Issue: Camera/Microphone Access Not Working in Production M365 Copilot

Description

We are testing an internally developed SPFx Copilot Component that requires access to the device camera and microphone.

The component works as expected when tested through Copilot Workbench, including requesting camera and microphone access. However, when the same component is deployed and accessed through production Microsoft 365 Copilot, camera and microphone access is blocked.

This appears to indicate a difference between the Copilot Workbench host and the production Microsoft 365 Copilot host/container, rather than an issue with the component's core functionality.

Steps to Reproduce

1. Develop or use the internally developed Copilot Component that requires camera and microphone access.
2. Ensure the component invokes camera/microphone functionality using getUserMedia() directly or through the relevant SDK/component functionality.
3. Run the component using Copilot Workbench.
4. Trigger the functionality that requires access to the camera and microphone.
5. Verify that the browser displays the camera/microphone permission prompt.
6. Grant the requested permissions.
7. Confirm that the camera and microphone functionality works successfully in Copilot Workbench.
8. Deploy the same component without code changes to the target SharePoint/Microsoft 365 environment.
9. Open the component through production Microsoft 365 Copilot.
10. Trigger the same camera/microphone functionality.
11. Observe that the component loads successfully and the functionality is triggered, but no browser permission prompt is displayed.
12. Open the browser developer console and check for Permissions Policy errors.

Actual Behavior

In production Microsoft 365 Copilot:

• The Copilot Component loads successfully.
• The camera/microphone functionality is triggered.
• No browser permission prompt is displayed.
• Camera and microphone access is blocked by the host container.
• The browser console reports errors similar to:

[Violation] Permissions policy violation: microphone is not allowed in this document.
[Violation] Permissions policy violation: camera is not allowed in this document.

The component/SDK subsequently reports that access to the hardware is denied.

Expected Behavior

The component should be able to request camera and microphone permissions when running in production Microsoft 365 Copilot, in the same way that it does when running through Copilot Workbench.

The browser should either:

• display the camera/microphone permission prompt, or
• honor previously granted permissions,

provided the Copilot Component has declared the required device permissions and the host supports the capability.

Comparison

Current Assessment

The component itself appears to be functioning because the same component and functionality work successfully in Copilot Workbench.

The failure occurs specifically when the component is hosted inside production Microsoft 365 Copilot, where the browser reports that camera and microphone are not permitted by the host container's Permissions Policy.

Therefore, the issue may be related to the production Microsoft 365 Copilot host/container configuration or supported capabilities, rather than the internally developed bot/component.

Validation Question

The key question to confirm is:

Does the production Microsoft 365 Copilot host currently support camera and microphone access for this type of SPFx Copilot Component, and if so, how are the required camera and microphone Permissions Policy permissions granted to the component?

In particular, it should be confirmed whether the production host/container provides the equivalent of the required iframe Permissions Policy, such as:

allow="camera; microphone"

or an equivalent host-level configuration.

Conclusion

Based on the current testing:

Copilot Component: Functional
Copilot Workbench: Camera/microphone access works
Production M365 Copilot: Camera/microphone access blocked by host Permissions Policy

The production host behavior should therefore be investigated before treating this as a defect in the internally developed bot/component.