Coding Agent IP Address for whitelisting in Azure SQL Server

[Gareth064]

Select Topic Area

Question

Copilot Feature Area

Copilot Coding Agent

Body

I want the coding agent to run my web app and use Playwrite to navigate and take screenshots of any new features or changes it has made, to then add to the PR.

But, the app points to an Azure SQL Server Database, which allows access from the public, BUT only from white listed IP addressess.

The agent, when running the web app, reports it can't reach the database, and I assume its because the database is blocking it, as it doesn't have its IP address whitelisted.

Is there an IP range range I can add to my Azure SQL Server which will help with this?

[shaashvat01]

Hey,

I think you can’t currently whitelist a fixed IP or IP range for GitHub Copilot’s Coding Agent, since its execution environment runs in ephemeral cloud containers, the outbound IPs are not static and can change anytime. That’s why your Azure SQL Server blocks the connection when it enforces IP based firewall rules.

There’s no official published IP range for Copilot or the Coding Agent yet, since it uses shared infrastructure that scales dynamically.

[Gareth064]

Any suggestions on how to tackle this?

I previously tried to get it to use Sqlite when running on its Linux container, but when I run it, it uses MSSQL. But as I am using Entity Framework and Migrations, the migrations it was creating during its sessions were for SQLite, and so if I deployed and tried to apply the migrations to MSSQL they failed.

I'd really love to have the agent to use Playwrite to actually use the app and take screenshots for documentation etc. also using the app is a good way to find weird UX issues as well.

[shaashvat01]

The most practical workaround for your use case would be to set up a separate dev/test database that the agent can access freely, while keeping your production database locked down. Since you're mainly using it for Playwright screenshots and PR documentation, you don't really need it connected to your production SQL Server anyway (If I understood your use case correctly).

The "Allow Azure Services" toggle might work but isn't guaranteed since the agent doesn't officially run on Azure infrastructure.

[Gareth064]

Ok good idea. I might look for another cheap SQL DB host that isn't Azure. My Azure version isn't a production one, its till a dev version BUT you don't seem to be able to open up the DB completely to the public, you always have to define an IP Range. Although I wonder if I could add a very large range that covers the entire range :D probably not I'm sure.

[omarguesmii]

The problem you’re seeing happens because your Copilot coding agent runs from dynamic IP addresses that are not on your Azure SQL Server’s whitelist. Azure SQL Server only allows connections from IP addresses you explicitly allow.

Here’s a simple way to fix it:

---

1️⃣ Find the Agent’s IP

If you’re running Copilot Coding Agent from your local machine, it will use your local IP. You can check your public IP here:

curl ifconfig.me

If it’s running from GitHub Actions (or another cloud environment), the IP can change dynamically, so you need a range of IPs GitHub Actions uses.

GitHub provides a JSON file with all the IP ranges:

• GitHub Actions IPs → look under "actions"

---

2️⃣ Add IPs to Azure SQL Server

1. Go to your Azure Portal → SQL Server → Networking → Firewall rules.

2. Click Add client IP (for your local IP) or manually add a start and end IP range for GitHub Actions.

Example for a range:

Rule Name | Start IP | End IP -- | -- | -- GitHubAG | 140.82.112.0 | 140.82.115.255

This allows all IPs from 140.82.112.0 to 140.82.115.255 to access your database.

---

3️⃣ Optional: Enable “Allow Azure Services”

• In Azure SQL Server → Networking, there’s a checkbox “Allow Azure services and resources to access this server”.

• This allows any Azure-hosted service to connect. ✅ Only use this if you trust all services in your Azure subscription.

---

4️⃣ Test Your Connection

Once you add the IPs, run your Copilot agent again. It should be able to:

• Launch the web app

• Connect to the Azure SQL Server

• Use Playwright to take screenshots and update the PR

---

💡 Tip:

• If the agent is running in a dynamic environment (like GitHub Actions), regularly check for updated IP ranges to avoid connection issues.

[Gareth064]

According to the Copilot built into Azure, to allow all public access to the SQL Server, you can add ip range 0.0.0.0/0. I have done this, so we will see how it goes.