Skip to content

Control 2.15: Network Security and Private Connectivity — Troubleshooting

Common issues and resolution steps for network security controls.

Common Issues

Issue 1: Copilot Slow or Unresponsive

  • Symptoms: Copilot responses are significantly delayed or time out, particularly from specific network locations
  • Root Cause: Network latency, proxy interference, SSL inspection overhead, or firewall blocking of required endpoints.
  • Resolution:
  • Run Script 1 to test endpoint connectivity and latency
  • Compare latency against baselines — anything above 200ms may impact experience
  • Check whether proxy or TLS inspection behavior is interrupting WSS or adding latency
  • Verify TLS inspection and proxy settings preserve full WSS connectivity; test a scoped exception if needed
  • Review firewall logs for blocked connections to Copilot service endpoints
  • Symptoms: An adjacent Azure resource an internal Copilot Studio agent calls (e.g., an Azure-hosted API) resolves to a public IP instead of its private endpoint, or DNS resolution fails entirely
  • Root Cause: Private DNS zones for the Azure resource may not be correctly configured, or DNS forwarding rules may not cover the resource's private domain.
  • Resolution:
  • Verify Azure Private DNS zones are created for the adjacent Azure resource's domain
  • Check DNS forwarding configuration on corporate DNS servers
  • Test DNS resolution against the Azure resource's private FQDN from within the corporate network
  • Verify the Private DNS zone is linked to the correct virtual network

M365/Copilot resolving to public Microsoft IPs is expected

Azure Private Link does not apply to Microsoft 365 Copilot. M365 endpoints (SharePoint Online, Exchange Online, Teams, Copilot) correctly resolve to public Microsoft IP addresses — that is by design for internet-facing SaaS, not a DNS fault. Govern M365 Copilot traffic with Conditional Access, Global Secure Access, and tenant restrictions, not private endpoints.

Issue 3: Firewall Blocking Required Copilot Endpoints

  • Symptoms: Copilot features fail or are unavailable; endpoint connectivity test shows failures
  • Root Cause: Firewall rules may not include recently added Microsoft 365 endpoints, or endpoint categories may have changed.
  • Resolution:
  • Download the current Microsoft 365 endpoint list from Microsoft's web service
  • Compare against current firewall rules to identify missing entries
  • Add missing endpoints and categories to the firewall allowlist
  • Subscribe to endpoint change notifications to stay current

Issue 4: SSL Inspection Degrading Copilot Performance

  • Symptoms: Copilot works but is noticeably slower than expected, or certificate errors appear intermittently
  • Root Cause: TLS inspection devices can add latency or interrupt the full WSS connectivity Copilot requires.
  • Resolution:
  • Confirm full WSS connectivity to *.cloud.microsoft and *.office.com
  • Test a narrowly scoped TLS inspection exception for the affected published endpoints
  • Test Copilot performance before and after bypass to quantify the improvement
  • If the exception is necessary, document its scope and evidence in the network security architecture

Issue 5: Branch Office Connectivity Issues

  • Symptoms: Copilot performance varies significantly between headquarters and branch offices
  • Root Cause: Branch offices may route M365 traffic through a central hub (backhauling) instead of using local internet egress, adding latency.
  • Resolution:
  • Evaluate local internet breakout for Microsoft 365 traffic at branch offices
  • Implement SD-WAN policies to route M365 traffic directly from branches
  • Configure split-tunnel VPN for remote workers to avoid backhauling M365 traffic
  • Monitor connectivity from each branch using Script 1

Diagnostic Steps

  1. Test connectivity: Run Script 1 from the affected network location
  2. Check DNS resolution: Verify M365 domains resolve correctly
  3. Review firewall logs: Check for blocked connections to M365 endpoints
  4. Test without proxy: Temporarily bypass proxy to isolate the issue
  5. Compare locations: Test from multiple network locations to identify location-specific issues

Escalation

Severity Condition Escalation Path
Low Minor latency variations between locations Network Operations
Medium Endpoint connectivity failures from specific locations Network Operations and ISP
High Private Link non-functional for an adjacent Azure resource an internal agent calls Azure team and Network Operations
Critical All Copilot endpoints unreachable Network Operations and Microsoft support immediately