microsoft/semantic-kernel · error · InvalidOperationException

Missing Scopes configuration for Microsoft Graph API.

Error message

Missing Scopes configuration for Microsoft Graph API.

What it means

Error "Missing Scopes configuration for Microsoft Graph API." thrown in microsoft/semantic-kernel.

Source

Thrown at dotnet/samples/Concepts/Plugins/CopilotAgentBasedPlugins.cs:225

            }
        }
    }
    private static readonly RestApiParameterFilter s_restApiParameterFilter = (RestApiParameterFilterContext context) =>
    {
        if (("me_sendMail".Equals(context.Operation.Id, StringComparison.OrdinalIgnoreCase) ||
            ("me_calendar_CreateEvents".Equals(context.Operation.Id, StringComparison.OrdinalIgnoreCase)) &&
            "payload".Equals(context.Parameter.Name, StringComparison.OrdinalIgnoreCase)))
        {
            context.Parameter.Schema = TrimPropertiesFromRequestBody(context.Parameter.Schema);
            return context.Parameter;
        }
        return context.Parameter;
    };
    internal static async Task<CopilotAgentPluginParameters> GetAuthenticationParametersAsync()
    {
        if (TestConfiguration.MSGraph.Scopes is null)
        {
            throw new InvalidOperationException("Missing Scopes configuration for Microsoft Graph API.");
        }

        LocalUserMSALCredentialManager credentialManager = await LocalUserMSALCredentialManager.CreateAsync().ConfigureAwait(false);

        var token = await credentialManager.GetTokenAsync(
                        TestConfiguration.MSGraph.ClientId,
                        TestConfiguration.MSGraph.TenantId,
                        TestConfiguration.MSGraph.Scopes.ToArray(),
                        TestConfiguration.MSGraph.RedirectUri).ConfigureAwait(false);
#pragma warning restore SKEXP0050

        BearerAuthenticationProviderWithCancellationToken authenticationProvider = new(() => Task.FromResult(token));
#pragma warning disable SKEXP0040

        // Microsoft Graph API execution parameters
        var graphOpenApiFunctionExecutionParameters = new OpenApiFunctionExecutionParameters(
            authCallback: authenticationProvider.AuthenticateRequestAsync,
            serverUrlOverride: new Uri("https://graph.microsoft.com/v1.0"),

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Add a 'Scopes' entry to the Microsoft Graph API configuration in the Copilot agent manifest so the required permissions can be requested.
2. Confirm the manifest's runtime configuration points to the Microsoft Graph resource with at least one scope defined.

When it happens

Trigger: Thrown at dotnet/samples/Concepts/Plugins/CopilotAgentBasedPlugins.cs:225 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/210d0f8046223d5e. Report an issue: GitHub.