Unable to add MCP server to Copilot Studio – “This request is not allowed per policy”

Question

Unable to add MCP server to Copilot Studio – “This request is not allowed per policy”

Lohit S 0

Hi,

I am facing an issue while adding an MCP server to Microsoft Copilot Studio. The MCP server was working previously, but for the past one week I have been unable to add/connect the MCP server successfully.

When I try to add the MCP server in Copilot Studio, the UI displays the following error:

“This request is not allowed per policy.”

The relevant API response is:

{
    "name": "<REDACTED_CONNECTION_ID>",
    "id": "/providers/Microsoft.PowerApps/apis/shared_<REDACTED_API_ID>/connections/<REDACTED_CONNECTION_ID>",
    "type": "Microsoft.PowerApps/apis/connections",
    "properties": {
        "apiId": "/providers/Microsoft.PowerApps/apis/shared_<REDACTED_API_ID>",
        "displayName": "TESTMcp",
        "iconUri": "https://defaulticons.powerapps.com/defaulticons/api-dedicated.png",
        "statuses": [
            {
                "status": "Error",
                "target": "token",
                "error": {
                    "code": "Unauthenticated",
                    "message": "This connection is not authenticated."
                }
            }
        ],
        "connectionParameters": {
            "sku": "Enterprise"
        },
        "keywordsRemaining": 0,
        "isSsoConnection": false,
        "createdBy": {
            "id": "<REDACTED_USER_ID>",
            "displayName": "<REDACTED_USER>",
            "email": "<REDACTED_EMAIL>",
            "type": "User",
            "userType": "NotSpecified",
            "tenantId": "<REDACTED_TENANT_ID>",
            "userPrincipalName": "<REDACTED_EMAIL>"
        },
        "createdTime": "<REDACTED_TIMESTAMP>",
        "lastModifiedTime": "<REDACTED_TIMESTAMP>",
        "environment": {
            "id": "/providers/Microsoft.PowerApps/environments/<REDACTED_ENVIRONMENT_ID>",
            "name": "<REDACTED_ENVIRONMENT_NAME>"
        },
        "allowSharing": false
    }
}

Environment / Configuration

Client: Microsoft Copilot Studio
Integration: MCP Server
Connection: OPMMcp
Connection SKU: Enterprise
Authentication status: Unauthenticated
Copilot Studio UI error: This request is not allowed per policy.

Can anyone help me to solve this isssue?

0 comments

2 answers

Your answer

Answer 1

Ashlesha Pawar (Tata Consultancy Services Limited) 400 Microsoft External Staff

We tested MCP connectivity in a clean Copilot Studio Developer environment using the official Microsoft Learn Streamable HTTP MCP server, and the connection and tool invocation completed successfully. This does not indicate a platform-wide MCP regression.

Please ask your Power Platform administrator to review all tenant-level and environment-level Data Policies and the effective Advanced Connector Policy for the affected environment. Confirm that the MCP server is explicitly allowed and that its custom connector host isn’t blocked or placed in an incompatible data group.

0 comments

Answer 2

The error matches a tenant or environment policy block on custom connectors, not an MCP server runtime failure.

Use this troubleshooting path:

Check whether the Copilot Studio agent is using the default Power Platform environment.
- Tenant-level Data Loss Prevention (DLP) policies often block custom connectors there.
- Use a Developer or Sandbox environment instead.
In Power Platform Admin Center > Environments, create or select a Developer or Sandbox environment.
- Recreate the connector and connection in that environment.
- Then return to Copilot Studio and add the MCP tool again.
Recreate the connection instead of reusing the current one.
- In the Copilot Studio MCP onboarding flow, select Create new connection > Create.
- Sign in with the tenant admin account.
- After sign-in succeeds, select Add and configure.
Verify the account used for sign-in has the required roles.
- Cloud Application Administrator is required to create and configure the connector.
- The signed-in user also needs the appropriate Microsoft Entra directory roles for the Graph operations the agent will perform.
- Sign in to both Copilot Studio and Power Apps with that tenant admin account.
If permissions were assigned recently, delete the existing connection and create a new one.
- A stale token can cause connection problems after role changes.
- The documented fix is to delete the existing connection in Power Apps and create it again to get a fresh token.
If the connection still fails after federated credential setup, verify the app registration values.
- In the app registration, confirm the federated credential Issuer, Subject, and Name exactly match the managed identity shown on the custom connector.
- If they do not match, delete and recreate the federated credential.
Verify the app registration redirect URI if OAuth sign-in is not completing.
- In Microsoft Entra admin center > app registration > Authentication > Add Redirect URI.
- Select Web.
- Paste the redirect URL copied from Copilot Studio.
- The app registration must be configured as a confidential client (Web App/API), not Mobile and Desktop applications.

What the current symptoms indicate:

This request is not allowed per policy. aligns with the documented DLP-policy block for custom connector creation.
This connection is not authenticated. indicates the connection was created but sign-in/token acquisition did not complete successfully.

Most likely fix based on the documented behavior:

Move the setup to a Developer or Sandbox environment.
Delete the existing connection.
Recreate the connection with the required admin account.
If roles changed recently, ensure the new connection is created after the role assignment.

Note: Microsoft MCP Server for Enterprise currently supports read-only operations only.