{"record":{"id":"67f6d7237b8a72ac","repo":"microsoft/semantic-kernel","slug":"copilot-studio-service-authentication-is-not-avail","errorCode":null,"errorMessage":"Copilot Studio SERVICE authentication is not available yet. Please use INTERACTIVE mode instead.","messagePattern":"Copilot Studio SERVICE authentication is not available yet\\. Please use INTERACTIVE mode instead\\.","errorType":"exception","errorClass":"AgentInitializationException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py","lineNumber":111,"sourceCode":"        try:\n            persistence = build_encrypted_persistence(cache_path)\n        except Exception:  # pylint: disable=bare-except\n            # On Linux, encryption exception will be raised during initialization.\n            # On Windows and macOS, they won't be detected here,\n            # but will be raised during their load() or save().\n            if not fallback_to_plaintext:\n                raise\n            logging.warning(\"Encryption unavailable. Opting in to plain text.\")\n            persistence = FilePersistence(cache_path)\n\n        return PersistedTokenCache(persistence)\n\n    def acquire(self) -> str:\n        \"\"\"Return a valid bearer token or raise AgentInitializationException.\"\"\"\n        if self.mode is CopilotStudioAgentAuthMode.SERVICE:\n            # SERVICE auth wiring is present but not yet supported end-to-end.\n            logger.warning(\"SERVICE authentication mode is not yet supported; falling back to error.\")\n            raise AgentInitializationException(\n                \"Copilot Studio SERVICE authentication is not available yet. Please use INTERACTIVE mode instead.\"\n            )\n\n        match self.mode:\n            case CopilotStudioAgentAuthMode.SERVICE:\n                return self._acquire_service_token()  # unreachable until the guard is removed\n            case _:\n                return self._acquire_interactive_token()\n\n    def _new_confidential_client(self, **extra_kwargs) -> ConfidentialClientApplication:\n        return ConfidentialClientApplication(\n            client_id=self.settings.app_client_id,\n            authority=f\"https://login.microsoftonline.com/{self.settings.tenant_id}\",\n            token_cache=self.cache,\n            **extra_kwargs,\n        )\n\n    def _acquire_service_token(self) -> str:","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py#L93-L129","documentation":"Raised by _CopilotStudioAgentTokenFactory.acquire (an AgentInitializationException) when the auth mode is CopilotStudioAgentAuthMode.SERVICE. Although SERVICE-mode wiring exists, it is intentionally not yet supported end-to-end, so the factory rejects it and tells the caller to use INTERACTIVE mode.","triggerScenarios":"Constructing a Copilot Studio agent with mode=CopilotStudioAgentAuthMode.SERVICE; the token factory's acquire() is called during agent invocation under SERVICE mode.","commonSituations":"Following docs/sample code that referenced SERVICE mode before it was gated; migrating from another auth pattern expecting service-to-service tokens; copying config that sets auth mode to SERVICE.","solutions":["Use CopilotStudioAgentAuthMode.INTERACTIVE for now; remove/override any SERVICE mode setting.","Track the library release notes; switch to SERVICE only once the guard is removed and the mode is supported.","If you need headless service auth, wait for the supported release or use INTERACTIVE with a persisted token cache.","Check your settings object/copilot_studio_agent_settings to confirm mode resolves to INTERACTIVE."],"exampleFix":"// before\nagent = CopilotStudioAgent(..., mode=CopilotStudioAgentAuthMode.SERVICE)  # raises on invoke\n// after\nagent = CopilotStudioAgent(..., mode=CopilotStudioAgentAuthMode.INTERACTIVE)","handlingStrategy":"validation","validationCode":"from semantic_kernel.agents.copilot_studio.copilot_studio_agent_settings import CopilotStudioAgentAuthMode\ndef assert_supported_mode(mode):\n    if mode is CopilotStudioAgentAuthMode.SERVICE:\n        raise ValueError('SERVICE mode not supported yet; use INTERACTIVE')\n    return mode","typeGuard":null,"tryCatchPattern":"from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException\ntry:\n    await agent.get_response('hi')\nexcept AgentInitializationException as e:\n    if 'SERVICE authentication' in str(e):\n        # rebuild with INTERACTIVE mode\n        ...\n    else: raise","preventionTips":["Use INTERACTIVE mode for Copilot Studio until SERVICE is supported","Watch release notes for the SERVICE-mode guard removal"],"tags":["copilot-studio","authentication","initialization","configuration"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}