Issue Connecting M365 Copilot to a Custom Federated Connector

Question

Issue Connecting M365 Copilot to a Custom Federated Connector

Jackson Lee 0

Hi, I'm trying to connect my company's (Frontify) official MCP server to an M365 Agent but the "Connect to MCP Server" form does not include the OAuth 2.0 with DCR option as an authentication type.

The Frontify MCP Server uses OAuth 2.0 - Dynamic Client Registration (DCR). This looks to be a supported option in the documentation and even is mentioned in the help panel adjacent to the connection form but the option isn't listed in the 'authentication type' dropdown.

The three listed authentication types in the form are "None", "OAuth 2.0", and "Entra SSO" but the help panel suggests there should be a fourth option "OAuth 2.0 with DCR".

The following text is from the help panel on this page: https://admin.cloud.microsoft/?ocid=cmm45ut5ap0#/copilot/connectors/add

Authentication methods
Option 1: No authentication
Select None if your MCP endpoint is publicly accessible and does not require credentials.
Option 2: OAuth 2.0
1. Create an OAuth application in your identity provider to obtain a Client ID and Client Secret.
2. Register the OAuth configuration in Teams Developer Portal.
Option 3: SSO via Microsoft Entra ID
1. Register an application in Microsoft Entra ID to obtain a Client ID.
2. Register the SSO configuration in the Teams Developer Portal.
Option 4: OAuth 2.0 with Dynamic Client Registration (DCR)
1. Ensure your MCP server supports OAuth 2.0 Dynamic Client Registration (DCR).
2. Select OAuth 2.0 with DCR as the authentication method.

See screenshot below.

Thanks,
Jackson

Screenshot with no DCRoption

Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-08-27T06:42:43.4166667+00:00
Hi Jackson,

DCR is supported for Microsoft 365 Copilot MCP integrations, but Microsoft currently requires the authorization server to issue a client_secret. DCR for public clients without a secret isn’t supported yet.

Frontify’s authorization metadata currently advertises:

"token_endpoint_auth_methods_supported": ["none"]

Therefore, Frontify’s current DCR implementation isn’t compatible with this Microsoft 365 requirement. The missing DCR option while the help panel advertises it is a UI/documentation inconsistency or incomplete rollout, but exposing the option alone wouldn’t make this Frontify endpoint connect successfully.

As an alternative, Frontify would need to support confidential-client DCR and issue a client secret, or provide a statically registered OAuth client ID and secret for the regular OAuth 2.0 option.

References:

Configure dynamic client registration

MCP authentication options

Register MCP servers as agent connectors
Jackson Lee 0 Reputation points

2026-08-27T15:35:22.1733333+00:00

Hi Ashlesha,

Thank you, that's a helpful diagnosis. I've raised the confidential-client requirement with our engineering team so our authorization server can issue a client secret during registration and advertise a secret-based method alongside "none".

One follow-up: can I expect "OAuth 2.0 with Dynamic Client Registration" to appear as a selectable authentication type in the connector form, and if so, is there a rough timeline? I understand it wouldn't help us until our change ships, but I'd like to know whether to plan around the option becoming available or whether the help panel text will be removed instead.

Thanks again,

Jackson
Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-09-09T08:51:30.6866667+00:00

Hi Jackson, Thanks for the follow-up. The latest documentation clarifies that DCR is supported for MCP plugins, but it is not currently supported through the Teams Developer Portal or the Microsoft 365 admin-center connector form. This explains why the option is described in the help panel but does not appear in the dropdown.

At present, the documented way to configure DCR is through Microsoft 365 Agents Toolkit 6.12.0 or later, where you can select OAuth (with dynamic registration) while creating an MCP plugin. The declarative-agent developer skill is another supported route.

Microsoft has not published a rollout date for adding DCR to the connector form, so we cannot provide or confirm an ETA. I recommend planning around Agents Toolkit or static OAuth rather than relying on the fourth option becoming available in the portal.

Your Frontify authorization server would still need to issue a client_secret during DCR. Support for public-client DCR using "token_endpoint_auth_methods_supported": ["none"] has also not been announced.

The help-panel entry appears to describe intended capability before the corresponding portal experience is available. I’ll flag that documentation/UI discrepancy for review.

Your answer

Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-08-27T06:42:43.4166667+00:00

Hi Jackson,

DCR is supported for Microsoft 365 Copilot MCP integrations, but Microsoft currently requires the authorization server to issue a client_secret. DCR for public clients without a secret isn’t supported yet.

Frontify’s authorization metadata currently advertises:

"token_endpoint_auth_methods_supported": ["none"]

Therefore, Frontify’s current DCR implementation isn’t compatible with this Microsoft 365 requirement. The missing DCR option while the help panel advertises it is a UI/documentation inconsistency or incomplete rollout, but exposing the option alone wouldn’t make this Frontify endpoint connect successfully.

As an alternative, Frontify would need to support confidential-client DCR and issue a client secret, or provide a statically registered OAuth client ID and secret for the regular OAuth 2.0 option.

References:

Configure dynamic client registration

MCP authentication options

Register MCP servers as agent connectors
Jackson Lee 0 Reputation points

2026-08-27T15:35:22.1733333+00:00

Hi Ashlesha,

Thank you, that's a helpful diagnosis. I've raised the confidential-client requirement with our engineering team so our authorization server can issue a client secret during registration and advertise a secret-based method alongside "none".

One follow-up: can I expect "OAuth 2.0 with Dynamic Client Registration" to appear as a selectable authentication type in the connector form, and if so, is there a rough timeline? I understand it wouldn't help us until our change ships, but I'd like to know whether to plan around the option becoming available or whether the help panel text will be removed instead.

Thanks again,

Jackson
Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-09-09T08:51:30.6866667+00:00

Hi Jackson, Thanks for the follow-up. The latest documentation clarifies that DCR is supported for MCP plugins, but it is not currently supported through the Teams Developer Portal or the Microsoft 365 admin-center connector form. This explains why the option is described in the help panel but does not appear in the dropdown.

At present, the documented way to configure DCR is through Microsoft 365 Agents Toolkit 6.12.0 or later, where you can select OAuth (with dynamic registration) while creating an MCP plugin. The declarative-agent developer skill is another supported route.

Microsoft has not published a rollout date for adding DCR to the connector form, so we cannot provide or confirm an ETA. I recommend planning around Agents Toolkit or static OAuth rather than relying on the fourth option becoming available in the portal.

Your Frontify authorization server would still need to issue a client_secret during DCR. Support for public-client DCR using "token_endpoint_auth_methods_supported": ["none"] has also not been announced.

The help-panel entry appears to describe intended capability before the corresponding portal experience is available. I’ll flag that documentation/UI discrepancy for review.