Copilot Studio MCP Connector: OAuth Authentication Popup Fails Immediately When Using Keycloak as Identity Provider with DCR Discovery

When configuring a custom MCP server in Microsoft Copilot Studio using the "Dynamic Discovery" (DCR) authentication option with Keycloak as the identity provider, the OAuth login popup opens and immediately fails with the error "Failed to login. An error occurred while sending the request." No authentication request reaches the identity provider after the popup opens.

Steps to Reproduce

1. Deploy a custom MCP server implementing the MCP protocol with OAuth 2.0 protection
2. Configure the server to expose:
   • /.well-known/oauth-protected-resource/mcp/
   • /.well-known/oauth-authorization-server
3. Configure Keycloak as the OAuth provider with DCR enabled (anonymous registration allowed)
4. In Copilot Studio, add a new MCP connector with:
   • Server URL
   • Authentication: Dynamic Discovery
5. Click "Create Connection"

Observed Behavior

1. Following requests are made successfully:
   /.well-known/oauth-protected-resource
   /.well-known/openid-configuration
2. Returns full Keycloak OpenID Connect metadata including registration_endpoint, authorization_endpoint, token_endpoint
3. A login popup opens and immediately fails, no further requests are made to any server

What Was Verified Working

-Keycloak is publicly accessible from the internet

-TLS certificate is valid (no self-signed cert issues)

-DCR registration works when called manually:

-Browser popup blockers disabled for Copilot Studio domain

Questions for Microsoft Support

-What exact requests does Copilot Studio make after reading the OpenID configuration during the DCR discovery flow?

-Does Copilot Studio perform any validation checks on the /.well-known/openid-configuration (or oauth-authorization-server) response?

-Is there a known issue with the popup authentication flow when the identity provider is not Azure AD?