Multiple issues with the Azure AI Foundry Agent Service connector

[joniii98]

Describe the bug

Every call to the first-party Azure AI Foundry Agent Service connector (azureagentservice) from a Power Apps Code App fails with an OBO token decryption error (HTTP 401):

Right after running npx power-apps add-data-source, the generated service and model files contain syntax errors and the project no longer compiles (see attached screenshots). Two distinct symptoms: hyphenated parameter names are emitted as raw TypeScript identifiers, and multi-line schema descriptions lose the // prefix on continuation lines.

I was able to patch the generated files manually with the help of an AI assistant so the project compiles, and proceeded to actually call the connector.

2. Every call to the connector then fails with an OBO token decryption error.
With the manually fixed generated files in place, every call into the connector fails inside the Power Platform connector runtime, before the request reaches Azure Foundry, with HTTP 401:

Failed to get onbehalfof access token:
connectionId=azureagentservice,
message=IDX10609: Decryption failed. No Keys tried:
token: '[PII of type 'Microsoft.IdentityModel.Logging.SecurityArtifact' is hidden]'

The same connector with the same connection and the same user works in Power Automate, and the same agent is reachable via the @azure/ai-projects SDK from a non-Power-Apps web app.

Steps to Reproduce

Prereq: an agent deployed + published in Azure Foundry, and a Power Platform connection for the Azure AI Foundry Agent Service connector with auth type "Microsoft Entra ID User Login" pointing at the Foundry project endpoint.

1. Add the Azure AI Foundry Agent Service connector via the CLI: npx power-apps add-data-source and select it from the connector picker.
2. Run tsc --noEmit → parser errors in AzureAIFoundryAgentServiceService.ts and AzureAIFoundryAgentServiceModel.ts (problem 1).
3. Manually fix the generated files
4. Call any connector operation, e.g. InvokeAgent
5. Run the app → HTTP 401 with the IDX10609 error above (problem 2).

Expected behavior

• npx power-apps add-data-source produces TypeScript that compiles cleanly.
• The generated service operations succeed when invoked from the Code App with a valid user-delegated connection.

Actual behavior

• Generated files do not compile until manually patched.
• After the manual patch, every call fails with IDX10609: Decryption failed during the OBO token exchange. The request never reaches the Agent in Foundry.

Screenshots or Error Messages

{
  "success": false,
  "error": {
    "message": "Failed to get onbehalfof access token: connectionId=azureagentservice, message=IDX10609: Decryption failed. No Keys tried: token: '[PII of type 'Microsoft.IdentityModel.Logging.SecurityArtifact' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.",
    "status": 401,
    "requestId": "5e03a7af-6dea-4174-b5aa-17414384d2e8"
  }
}

Environment information

• Framework / build tool: React 18 + Vite 4.5, TypeScript
• SDK: @microsoft/power-apps ^1.1.1
• PAC CLI: v2.6.4 .NET
• Connector: Azure AI Foundry Agent Service (azureagentservice)
• Connection auth type: Microsoft Entra ID User Login
• OS / browser: macOS 26.4, Edge 147

Additional context

[eschavez]

Thanks for the detailed report and for isolating two distinct issues here.

Issue 1: Codegen — TypeScript compilation errors

We're tracking two sub-bugs in this area:

• Hyphenated parameter names: A fix for hyphen/dot characters in operation parameter names landed recently (they are now converted to underscores in the function signature while the original key is preserved in the params object type). If you're on PAC CLI v2.6.4 and still seeing this, it's possible the specific parameter shape in the azureagentservice swagger is hitting a different code path. Could you share the exact parameter name(s) that are emitted as-is? That will help us narrow it down.

• Multi-line schema descriptions losing // prefix on continuation lines: This is a confirmed bug on our end. When a property description in the swagger spans multiple lines, only the first line gets the // comment prefix; subsequent lines are emitted as bare text, which breaks compilation. We have a fix identified and will track this internally.

Issue 2: OBO token decryption failure (HTTP 401)

The IDX10609: Decryption failed error during the OBO (on-behalf-of) token exchange is occurring inside the Power Platform connector runtime, before the request reaches Azure AI Foundry. This is a service-side issue with how the OBO token is issued or decrypted for the azureagentservice connection — it is not something we can address in the Code Apps client or CLI. We are routing this to the appropriate team.

In the meantime, the same flow working in Power Automate with the same connection is useful confirmation that the connection itself is valid — this helps narrow the scope of the service-side investigation.

We'll update this issue as we make progress on both fronts. Thanks again for the thorough repro steps.

[joniii98]

Issue 1 — hyphenated parameter names

The affected parameter is api-version — the only hyphenated parameter in this connector, but present on every single operation, so all of them are broken.

Re: Issue 1 — multi-line comments

👍 Thanks for confirming!

Re: Issue 2 — OBO

Thanks for routing this to the appropriate team! This issue is currently my biggest blocker. My use case is to communicate with an Azure Foundry agent directly from my Code App, using the identity of the user who is currently signed in to the app. The agent needs to act on behalf of that user to access data with Dataverse RBAC.