Azure AI Foundry Agent published to Microsoft Teams prompts users for Foundry login instead of using Teams SSO

George, Jino 20 Reputation points
2026-06-15T11:28:38.49+00:00

I have published an Azure AI Foundry Agent to Microsoft Teams and shared it with users within our Microsoft 365 tenant.

When a user opens the agent in Teams for the first time, they receive a "User Sign-in" card asking them to "Open sign-in link". The link redirects to the Azure AI Foundry OAuth service (agent-oauth.azureml.ms), where the user signs in successfully before they can use the agent.

Our expectation is similar to Copilot Studio agents, where users already authenticated to Microsoft Teams/Microsoft 365 can start chatting without an additional Foundry login.

Environment

  • Azure AI Foundry Agent
  • Published directly to Microsoft Teams
  • Users are within the same Microsoft 365 tenant
  • Authentication completes successfully through the Foundry OAuth service
  • The prompt appears on first use (token caching behavior is still being evaluated)

What we've investigated

  • The prompt is not a Microsoft Graph consent dialog.
  • The authentication flow uses the Foundry OAuth endpoint (agent-oauth.azureml.ms).
  • We could not find any Microsoft documentation describing how to enable Teams SSO or bypass the initial Foundry login for published Foundry Agents.

Questions

  1. Is the initial Foundry OAuth login currently expected behavior for Azure AI Foundry Agents published to Microsoft Teams?
  2. Is there any supported configuration that enables seamless Microsoft Teams/Microsoft 365 Single Sign-On (SSO) similar to Copilot Studio agents?
  3. Can a Microsoft Entra Global Administrator or Azure Administrator configure anything (for example, Enterprise Applications, tenant-wide admin consent, authentication settings, or Azure RBAC) to eliminate the initial Foundry login prompt?
  4. If this is not currently supported, is there a roadmap or upcoming feature to enable Teams SSO for Azure AI Foundry Agents?

Any guidance or Microsoft documentation would be greatly appreciated.I have published an Azure AI Foundry Agent to Microsoft Teams and shared it with users within our Microsoft 365 tenant.

When a user opens the agent in Teams for the first time, they receive a "User Sign-in" card asking them to "Open sign-in link". The link redirects to the Azure AI Foundry OAuth service (agent-oauth.azureml.ms), where the user signs in successfully before they can use the agent.

Our expectation is similar to Copilot Studio agents, where users already authenticated to Microsoft Teams/Microsoft 365 can start chatting without an additional Foundry login.

Environment

  • Azure AI Foundry Agent
  • Published directly to Microsoft Teams
  • Users are within the same Microsoft 365 tenant
  • Authentication completes successfully through the Foundry OAuth service
  • The prompt appears on first use (token caching behavior is still being evaluated)

What we've investigated

  • The prompt is not a Microsoft Graph consent dialog.
  • The authentication flow uses the Foundry OAuth endpoint (agent-oauth.azureml.ms).
  • We could not find any Microsoft documentation describing how to enable Teams SSO or bypass the initial Foundry login for published Foundry Agents.

Questions

  1. Is the initial Foundry OAuth login currently expected behavior for Azure AI Foundry Agents published to Microsoft Teams?
  2. Is there any supported configuration that enables seamless Microsoft Teams/Microsoft 365 Single Sign-On (SSO) similar to Copilot Studio agents?
  3. Can a Microsoft Entra Global Administrator or Azure Administrator configure anything (for example, Enterprise Applications, tenant-wide admin consent, authentication settings, or Azure RBAC) to eliminate the initial Foundry login prompt?
  4. If this is not currently supported, is there a roadmap or upcoming feature to enable Teams SSO for Azure AI Foundry Agents?

Any guidance or Microsoft documentation would be greatly appreciated.

Foundry Agent Service
Foundry Agent Service

A fully managed platform in Microsoft Foundry for hosting, scaling, and securing AI agents built with any supported framework or model

Answer accepted by question author
Anshika Varshney 15,625 Reputation points Microsoft External Staff Moderator
2026-06-15T20:43:24.0366667+00:00

Hello @George, Jino

This is a good observation, and what you’re seeing is actually expected behavior today.

When an Azure AI Foundry Agent is published to Teams, users may still see a “User sign-in” prompt (redirecting to agent-oauth.azureml.ms) the first time they access it. This happens even if they are already signed into Teams.

Why this happens

Teams SSO does not automatically cover the agent runtime itself. The agent still needs its own authentication context with Azure AI Foundry, so the platform triggers a one-time sign-in/consent flow to establish that session.

What to expect

  • The sign-in prompt is typically shown only on first use per user/session
  • After successful authentication, users should not be repeatedly prompted unless session or token conditions require it
  • This is separate from Microsoft Graph consent and is specific to the agent’s backend service

Current limitation

At the moment, there isn’t a documented setting to completely bypass this initial sign-in step and enforce seamless Teams SSO for Foundry agents. The Teams integration focuses on distribution and access, but authentication to the agent runtime is still handled separately.

What you can check

If the prompt appears repeatedly (not just once), then it’s worth validating:

  • Conditional Access or MFA policies
  • Token/session expiry behavior
  • User permissions in the Foundry project
  • Any additional tools or integrations that may require auth

Summary

  • One-time sign-in prompt → expected
  • Full seamless SSO (no prompt at all) → not currently configurable based on available documentation

References:
What is Microsoft Foundry Agent Service? (publishing/distribution overview): https://learn.microsoft.com/azure/foundry/agents/overview?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider

Foundry agents in Microsoft Agent 365 (Teams/blueprint creation & registry flow): https://learn.microsoft.com/azure/foundry/agents/how-to/agent-365?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider

Hope this helps clarify. Do let me know if you have any further queries.

Thankyou!

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-06-15T11:29:20.0566667+00:00
    1. The initial Foundry OAuth login is expected behavior for Azure AI Foundry Agent Applications that use OAuth identity passthrough or other OAuth-based flows. When a user first interacts with an agent that relies on OAuth, Agent Service generates a consent link and requires the user to sign in and authorize access. This is described as the normal “first interaction” behavior for OAuth identity passthrough.
    2. There is no configuration in the provided documentation that enables seamless Teams/Microsoft 365 SSO for Azure AI Foundry Agents in the same way that Copilot Studio agents support Teams SSO. Copilot Studio has explicit guidance for enabling Teams SSO on the Teams channel by wiring an Entra app registration (Application ID, Application ID URI) into the channel configuration, then republishing the agent. No equivalent Teams SSO configuration is documented for Azure AI Foundry Agent Applications.
    3. Based on the available documentation, Microsoft Entra or Azure administrators can:
      • Assign Foundry roles (for example, Foundry User) at the appropriate scopes so that identities can invoke agents and tools.
      • Configure OAuth-based connections and consent (for example, for Agent2Agent or Work IQ scenarios), including granting admin consent where required.
      However, these controls do not remove the initial OAuth consent/sign-in step for users when OAuth identity passthrough is used. The documented behavior for OAuth identity passthrough is that each user must go through a consent flow once, after which Agent Service stores access/refresh tokens and uses them on subsequent calls.
    4. No roadmap or upcoming feature to enable Teams SSO for Azure AI Foundry Agents is mentioned in the provided documentation. The only SSO-specific guidance in the context is for Copilot Studio agents in Teams, not for Azure AI Foundry Agent Applications.

    In summary, for Azure AI Foundry Agents that rely on OAuth identity passthrough, the initial Foundry OAuth sign-in/consent is expected and there is no documented way to replace it with the Teams SSO experience that Copilot Studio provides.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.