Use IP firewalls for inbound connections to agents and Copilot Studio (preview)

[This article is prerelease documentation and is subject to change.]

If you configure IP firewalls in Power Platform environments, the firewall blocks connections into your network to Copilot Studio agents or the Copilot Studio web app from restricted or unallowed IPs or IP ranges.

An IP firewall helps mitigate threats, helps you apply security principles such as Zero Trust, and limits access to only those users who need it, when they need it. The IP firewall can help to:

• Mitigate insider threats like data exfiltration. For example, a malicious user who tries to access Copilot Studio from a disallowed IP location is blocked from doing so in real time.
• Prevent token replay attacks. For example, if a user steals an access token and tries to use it to access a conversation from outside an allowed IP range, Copilot Studio denies the access attempt in real time.

When a request is made to Copilot Studio, the requested IP address is evaluated in real time against the IP ranges configured for the Power Platform environment. If the IP address is in the allowed ranges, the request is allowed. If the IP address is outside the IP ranges configured for the environment, the IP firewall denies the request with an error message to the agent user or the agent maker at the time of the block.

Prerequisites

• Your environment must be a Managed Environment in Power Platform.
• You must be a Power Platform admin, such as a tenant admin or have the Environment Admin role.

Enable IP firewall for Power Platform environments

To enable the IP firewall, see IP firewall in Power Platform environments - Enable the IP firewall.

• Enable the IP firewall for:
  • Single Power Platform environments, with the Power Platform admin center
  • Single Power Platform environments, with the Dataverse OData API
  • Environment groups, with the Power Platform admin center
• Validate that the IP firewall is working

You can also configure the firewall to use service tags, operate in audit-only mode, and to allow access for Microsoft trusted services.

Service tags

Service tags are predefined sets of outgoing public internet IP ranges and addresses that customer-operated Azure and Power Platform services hosted by Microsoft systems use. For example, you might have connections from Azure Web Apps, or you created a Dataverse plugin that needs to access Copilot Studio endpoints.

Because these services can have multiple addresses and ranges, and Microsoft might add or change these services, using service tags removes the need to manually find and enter individual addresses or ranges for the services you're connecting to.

When you create a plugin, tool, or configure firewalls, select the service tags you want to include in your firewall's configuration.

For example, if you create a Dataverse plugin to connect to Copilot Studio based on an event in your Dataverse instance, select the PowerPlatformPlex service tag when configuring your firewall:

In this example, the PowerPlatformPlex tag contains the required Power Platform and Dataverse addresses needed to allow the services to interact.

For more information on service tags in Power Platform, see Power Platform URLs and IP address ranges. That article also describes PowerPlatformPlex and Power Platform connection requirements under the IP addresses required section.

Validate IP firewall for agent authors and agent users

Test the IP firewall to verify that it works:

1. To test that agent author and maker access to Copilot Studio is blocked:

   1. From an IP address that isn't in the allowed list, open Copilot Studio.

   2. If the firewall is working, you see the following error message, along with an email address for the admin:

      Access to this environment is not possible because your IP address has been blocked by your admin. Please reach out to your admin.

      

2. To test that agent users are blocked from interacting with an agent:

   1. From an IP address that isn't in the allowed list, open an agent on your demo website.

   2. If the firewall is working, you see the following error message:

      The agent isn't available right now because your IP address has been blocked. Please contact your agent owner.

      

Known limitations

• The system enforces agent IP firewall restrictions on web chat and APIs that carry conversational content.

• Over time, agent IP firewall restrictions expand to more endpoints.

• Agents published on the following channels don't enforce IP firewall restrictions:

  • Microsoft channels such as Teams and Microsoft 365 Copilot.
  • Other channels such as Facebook.
  • Connected to Dynamics 365 Customer Service.

• Existing chat sessions don't disconnect when admins apply IP firewall restrictions. The restrictions apply once the session restarts.

Outbound IP addresses for Bot Framework skills

Requests from Copilot Studio to Bot Framework skills use the following IP addresses in their respective regions. If you're using an Azure service, use the PowerPlatformInfra and PowerPlatformPlex service tags, which automatically implement the proper IP addresses. You can also manually enter IP addresses in your traffic configuration rules.

Configure all connectors for IP addresses for Power Automate in addition to Copilot Studio to use both together.

For more information on using service tags, see Virtual network service tags.

¹ Customer data in South America is replicated in United States for disaster recovery purposes, so requests from Copilot Studio to Bot Framework skills use United States IP addresses.