Inconsistent Agent Experience in MS Teams

Dominic Blood 0 Reputation points
2026-08-06T11:28:53.2033333+00:00

We are experiencing an issue with a Copilot Studio agent that has been published to Microsoft Teams and shared with users within our organisation. Issue Summary A small number of users are unable to access the agent.

When attempting to open the shared agent URL, they receive one of the following: In a standard browser session or Teams: “Bad request” In an InPrivate browser session: AADSTS53003 – “Your sign-in was successful but does not meet the criteria to access this resource.” The failure occurs immediately after selecting the shared link, before the Copilot Studio agent loads. Environment Copilot Studio agent published to Microsoft Teams. Users are internal to our tenant.

All affected users are correctly licensed for Microsoft 365 and Copilot Studio usage. The agent has been successfully shared with the affected users. Other users, including the agent owner, can access the agent without issue.

Troubleshooting Completed

  • We have already confirmed the following:
  • The affected users are present within the Power Platform environment.
  • The users have appropriate licensing.
  • The issue occurs both via Microsoft Teams and via the direct shared agent URL. Republishing the agent did not resolve the issue.
  • The agent name is fewer than 30 characters.
  • The issue affects a small subset of users, while other users can access the same agent successfully.
  • Some of the affected users have Entra-registered or Hybrid Azure AD joined devices.
  • We have reviewed Conditional Access policies within Entra but have not identified any policy that appears applicable.
  • We are unable to locate any corresponding sign-in events in the Entra sign-in logs, even when searching using the supplied Correlation ID and Timestamp.

Error Details

When accessed via an InPrivate browser session, the following details are displayed: Error Code: 53003 (AADSTS53003) Message: “Your sign-in was successful but does not meet the criteria to access this resource.” Application: Microsoft Teams Web Client Device State: Unregistered.

Microsoft Teams | Development
Microsoft Teams | Development

Building, integrating, or customizing apps and workflows within Microsoft Teams using developer tools and APIs

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dora-T 290 Reputation points Independent Advisor
    2026-08-07T04:36:12.9733333+00:00

    Hi Dominic Blood

    Based on what you’ve shared, you’ve already covered the key troubleshooting steps very thoroughly. At this point, I’m not seeing additional documented guidance beyond what you’ve already tested. This appears to be a more complex scenario that may involve the interaction between Teams, Copilot Studio, and underlying Power Platform services, rather than a straightforward configuration issue. 

    Given that, I’d recommend posting this in the Power Platform community, where there is more direct visibility into Copilot Studio agent behavior and related components. It’s a great space with knowledgeable members who can help take this further. 

    Additionally, you may consider raising a support ticket with Microsoft through the Power Platform admin center for further assistance.

    For your reference: Find community help and support - Microsoft Copilot Studio | Microsoft Learn

    Thank you for your understanding. 

    Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

    Was this answer helpful?

  2. AI answer

    2026-08-06T11:29:19.82+00:00

    The error pattern matches Conditional Access enforcement blocking token acquisition for some users before the agent can load.

    Key points that fit the reported behavior:

    1. Copilot Studio agents can become unavailable in Teams or show a blank page or error when Conditional Access blocks the authentication token.
    2. The enforcement applies even to existing agents and can affect only some users, depending on policy evaluation.
    3. The InPrivate result showing AADSTS53003 and device state Unregistered is consistent with access being denied by Conditional Access criteria.

    Since licensing, sharing, republishing, and user presence in the environment were already verified, the next supported path is to inspect Conditional Access failures directly in Microsoft Entra.

    Recommended steps:

    1. In the Microsoft Entra admin center, review Conditional Access logs for all Copilot Studio agents:
      • Go to Identity.
      • Select Monitoring & health > Audit logs.
      • Set the relevant Date range.
      • Select Add filters > Application and set Application contains: Copilot Studio.
      • Add Conditional Access filter and set it to Failure.
      • Check each tab on the Conditional Access sign-in logs page, because the related event can appear under different sign-in categories.
    2. Review logs for the specific agent:
      • In Microsoft Entra admin center, open App registrations.
      • Open the registration for the affected agent.
      • On Overview, under Essentials, select Managed application in local directory.
      • Review the prefiltered Conditional Access logs for that agent.
    3. Compare affected and unaffected users:
      • Focus on differences in device state, especially where affected sessions show Unregistered.
      • Check whether a policy requires a compliant, hybrid joined, or otherwise recognized device state.
      • Check whether browser or Teams sign-ins are being evaluated differently from other client paths.
    4. If a blocking policy is identified, remediate the policy or allow the required network ranges:
      • The documented mitigation is to identify which Conditional Access policy is blocking the request and then investigate or modify that policy.
      • It might also be necessary to allow specific IP addresses and IP ranges used by Copilot Studio, Power Platform, or other Microsoft services.
    5. If users see a data policy error instead of the current sign-in failure, treat that separately:
      • DataLossPreventionViolation indicates DLP enforcement, not Conditional Access.

    Based on the reported symptoms, this is not consistent with agent name length, publishing scope, or a general licensing problem. The strongest documented match is Conditional Access evaluation preventing token acquisition for a subset of users.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.