|
| 1 | +# Deploy a Microsoft Copilot Studio Copilot as a SharePoint Component with Single Sign-On (SSO) |
| 2 | + |
| 3 | +This guide provides a comprehensive walkthrough for deploying a Microsoft Copilot Studio Copilot as a SharePoint Framework (SPFx) component with Single Sign-On (SSO) functionality. Follow these steps to ensure a seamless integration. |
| 4 | + |
| 5 | +--- |
| 6 | + |
| 7 | +## Overview |
| 8 | + |
| 9 | +Deploying the Copilot as a SharePoint SPFx component involves the following: |
| 10 | + |
| 11 | +1. Configuring Microsoft Entra ID authentication for your Copilot. |
| 12 | +2. Registering your SharePoint site as a canvas app to enable SSO. |
| 13 | +3. Building, configuring, and packaging the SPFx component. |
| 14 | +4. Deploying the component to SharePoint, configuring properties, and validating its functionality. |
| 15 | + |
| 16 | +Each step is explained in detail, with examples, prerequisites, and troubleshooting tips. |
| 17 | + |
| 18 | +--- |
| 19 | + |
| 20 | +## Step 1: Configure Microsoft Entra ID Authentication for the Copilot |
| 21 | + |
| 22 | +Authentication is a critical step in ensuring the Copilot operates securely within your organization. This involves setting up API permissions, defining custom scopes, and validating the integration with the Copilot Studio authoring environment. |
| 23 | + |
| 24 | +### Prerequisites: |
| 25 | + |
| 26 | +- Access to the Azure portal with administrative privileges. |
| 27 | +- Existing app registration for the Copilot or the ability to create a new one. |
| 28 | +- Familiarity with Microsoft Entra ID concepts such as scopes, API permissions, and redirect URIs. |
| 29 | + |
| 30 | +### Detailed Steps: |
| 31 | + |
| 32 | +1. **Create or Update App Registration for the Copilot**: |
| 33 | + - Log in to the Azure portal. |
| 34 | + - Navigate to **Azure Active Directory** > **App registrations**. |
| 35 | + - Select your existing Copilot app registration or create a new one by clicking **New registration**. |
| 36 | + - Specify the following details: |
| 37 | + - **Name**: Provide a meaningful name (e.g., "Copilot Authentication App"). |
| 38 | + - **Supported account types**: Choose "Accounts in this organizational directory only". |
| 39 | + - **Redirect URI**: Leave blank for now; this will be configured later. |
| 40 | + |
| 41 | +2. **Define API Permissions**: |
| 42 | + - Go to the **API permissions** tab in the app registration. |
| 43 | + - Add permissions for Microsoft Graph: |
| 44 | + - **Delegated permissions**: `Sites.Read.All`, `Sites.ReadWrite.All`, and any others required for your use case. |
| 45 | + - If using custom APIs, click **Add a permission** > **APIs my organization uses** and locate your custom API. |
| 46 | + - Select the appropriate custom scope, e.g., `api://YOUR-APP-ID/SPO.Read`. |
| 47 | + - Grant admin consent for the permissions by clicking **Grant admin consent for [Your Tenant Name]**. |
| 48 | + |
| 49 | +3. **Create a Custom Scope** (if applicable): |
| 50 | + - Navigate to the **Expose an API** tab. |
| 51 | + - Define a custom scope that matches your application's requirements: |
| 52 | + - **Scope name**: e.g., `SPO.Read`. |
| 53 | + - **Who can consent**: Admins only. |
| 54 | + - **Admin consent display name**: Provide a clear name, e.g., "Read access to SharePoint Online". |
| 55 | + - **Admin consent description**: Describe the scope, e.g., "Allows reading data from SharePoint Online". |
| 56 | + - Save the scope and note its full URI, e.g., `api://YOUR-APP-ID/SPO.Read`. |
| 57 | + |
| 58 | +4. **Configure Token Exchange URL**: |
| 59 | + - Under **Authentication** > **Advanced settings**, populate the Token Exchange URL: |
| 60 | + ```plaintext |
| 61 | + https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token |
| 62 | + ``` |
| 63 | + - This URL will facilitate the secure exchange of tokens between the Copilot and custom applications. |
