Resolving Copilot WSS Connection Failures via Proxy Policy
Short answer
A Configure the Branch1 web proxy policy to allow required protocols for the hosts in *.cloud.microsoft.
Question
Your company has multiple branch offices, including a branch office named Branch1. The users in Branch1 connect to Microsoft 365 by using a corporate web proxy.
On the Network connectivity page in the Microsoft 365 admin center, Branch1 displays the following network insight:
“We’re detecting WebSocket (WSS) connection failures to the domain: *.cloud.microsoft, which causes Copilot to not work correctly for your users.”
HTTPS access to Microsoft 365 apps from Branch1 succeeds.
You need to resolve the insight without changing connectivity for the other branch offices.
What should you configure?
Key Takeaways
Copilot requires WebSocket (WSS) connections; standard HTTPS success does not guarantee WSS support, requiring explicit proxy protocol allowance.
Learn how to fix Microsoft 365 Copilot WSS connection failures in Branch1 by updating the web proxy policy to allow WebSocket protocols for *.cloud.microsoft.
Common mistake: Choosing DNS optimization (B) or firewall rules (D) ignores the fact that HTTPS works and the issue is specifically at the application layer protocol level (WebSocket).
Expert Analysis
WebSocket (WSS) Requirement: Microsoft 365 Copilot relies on persistent WebSocket connections over WSS to communicate with endpoints in the *.cloud.microsoft domain. Unlike standard HTTP/HTTPS traffic, WSS requires specific protocol upgrade capabilities that are often blocked by default proxy configurations.
Proxy vs. Firewall Analysis: The question states that HTTPS access to Microsoft 365 apps succeeds, which rules out basic firewall blocking of port 443 (Option D). Since the issue is isolated to Branch1 and involves a web proxy, the solution must address the proxy's handling of non-HTTP protocols. Option B (DNS) is incorrect because name resolution is working; the connection itself fails.
Protocol Allowance vs. TLS Inspection: While TLS inspection (Option C) can sometimes interfere with certificates, the primary blocker for Copilot is the lack of WebSocket support in the proxy policy. Standard proxies may strip or reject the Upgrade: websocket header unless explicitly permitted. Therefore, configuring the Branch1 web proxy policy to allow the required protocols for *.cloud.microsoft is the direct fix.
Scope Constraint: The requirement to resolve the insight without affecting other branches necessitates a targeted policy change for Branch1 only, making Option A the precise administrative action.
Exam Strategy
When troubleshooting network insights in M365, distinguish between transport-layer issues (firewall/DNS) and application-layer requirements (WebSockets/SIP). If HTTPS works but real-time services fail, check proxy settings for protocol upgrades like WebSocket or SIP rather than broadening firewall rules.
Frequently Asked Questions
Why doesn't successful HTTPS mean Copilot will work?
Can I use a firewall rule to fix this?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
linux_admin 👍 1 Answered AUpdate the Branch1 web proxy policy to allow required protocols for the hosts in .cloud.microsoft. Explanation: Microsoft 365 Copilot requires persistent WebSocket (WSS) connections to endpoints under .cloud.microsoft. Because HTTPS traffic already succeeds, the connectivity issue occurs at the proxy level where non-HTTP/1.1 protocol upgrades are restricted, requiring the Branch1 web proxy policy to explicitly allow the WebSocket protocol for *.cloud.microsoft.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.