Network access for Cloud agents
Decide between an internet endpoint and Tailscale, manage IP allowlists, and expose only required services.
Network exposure is selected per agent. Choose it based on who must reach the workspace and which private services the agent must call.
Internet exposure
An internet-exposed agent receives a public HTTPS endpoint. The Cloud Console creates firewall rules and, when configured, a stable DNS hostname. Access to the owner UI is restricted by the agent’s allowed IP ranges.
Enter individual addresses as /32 ranges and networks in CIDR form. Separate multiple ranges with
commas or spaces.
203.0.113.4/32, 198.51.100.0/24
Use Add my IP to insert the current public address. Corporate VPNs, mobile networks, and home routers can change that address later.
Change an allowlist
Open Settings on an eligible agent card, edit Allowed IP ranges, and save. Use Add my IP from the settings dialog when you moved to a new network.
Keep at least one range you can reach from. A malformed or overly narrow range can lock you out of the endpoint even while the agent remains healthy.
Tailscale exposure
A Tailscale agent joins your configured tailnet with a short-lived auth key. The private UI becomes available through its MagicDNS name after tailnet HTTPS is ready. The card can briefly show a certificate-pending state during first boot.
Tailscale is the recommended mode when the agent must reach private custom tools, a local model server, a Hue Bridge, or an externally hosted Voice Studio. Connect the account first in Cloud Console → Settings. See Tailscale setup.
Microsoft Teams Funnel
For a Tailscale deployment, Microsoft Teams Funnel publishes only the Teams Activity endpoint. The owner UI on port 443 and the internal bot transport remain private. After launch, use the exact Azure Bot endpoint shown by the Microsoft 365 integration.
Do not expose a general-purpose internal listener as a substitute. The Teams route is designed to accept authenticated Bot Framework traffic while preserving the private management surface.
Choosing a mode
| Need | Recommended mode |
|---|---|
| Reach the UI from a known office or home address | Internet with a narrow allowlist |
| Reach private LAN or tailnet services | Tailscale |
| Avoid updating changing public IPs | Tailscale |
| Receive Teams Bot Framework traffic on a private agent | Tailscale with Teams Funnel |
Network mode is a launch-time architectural choice. If requirements change substantially, launch a replacement agent with the correct exposure and migrate only the data you intend to retain.
Your response helps us keep product instructions useful.