| 64 | +
|
| 65 | +5. **Validate Authentication in Copilot Studio**: |
| 66 | + - Open Copilot Studio and navigate to the authoring canvas. |
| 67 | + - Sign in to verify that authentication is working correctly. If "Require users to sign in" is enabled, the canvas should automatically prompt for authentication. |
| 68 | + - Test Generative Answers with SharePoint or OneDrive data sources to confirm proper permissions. |
| 69 | +
|
| 70 | +**Resources**: |
| 71 | +- [Microsoft Entra ID Authentication Guide](https://learn.microsoft.com/en-us/power-virtual-agents/configuration-authentication-azure-ad) |
| 72 | +- [Using SharePoint or OneDrive Data for Generative Answers](https://learn.microsoft.com/en-us/power-virtual-agents/nlu-generative-answers-sharepoint-onedrive) |
| 73 | +
|
| 74 | +--- |
| 75 | +
|
| 76 | +## Step 2: Register Your SharePoint Site as a Canvas App |
| 77 | +
|
| 78 | +A canvas app acts as the hosting environment for the Copilot and is critical for enabling SSO. This step involves creating a new app registration in Microsoft Entra ID for your SharePoint site. |
| 79 | +
|
| 80 | +### Prerequisites: |
| 81 | +
|
| 82 | +- SharePoint Online site URL where the Copilot will be hosted. |
| 83 | +- Administrative access to Microsoft Entra ID. |
| 84 | +
|
| 85 | +### Detailed Steps: |
| 86 | +
|
| 87 | +1. **Create a New App Registration**: |
| 88 | + - In the Azure portal, go to **Azure Active Directory** > **App registrations** > **New registration**. |
| 89 | + - Fill in the following details: |
| 90 | + - **Name**: Provide a clear name, e.g., "SharePoint Copilot Canvas". |
| 91 | + - **Supported account types**: Choose "Accounts in this organizational directory only". |
| 92 | + - **Redirect URI**: Add the SharePoint site URL: |
| 93 | + ```plaintext |
| 94 | + https://mytenant.sharepoint.com/sites/MySite |
| 95 | + https://mytenant.sharepoint.com/sites/MySite/ |
| 96 | + ``` |
| 97 | + Ensure you include both versions (with and without trailing slash) for compatibility. |
| 98 | +
|
| 99 | +2. **Add API Permissions**: |
| 100 | + - Navigate to the **API permissions** tab. |
| 101 | + - Add permissions for the custom API created in Step 1. |
| 102 | + - Search for the custom API under "APIs my organization uses" and select the appropriate scope. |
| 103 | +
|
| 104 | +3. **Document Key Details**: |
| 105 | + - Note down the following details for future use: |
| 106 | + - **Application (Client) ID** |
| 107 | + - **Directory (Tenant) ID** |
| 108 | +
|
| 109 | +4. **Validate Redirect URI**: |
| 110 | + - Ensure the SharePoint site URL matches the registered redirect URIs. |
| 111 | + - If you encounter authentication errors, verify the URI format and trailing slash consistency. |
| 112 | +
|
| 113 | +**Resources**: |
| 114 | +- [Configure Single Sign-On with Microsoft Entra ID](https://learn.microsoft.com/en-us/power-virtual-agents/configure-sso?tabs=webApp#create-app-registrations-for-your-custom-website) |
| 115 | +
|
| 116 | +### Validation: |
| 117 | +
|
| 118 | +1. **Verify Installation**: |
| 119 | + - Navigate to the SharePoint site and ensure the Copilot button appears. |
| 120 | + - Click the button to launch the chat interface. |
| 121 | +
|
| 122 | +2. **Test SSO**: |
| 123 | + - Confirm users are signed in automatically and can interact with the Copilot seamlessly. |
| 124 | +
|
| 125 | +--- |
| 126 | +
|
| 127 | +## Troubleshooting |
| 128 | +
|
| 129 | +- **Authentication Errors**: Verify app registration settings, including redirect URIs and API permissions. |
| 130 | +- **Component Deployment Issues**: Check the `.sppkg` file, ensure the App Catalog is enabled, and review SharePoint logs for errors. |
| 131 | +
|
| 132 | +--- |
| 133 | +
|
| 134 | +By completing these steps, you have successfully deployed a Microsoft Copilot Studio Copilot as a SharePoint SPFx component with SSO. |
| 135 | +
|
0 commit comments