypass that consent card for specific Copilot Studio agents.

How-To

The Microsoft Learn article below describes the process and has the PowerShell script you need to bypass the consent card.

Bypass connector consent cards for an agent – Microsoft Copilot Studio | Microsoft Learn

• Download the PowerShell script, name it ConsentBypass-CopilotStudio.ps1 and save it to a folder on your machine
• To run the script your account will have to have one of these Entra roles:
  • Power Platform Administrator
  • AI Administrator
  • Global Administrator

Next you will need to create a Microsoft Entra application in the Azure Portal. https://portal.azure.com

Go to Microsoft Entra ID > App registrations, select New Registration.

Give the App registration the name: CopilotStudioConsentBypassPS

Set Supported account types to Single tenant only – <your tenant>

Set redirect URI to Public client/native (mobile and desktop) and the Redirect URI to http://localhost

Then click Register. From the Overview Page of the App registration copy the Application (client) ID, we will need that for later.

Go to API permissions in the App registration and select Add a permission.

On the APIs my organization uses, search for Power Platform API.

Select it and the select Delegated permissions.

Find the permission CopilotStudio.AdminActions.Invoke under CopilotStudio and check the checkbox and click Add permissions.

That completes the app registration setup. This only needs to be done once per tenant.

Run the PowerShell script

Open PowerShell and change to the folder where you saved the script. If the script is blocked because the execution policy blocks unsigned scripts run the following command.

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

This will allow the script to run for this PowerShell process and will reset when the window is closed.

If Windows says the script file is blocked, unblock it with the following command.

Unblock-File -Path .\ConsentBypass-CopilotStudio.ps1

Run the following command to load the script functions into the PowerShell session:

. .\ConsentBypass-CopilotStudio.ps1

And now we are ready to run functions from the script. Start with this:

Connect-CopilotStudioAdmin -TenantId "b7f2c418-6d9a-4e31-8a52-1c3f7d90e6ab" -ClientId "c3a7f921-84de-4b65-9f12-6d0e8a42b7c5"

You can find both TenantId and ClientId from the Overview page of the App registration we created earlier.

And to turn on the consent bypass for an agent run the following command:

Set-AdminCopilotStudioBotConnectorConsentBypass -EnvironmentId "7d91e4b2-a638-4f0c-b527-9e6a13d8c045" -BotId "e6b4c2a9-17f3-48d5-8c01-2a9f7e63b4d8" -BypassConsent $true

You can find both the EnvironmentId and BotId from the URL of the agent in Copilot Studio:

Now you can run the following command to check if consent bypass is set to true:

Get-AdminCopilotStudioBotConnectorConsentBypass -EnvironmentId "7d91e4b2-a638-4f0c-b527-9e6a13d8c045" -BotId "e6b4c2a9-17f3-48d5-8c01-2a9f7e63b4d8"

That will return True when the setting is on and false when its off.

So, what did we bypass?

Bypassing the consent message removes the dialog shown below for end users. They no longer need to select Allow, because an administrator has already approved the connector for use in that specific agent.

The consent bypass does not remove the connection dialog for every type of connector. The example below is from the Microsoft Learn MCP connector in an agent. When using End User Credentials, the user will still have to set up their own connection for this connector. If the connector is set to Maker-Provided credentials the user would not have to set up their own connection.

More Information

Bypass connector consent cards for an agent – Microsoft Copilot Studio | Microsoft Learn