A security engineer is deploying Microsoft Copilot Studio with custom connectors that access internal APIs. The security team requires that authentication between Copilot Studio bots and internal APIs must use OAuth 2.0 with Entra ID, not API keys. How should the custom connector be configured?
Select an answer to reveal the explanation.
Short Explanation
Set the custom connector to OAuth 2.0 and point it at Entra ID's authorization and token endpoints. That lets the bot request and refresh Entra ID tokens instead of relying on a static key.
Full Explanation
The correct configuration is to configure the custom connector with the OAuth 2.0 authentication type, specifying the Microsoft Entra ID authorization endpoint, token endpoint, client ID, and scope. This enables the bot to acquire Entra ID tokens and authenticate to internal APIs using the OAuth 2.0 authorization code or client credentials flow. The API Key approach with the Entra ID token stored as the key value is incorrect because configuring API Key authentication and storing a token as the key value is not proper OAuth 2.0 implementation; the token would be static and would expire without a refresh mechanism. The environment variable approach is incorrect because storing a client secret in an environment variable as a workaround does not implement proper OAuth 2.0 token acquisition and refresh; using the built-in OAuth connector type is the correct approach. The Azure API Management approach is incorrect because adding APIM as a translation layer adds unnecessary infrastructure complexity when Copilot Studio's connector framework natively supports OAuth 2.0.