The beta endpoint GET /beta/copilot/admin/catalog/packages currently supports delegated permissions only - app-only (client credentials / service principal) calls are rejected with 403 "Access is denied to the requested resource". Note that CopilotPackages.Read.All is already grantable as an application role, but the service refuses app-only auth. Please enable app-only support for this permission so the agent catalog can be read by a background service without an interactive user.
Why this matters: we need to continuously inventory the Microsoft 365 Copilot agents deployed in a tenant for security and governance - tracking which agents exist, who published them, and how they change. We want to query this data from customer tenants, and it can only be performed properly using a service principal, not a user. Delegated-only auth forces an interactive session, making continuous collection impractical.
Request:
1. Enable app-only access for CopilotPackages.Read.All on /beta/copilot/admin/catalog/packages so it can be called with client credentials.
2. Clarify whether app-only access would carry the same Microsoft Agent 365 license requirement that applies today - and if so, whether a read-only inventory scenario can be supported without per-user licensing, since automated collection has no interactive user to license.