Copilot Studio Agent with Work IQ - External Access via Direct Line

이승철2 (Lee, Seungchul) [sclee01] 0 Reputation points
2026-05-22T06:32:27.76+00:00

Hi,

I have successfully called Work IQ directly from an external service (Snowflake) via the A2A endpoint

(workiq.svc.cloud.microsoft/a2a/) and it works fine.

I also created an agent in Copilot Studio that uses Work IQ to query Microsoft 365 data via AI.

When the agent is configured with Microsoft Entra ID authentication, it works perfectly inside Copilot Studio.

However, when trying to access this agent externally via Direct Line, it fails.

Could you confirm if this is expected behavior? And if so, is there any supported way to call a Copilot Studio agent (that uses Work IQ internally) from an external service with proper authentication?

Thank you.

Microsoft Copilot | Microsoft 365 Copilot | Development
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-22T06:32:40.16+00:00

    This is expected with the current supported patterns.

    Work IQ is designed to be called directly as an API (via the Work IQ A2A endpoint) using an app registration and delegated permission WorkIQAgent.Ask, or indirectly through Copilot Studio agents via Power Platform connectors and Entra Agent ID. Copilot Studio agents use connectors with on-behalf-of (OBO) authentication and Entra Agent ID–based scopes, and these flows are mediated by the connector runtime and channel (for example, Teams) rather than exposed as a general-purpose, externally callable API surface.

    When an agent is published, Copilot Studio attaches connector-specific scopes to the agent’s Entra Agent ID and relies on Power Platform connector authentication and Microsoft Entra Conditional Access enforcement (currently only end-to-end in Teams). This model does not expose a supported, general external authentication mechanism for calling that same agent over Direct Line from arbitrary external services.

    For scenarios where an external service (such as Snowflake) needs to query Microsoft 365 data via Work IQ, the supported approach is to call Work IQ directly using the Work IQ API and appropriate app registration and authentication flow (for example, confidential client with OBO), as already implemented. Calling a Copilot Studio agent that internally uses Work IQ, over Direct Line, is not a documented or supported pattern for secure external access.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.