You deploy a Copilot Studio agent in Microsoft Teams for employees. You want the agent to access each employee's personal OneDrive files without requiring a separate login prompt within the conversation. Which configuration enables this silent authentication experience?
Select an answer to reveal the explanation.
Short Explanation
SSO in Teams is like a VIP badge that works everywhere — once you're signed into Teams, the agent silently borrows that authentication token to access OneDrive on your behalf. You get no new login prompt, no friction, and no credential storage.
Full Explanation
Copilot Studio supports Single Sign-On (SSO) for Teams-deployed agents. When configured with Microsoft (Azure AD) authentication and SSO enabled for Teams, the agent can obtain the user's authentication token directly from their active Teams session without prompting for an additional login. That token can then be used for delegated API calls, such as accessing the user's OneDrive through the Microsoft Graph API or a connector configured with user-delegated authentication. The configuration involves setting the agent authentication to 'Authenticate with Microsoft' or 'Manual (AAD V2)', enabling SSO in the Teams channel configuration, and registering an Azure AD app registration with the appropriate API permissions, such as Files.ReadWrite for OneDrive access. The no-authentication approach that uses the OneDrive connector's service account is wrong because a shared service account makes the agent access the service account's OneDrive, not each employee's personal OneDrive, which breaks the personalization requirement entirely. Storing each employee's OneDrive credentials in a Dataverse table and retrieving them at the start of each conversation is wrong because storing credentials in a database is a severe security anti-pattern; never store user passwords or OAuth tokens in application tables. Deploying the agent to a custom website channel where employees log in with their Microsoft account before starting a conversation is wrong because it uses a different channel deployment and still presents a login page rather than silent SSO, while the question specifically asks about the Teams experience. Exam pattern: Teams + SSO + Azure AD authentication equals silent authentication using the existing Teams session, and this is the enterprise-standard pattern for Teams-deployed authenticated agents.