Hi team,
I am testing the pcf-canvas-app sample from this repository:
https://github.com/microsoft/CopilotStudioSamples/tree/main/ui/embed/pcf-canvas-app
The sample works as expected in desktop browsers, but authentication fails when running inside Power Apps iOS mobile application, where the Canvas App is hosted through WKWebView.
The issue appears to be related to MSAL Browser initialization / authentication flow limitations in WKWebView.
Environment
Sample: ui/embed/pcf-canvas-app
Host application: Power Apps Canvas App
Platform: iOS Power Apps Mobile
Web runtime: WKWebView
Authentication: Microsoft Entra ID / M365 authentication
MSAL: Browser-based authentication flow
Expected behavior
When opening the Canvas App on iOS:
PCF control initializes successfully
MSAL Browser creates the authentication client
User is redirected to Microsoft login page
Token acquisition succeeds
Copilot Studio agent connection is established
Actual behavior
The authentication initialization fails inside iOS WKWebView.
The flow looks like:
Power Apps (iOS WKWebView)
|
v
PCF
|
v
MSAL Browser
|
v
login.microsoftonline.com
MSAL fails during initialization or token acquisition.
As a result, the PCF control cannot authenticate and the Copilot Studio agent cannot be loaded.
Possible root cause
It seems related to known limitations of using MSAL Browser inside WKWebView:
Redirect based login may not work correctly
Popup authentication is unavailable
Third-party cookie restrictions may block authentication state
Silent token acquisition may fail
Web storage behavior differs from desktop browsers
Power Apps iOS uses WKWebView instead of a full browser environment, which may cause MSAL Browser assumptions to fail.
Error details
Example behavior:
Unable to initialize MSAL authentication client
or
Failed to acquire token silently
Network requests to:
https://login.microsoftonline.com/
do not complete successfully.
Questions
Is pcf-canvas-app officially supported inside Power Apps Mobile (iOS)?
Is there a recommended authentication approach for PCF controls running inside Canvas Apps on iOS?
Should this sample use another authentication mechanism instead of MSAL Browser?
For example:
Native Power Apps authentication context
Entra ID token provided by host application
MSAL native authentication flow
Alternative PCF authentication pattern
Additional information
The current implementation works correctly in:
✅ Desktop browser
✅ Standard browser environments
The issue only reproduces in:
❌ Power Apps iOS Mobile App (WKWebView)
Possible improvement
Could the sample documentation include a note about mobile/WKWebView authentication limitations?
For example:
"This sample uses MSAL Browser authentication. Running inside embedded WebView containers such as Power Apps Mobile iOS may require additional authentication handling."
Thanks for reviewing this issue.
Hi team,
I am testing the pcf-canvas-app sample from this repository:
https://github.com/microsoft/CopilotStudioSamples/tree/main/ui/embed/pcf-canvas-app
The sample works as expected in desktop browsers, but authentication fails when running inside Power Apps iOS mobile application, where the Canvas App is hosted through WKWebView.
The issue appears to be related to MSAL Browser initialization / authentication flow limitations in WKWebView.
Environment
Sample: ui/embed/pcf-canvas-app
Host application: Power Apps Canvas App
Platform: iOS Power Apps Mobile
Web runtime: WKWebView
Authentication: Microsoft Entra ID / M365 authentication
MSAL: Browser-based authentication flow
Expected behavior
When opening the Canvas App on iOS:
PCF control initializes successfully
MSAL Browser creates the authentication client
User is redirected to Microsoft login page
Token acquisition succeeds
Copilot Studio agent connection is established
Actual behavior
The authentication initialization fails inside iOS WKWebView.
The flow looks like:
Power Apps (iOS WKWebView)
|
v
PCF
|
v
MSAL Browser
|
v
login.microsoftonline.com
MSAL fails during initialization or token acquisition.
As a result, the PCF control cannot authenticate and the Copilot Studio agent cannot be loaded.
Possible root cause
It seems related to known limitations of using MSAL Browser inside WKWebView:
Redirect based login may not work correctly
Popup authentication is unavailable
Third-party cookie restrictions may block authentication state
Silent token acquisition may fail
Web storage behavior differs from desktop browsers
Power Apps iOS uses WKWebView instead of a full browser environment, which may cause MSAL Browser assumptions to fail.
Error details
Example behavior:
Unable to initialize MSAL authentication client
or
Failed to acquire token silently
Network requests to:
https://login.microsoftonline.com/
do not complete successfully.
Questions
Is pcf-canvas-app officially supported inside Power Apps Mobile (iOS)?
Is there a recommended authentication approach for PCF controls running inside Canvas Apps on iOS?
Should this sample use another authentication mechanism instead of MSAL Browser?
For example:
Native Power Apps authentication context
Entra ID token provided by host application
MSAL native authentication flow
Alternative PCF authentication pattern
Additional information
The current implementation works correctly in:
✅ Desktop browser
✅ Standard browser environments
The issue only reproduces in:
❌ Power Apps iOS Mobile App (WKWebView)
Possible improvement
Could the sample documentation include a note about mobile/WKWebView authentication limitations?
For example:
"This sample uses MSAL Browser authentication. Running inside embedded WebView containers such as Power Apps Mobile iOS may require additional authentication handling."
Thanks for reviewing this issue.