microsoft/semantic-kernel · error · AgentInitializationException

client_secret *or* client_certificate is required for servic

Error message

client_secret *or* client_certificate is required for service-to-service auth.

What it means

Raised by _CopilotStudioAgentTokenFactory._acquire_service_token (an AgentInitializationException) when neither client_secret nor client_cert_path is provided. Service-to-service (confidential client) auth requires exactly one credential, so an empty configuration is rejected before building the MSAL confidential client.

Source

Thrown at python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:131

            )

        match self.mode:
            case CopilotStudioAgentAuthMode.SERVICE:
                return self._acquire_service_token()  # unreachable until the guard is removed
            case _:
                return self._acquire_interactive_token()

    def _new_confidential_client(self, **extra_kwargs) -> ConfidentialClientApplication:
        return ConfidentialClientApplication(
            client_id=self.settings.app_client_id,
            authority=f"https://login.microsoftonline.com/{self.settings.tenant_id}",
            token_cache=self.cache,
            **extra_kwargs,
        )

    def _acquire_service_token(self) -> str:
        if not self.client_secret and not self.client_cert_path:
            raise AgentInitializationException(
                "client_secret *or* client_certificate is required for service-to-service auth."
            )

        kwargs: dict[str, Any] = {}
        if self.client_secret:
            kwargs["client_credential"] = self.client_secret
        else:  # certificate
            if not self.client_cert_path:
                raise AgentInitializationException(
                    "If no client_secret is provided, a client_certificate is required for service-to-service auth."
                )
            kwargs["client_credential"] = {
                "private_key": Path(self.client_cert_path).read_text(),
                "thumbprint": self._cert_thumbprint(self.client_cert_path),
            }

        app = self._new_confidential_client(**kwargs)

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Provide a client_secret or a client_certificate (Path) when setting up SERVICE auth.
2. Supply credentials via environment variables / secret store rather than hardcoding; verify they are loaded.
3. Since SERVICE mode is currently gated (error 797), use INTERACTIVE mode until SERVICE is supported, then add the credential.
4. Validate that the cert path exists and is readable if using a certificate.

Example fix

// before
factory = _CopilotStudioAgentTokenFactory(settings=..., mode=SERVICE, cache_path=...)  # no secret/cert
factory._acquire_service_token()  # raises
// after
factory = _CopilotStudioAgentTokenFactory(
    settings=..., mode=SERVICE, cache_path=..., client_secret=os.environ['CS_CLIENT_SECRET'])

def validate_service_creds(client_secret, client_cert_path):
    if not client_secret and not client_cert_path:
        raise ValueError('Provide client_secret or client_certificate for service auth')
    return True

from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException
try:
    token = factory._acquire_service_token()
except AgentInitializationException as e:
    if 'client_secret' in str(e):
        raise RuntimeError('Missing Copilot Studio service credential; set CS_CLIENT_SECRET or cert path')
    raise

When it happens

Trigger: Configuring SERVICE auth without supplying client_secret or client_certificate; both credential parameters left at their defaults (None) on the token factory/agent.

Common situations: Incomplete environment/config for service auth (missing env vars for secret or cert path); copy-paste config that omitted the credential; planning to use SERVICE mode (which is itself gated by error 797) without the credential wired.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• If no client_secret is provided, a client_certificate is req
• AllowedCallersClaimsValidator: config object cannot be None.
• "{self.config_key}" not found in configuration.
• Missing required configuration. APP_ID, APP_PASSWORD, and AP
• Copilot Studio SERVICE authentication is not available yet.

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/e85d9a022e6d857f. Report an issue: GitHub.