Version
microsoft-agents-hosting-core 1.1.0 and current main (ab57341) are affected.
What happened
We hit this while testing silent SSO for a custom-engine agent in Microsoft 365 Copilot.
On a fresh auth path, Copilot sends signin/tokenExchange. The exchange itself succeeds, but AgentApplication._on_turn() then awaits the original message replay before returning the invoke response. That means the token-exchange request stays open for however long the agent takes to answer. With a slower agent, Copilot can treat the exchange as failed and show a sign-in prompt even though the token was stored and the message was processed.
The JavaScript SDK had the same issue in microsoft/Agents-for-js#946 and fixed it in microsoft/Agents-for-js#1013.
Expected behavior
Once token exchange and auth-state persistence succeed, the SDK should return the invoke response promptly and replay the original message in a separate proactive turn. The replay should preserve the original message activity, channel, conversation reference, and claims identity.
Reproduction
- Configure auto sign-in for an agent and open it in
m365.cloud.microsoft.
- Clear the user's Bot Framework token/auth state so the next message takes the fresh SSO path.
- Send a message that takes several seconds to process.
- Observe that
signin/tokenExchange remains open until the replayed message finishes.
The coupling is here: after auth interception returns a continuation activity, _on_turn() calls and awaits self.on_turn(new_context) before the invoke can return.
Live result with the proposed fix
We validated the detached lifecycle against a deployed Copilot agent after clearing both Bot Framework token partitions:
21:06:55.793 — token-exchange auth handling started21:06:56.286 — completed auth state saved21:06:56.294 — signin/tokenExchange returned HTTP 20021:06:56.299 — replayed message turn started21:07:01.361 — final streamed message sent
There was one continuation replay, no sign-in card, no exchange retry loop, and one final answer. Before detaching the replay, the same invoke stayed open for roughly 9.7 seconds while the agent ran.
I have a focused fix and regression test ready and will link the PR here.
Version
microsoft-agents-hosting-core1.1.0 and currentmain(ab57341) are affected.What happened
We hit this while testing silent SSO for a custom-engine agent in Microsoft 365 Copilot.
On a fresh auth path, Copilot sends
signin/tokenExchange. The exchange itself succeeds, butAgentApplication._on_turn()then awaits the original message replay before returning the invoke response. That means the token-exchange request stays open for however long the agent takes to answer. With a slower agent, Copilot can treat the exchange as failed and show a sign-in prompt even though the token was stored and the message was processed.The JavaScript SDK had the same issue in microsoft/Agents-for-js#946 and fixed it in microsoft/Agents-for-js#1013.
Expected behavior
Once token exchange and auth-state persistence succeed, the SDK should return the invoke response promptly and replay the original message in a separate proactive turn. The replay should preserve the original message activity, channel, conversation reference, and claims identity.
Reproduction
m365.cloud.microsoft.signin/tokenExchangeremains open until the replayed message finishes.The coupling is here: after auth interception returns a continuation activity,
_on_turn()calls and awaitsself.on_turn(new_context)before the invoke can return.Live result with the proposed fix
We validated the detached lifecycle against a deployed Copilot agent after clearing both Bot Framework token partitions:
21:06:55.793— token-exchange auth handling started21:06:56.286— completed auth state saved21:06:56.294—signin/tokenExchangereturned HTTP 20021:06:56.299— replayed message turn started21:07:01.361— final streamed message sentThere was one continuation replay, no sign-in card, no exchange retry loop, and one final answer. Before detaching the replay, the same invoke stayed open for roughly 9.7 seconds while the agent ran.
I have a focused fix and regression test ready and will link the PR here.