403 Forbidden on _api/contextinfo for non-Copilot licensed users via usePwBrokeredAuth=true

[JonEricEubanks]

When a user with a standard Microsoft 365 Business Premium license (no M365 Copilot add-on) triggers the My Day Copilot Component, the SPFx runtime fails with 403 Forbidden on every SharePoint REST API call. The component never renders and shows "An error has occurred on the server."

Users with an M365 Copilot license work correctly.

Steps to reproduce

Deploy my-day.sppkg to the tenant App Catalog and sync to Teams
Sign into Microsoft 365 Copilot Chat as a user with only M365 Business Premium (no Copilot add-on)
Invoke the My Day agent: "What does my day look like?"
Component fails to render — "An error has occurred on the server"
Expected behavior

Per Microsoft's own blog post (devblogs.microsoft.com):

"No license barrier to start – built on declarative agents, which enable baseline agent experiences with simply a Microsoft 365 user license."

The component should render for any user with a standard M365 license that includes SharePoint Online.

Actual behavior

The PortableComponent.aspx loads with &usePwBrokeredAuth=true. The brokered auth token provided for non-Copilot users does not include
SharePoint API scopes, causing:
POST https://[tenant].sharepoint.com/_api/contextinfo → 403 Forbidden
POST https://[tenant].sharepoint.com/_api/web/GetClientSideComponents → 403 Forbidden

Console evidence:
portable-component-assembly...js:221
POST https://communityessentials.sharepoint.com/_api/contextinfo 403 (Forbidden)

portable-component-assembly...js:221
POST https://communityessentials.sharepoint.com/_api/web/GetClientSideComponents 403 (Forbidden)

Environment

SPFx version: 1.24.0-beta.2
Tenant: Production M365 tenant
Working account: M365 Business Premium + M365 Copilot add-on ✅
Failing account: M365 Business Premium only (no Copilot add-on) ❌
Browser: Edge / Chrome
Surface: Microsoft 365 Copilot Chat (copilot.microsoft.com and Teams)
Root cause hypothesis

The usePwBrokeredAuth token issued by Copilot Chat for non-Copilot licensed users does not include SharePoint API permission scopes. M365 Copilot licensed users receive a richer token that includes these scopes.

Additional context

The root SharePoint site has "Everyone except external users" as Site Members, so SharePoint permissions are not the issue. The failing account can browse SharePoint normally when not using the brokered auth flow.

See attached screenshots:

shows clean console with M365 Copilot license (no 403s, AppBridge initialized); [screenshot-failing.png] shows 403s with Business Premium only."

[VesaJuvonen]

hi @JonEricEubanks - as this is more a generic issue vs the sample story - any change you can relocate the issue to https://github.com/SharePoint/sp-dev-docs/issues location so that we can track that with our vendors and engineering.

We absolutely need to be 100% clear on the requirements here before we go to the GA and thank you for calling this out. I do apologize the experience you've had with good expectations and the hitting a roadblock.

I can't copy this in away to the sp-dev-docs that it would retain you as a owner/submitter - which would be good. If you could do that - that would be really helpful for us as we move forward on this journey from preview to the generally available status. Thank you 🙏

[VesaJuvonen]

@JonEricEubanks engineering has detected a potential issue here and we are looking into it. I'd still love to get this moved to the sp-dev-docs issue list so that also others can easily find the potential issue and stay up to date the progress.