microsoft/semantic-kernel · error · AgentInitializationException

Copilot Studio SERVICE authentication is not available yet.

Error message

Copilot Studio SERVICE authentication is not available yet. Please use INTERACTIVE mode instead.

What it means

Raised by _CopilotStudioAgentTokenFactory.acquire (an AgentInitializationException) when the auth mode is CopilotStudioAgentAuthMode.SERVICE. Although SERVICE-mode wiring exists, it is intentionally not yet supported end-to-end, so the factory rejects it and tells the caller to use INTERACTIVE mode.

Source

Thrown at python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py:111

        try:
            persistence = build_encrypted_persistence(cache_path)
        except Exception:  # pylint: disable=bare-except
            # On Linux, encryption exception will be raised during initialization.
            # On Windows and macOS, they won't be detected here,
            # but will be raised during their load() or save().
            if not fallback_to_plaintext:
                raise
            logging.warning("Encryption unavailable. Opting in to plain text.")
            persistence = FilePersistence(cache_path)

        return PersistedTokenCache(persistence)

    def acquire(self) -> str:
        """Return a valid bearer token or raise AgentInitializationException."""
        if self.mode is CopilotStudioAgentAuthMode.SERVICE:
            # SERVICE auth wiring is present but not yet supported end-to-end.
            logger.warning("SERVICE authentication mode is not yet supported; falling back to error.")
            raise AgentInitializationException(
                "Copilot Studio SERVICE authentication is not available yet. Please use INTERACTIVE mode instead."
            )

        match self.mode:
            case CopilotStudioAgentAuthMode.SERVICE:
                return self._acquire_service_token()  # unreachable until the guard is removed
            case _:
                return self._acquire_interactive_token()

    def _new_confidential_client(self, **extra_kwargs) -> ConfidentialClientApplication:
        return ConfidentialClientApplication(
            client_id=self.settings.app_client_id,
            authority=f"https://login.microsoftonline.com/{self.settings.tenant_id}",
            token_cache=self.cache,
            **extra_kwargs,
        )

    def _acquire_service_token(self) -> str:

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Use CopilotStudioAgentAuthMode.INTERACTIVE for now; remove/override any SERVICE mode setting.
2. Track the library release notes; switch to SERVICE only once the guard is removed and the mode is supported.
3. If you need headless service auth, wait for the supported release or use INTERACTIVE with a persisted token cache.
4. Check your settings object/copilot_studio_agent_settings to confirm mode resolves to INTERACTIVE.

Example fix

// before
agent = CopilotStudioAgent(..., mode=CopilotStudioAgentAuthMode.SERVICE)  # raises on invoke
// after
agent = CopilotStudioAgent(..., mode=CopilotStudioAgentAuthMode.INTERACTIVE)

from semantic_kernel.agents.copilot_studio.copilot_studio_agent_settings import CopilotStudioAgentAuthMode
def assert_supported_mode(mode):
    if mode is CopilotStudioAgentAuthMode.SERVICE:
        raise ValueError('SERVICE mode not supported yet; use INTERACTIVE')
    return mode

from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException
try:
    await agent.get_response('hi')
except AgentInitializationException as e:
    if 'SERVICE authentication' in str(e):
        # rebuild with INTERACTIVE mode
        ...
    else: raise

When it happens

Trigger: Constructing a Copilot Studio agent with mode=CopilotStudioAgentAuthMode.SERVICE; the token factory's acquire() is called during agent invocation under SERVICE mode.

Common situations: Following docs/sample code that referenced SERVICE mode before it was gated; migrating from another auth pattern expecting service-to-service tokens; copying config that sets auth mode to SERVICE.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• AllowedCallersClaimsValidator: config object cannot be None.
• "{self.config_key}" not found in configuration.
• Missing required configuration. APP_ID, APP_PASSWORD, and AP
• client_secret *or* client_certificate is required for servic
• If no client_secret is provided, a client_certificate is req

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/67f6d7237b8a72ac. Report an issue: GitHub.