Copilot Studio A2A: OAuth 2.0 Client Credentials not supported for sub-agent connections

Question

Copilot Studio A2A: OAuth 2.0 Client Credentials not supported for sub-agent connections

Yasara Peiris 0

I have an orchestrator agent in Microsoft Copilot Studio. I'm adding a sub-agent via the Agent2Agent (A2A) protocol, where the sub-agent authenticates using OAuth 2.0 Client Credentials grant (machine-to-machine, no end user, just client_id + client_secret exchanged directly at a single token endpoint via Basic auth).

Current behavior: In Copilot Studio, the A2A "Add an agent" screen's OAuth 2.0 option only exposes fields for Authorization Code flow - Authorization URL, Token URL, Refresh URL which assumes a user signs in. There's no option to select Client Credentials grant, which needs only a token endpoint and no user interaction.

Expected behavior: Copilot Studio's OAuth 2.0 option for A2A sub-agent connections should let you choose a grant type, including Client Credentials. When selected, it should only require Client ID, Client Secret, Token URL, and Scope.

Question: Is Client Credentials support planned for Copilot Studio's A2A OAuth 2.0 option? And in the meantime, is there a supported workaround for connecting an A2A sub-agent that only offers Client Credential?

Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-09-07T05:18:38.2366667+00:00
@Yasara Peiris OAuth 2.0 Client Credentials isn’t currently listed as a supported authentication option for A2A connections in Copilot Studio. Microsoft hasn’t publicly announced roadmap details for this capability, so we can’t confirm whether or when it might become available.

There is no documented native workaround for directly connecting an A2A agent that supports only Client Credentials. Possible alternatives are:

Enable API-key authentication or the currently supported OAuth flow on the remote agent.

Place a secured proxy or API gateway in front of it. Copilot Studio can use a supported authentication method with the proxy, which can obtain an app-only token and forward A2A requests. This custom architecture should undergo security review.

If A2A capabilities such as multiturn delegation aren’t required, expose the operation as an API and invoke it through an appropriate HTTP tool.

This would require an additional A2A authentication capability. Please submit the scenario through Copilot Studio Ideas, including the required fields, token-endpoint authentication method, and why the existing authentication options don’t meet the requirement.

Current supported options are documented here: Connect an agent over A2A.

Your answer

Ashlesha Pawar (Tata Consultancy Services Limited) 395 Reputation points Microsoft External Staff

2026-09-07T05:18:38.2366667+00:00

@Yasara Peiris OAuth 2.0 Client Credentials isn’t currently listed as a supported authentication option for A2A connections in Copilot Studio. Microsoft hasn’t publicly announced roadmap details for this capability, so we can’t confirm whether or when it might become available.

There is no documented native workaround for directly connecting an A2A agent that supports only Client Credentials. Possible alternatives are:

Enable API-key authentication or the currently supported OAuth flow on the remote agent.

Place a secured proxy or API gateway in front of it. Copilot Studio can use a supported authentication method with the proxy, which can obtain an app-only token and forward A2A requests. This custom architecture should undergo security review.

If A2A capabilities such as multiturn delegation aren’t required, expose the operation as an API and invoke it through an appropriate HTTP tool.

This would require an additional A2A authentication capability. Please submit the scenario through Copilot Studio Ideas, including the required fields, token-endpoint authentication method, and why the existing authentication options don’t meet the requirement.

Current supported options are documented here: Connect an agent over A2A.