How do I connect a copilot agent to an Azure AI index securely

Question

How do I connect a copilot agent to an Azure AI index securely

Shabash, Boris 30

I have an Azure AI Search service, with a networking configuration where only "Selected IP addresses" can connect to it. i.e. it is blocked from public access

I also have copilot agent which I want to integrate to use the vector index from the search service, but it can't connect because of the networking setting

How do I have a copilot agent connect to a secure search service like this?

Manas Mohanty 4,125 Reputation points Microsoft External Staff Moderator

2025-05-06T09:03:40.07+00:00

Hello Shabash, Boris,

We are checking to see if the below pointers from Sina Salam helped address your query on connecting Azure AI search connector securely to Copilot agent.

Please post your query on Microsoft copilot forum if you have any additional queries or other issue.

Thank you
Manas Mohanty 4,125 Reputation points Microsoft External Staff Moderator

2025-05-07T09:10:22.02+00:00

Hello Shabash, Boris,

We have not heard back from you. Hope the pointers from Sina Salam addressed your query/.

Thank you

1 answer

Your answer

Manas Mohanty 4,125 Reputation points Microsoft External Staff Moderator

2025-05-06T09:03:40.07+00:00

Hello Shabash, Boris,

We are checking to see if the below pointers from Sina Salam helped address your query on connecting Azure AI search connector securely to Copilot agent.

Please post your query on Microsoft copilot forum if you have any additional queries or other issue.

Thank you
Manas Mohanty 4,125 Reputation points Microsoft External Staff Moderator

2025-05-07T09:10:22.02+00:00

Hello Shabash, Boris,

We have not heard back from you. Hope the pointers from Sina Salam addressed your query/.

Thank you

Answer 1

Sina Salam 21,226 Moderator

Hello Shabash, Boris,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to know how you can connect a copilot agent to an Azure AI index securely.

In your Copilot agent settings, add the Azure AI Search connector. Provide the necessary details such as the Azure AI Search instance name, index name, vector field, text field, title field, and the API key for authentication - https://learn.microsoft.com/en-us/microsoft-copilot-studio/knowledge-azure-ai-search
To resolve the networking issues, check the following and the associated links for more details. You can do this by setting up inbound rules that list the IP addresses, ranges, or subnets from which requests are admitted and if your Copilot agent is hosted on a specific IP address or within a specific subnet, make sure to add these to the allowed list in your Azure AI Search service's networking settings. - https://learn.microsoft.com/en-us/azure/search/service-configure-firewall
Consider using private endpoints to securely connect your Copilot agent to the Azure AI Search service. - https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks
Make Copilot agent to properly authenticated and authorized to access the Azure AI Search service. - https://learn.microsoft.com/en-us/azure/ai-services/cognitive-services-virtual-networks

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Shabash, Boris 30 Reputation points

2025-05-08T16:47:40.5266667+00:00

@Sina Salam
I am not sure about these steps. I have provided all the required credentials for the copilot agent in copilot studio but it still cannot connect, and I am not sure how to list the IP address of the copilot agent or copilot studio as an exception

Can you provide some more details about the method I should employ?

To clarify, I have also added my own IP address as an exception, but it does not help the copilot agent from copilot studio to connect
Sina Salam 21,226 Reputation points Moderator

2025-05-08T18:06:53.4766667+00:00
Hello Shabash, Boris,

Thank you for your feedback.

Integrating Microsoft Copilot Studio (copilot agent) with Azure AI Search that has restricted network access is not straightforward, and though I'm NOT supporting Microsoft Copilot as a Team but all my responses are directionally correct by experience.

The IPs used by Copilot Studio (especially hosted Copilot agents) are not publicly documented and cannot reliably be whitelisted using "Selected IPs". You can’t simply add “Copilot agent IPs” — they’re dynamic and abstracted.

Yes I mentioned private endpoints but Copilot Studio must be VNet-integrated (which you're not using currently).

Since you're already using API keys, the actual issue is network-level access, not credentials.

As I said, you do need to configure the Azure AI Search connector in Copilot Studio with API key and field mappings. However, this only works if the networking configuration allows communication, which is your issue.

To break from limitations, use a Secure Proxy (Azure Function or Azure API Management and follow the below steps:

Step 1: Create a secure proxy layer by deploy an Azure Function or API App that:

Runs in a VNet (if needed)

Has access to your Azure AI Search (via private endpoint or allowed IP)

Accepts REST requests from Copilot Studio

Proxies the requests securely to Azure AI Search

This layer will:

Authenticate Copilot’s requests (using an API key or token)

Call Azure AI Search securely using your private setup

Return the results back to the Copilot agent

Step 2: Configure Azure AI Search by keeping the networking to Selected IPs.

Add the Azure Function’s outbound IP(s) or VNet integration subnet to the firewall rules

Or use a Private Endpoint if you VNet-integrate the Azure Function

Step 3: Configure Copilot Studio in your knowledge source configuration:

Point it to the proxy endpoint (e.g., https://myproxy.azurewebsites.net/query)

Ensure it returns JSON in the schema expected by Copilot Studio

While putting into consideration the security best practices:

Use managed identity or Azure API Management with OAuth2 for secure access between the proxy and Azure AI Search.

Enable rate limiting and request validation on your proxy to prevent abuse.

If using API Management, consider using JWT validation for added security.

Alternatively, to the proxy (if you don’t want to build a proxy):

Loosen Azure AI Search firewall temporarily for dev/testing by allowing 0.0.0.0/0 and monitor requests — not recommended for production.

Submit feedback to Microsoft requesting documented IP ranges or VNet integration support for Copilot Studio.

That's my best advice.

Have a good success.

Share via

How do I connect a copilot agent to an Azure AI index securely

1 answer

Your answer