Power Platform Community Forum Thread Details

I have followed the steps in the documentation to connect a Copilot Studio agent to application insights. Agent-level telemetry with Application Insights - Microsoft Copilot Studio | Microsoft Learn.

1. On my application insights resource in Azure, I copied the connection string.

2. Go to the Settings page for the agent and selected Advanced.
3. Within the Application Insights section, enter the Connection string.

4. Save and publish agent.

5. Waited an hour, ran some conversations in the test pane in Copilot Studio, waited an hour, then reviewed application insights logs using KQL query customEvents. No logs appeared.

The Application Insights resource has restricted public inbound access. A Private Link is configured using AMPLS. Configure private link for Azure Monitor - Azure Monitor | Microsoft Learn.

Subnet injection has been performed for the Power Platform environment into the Azure VNet which contains the Application Insights resource and private endpoint.

My questions are:

Given the subnet injection, is Copilot Studio telemetry able to connect to the Azure Monitor private endpoint?
Are there networking or AMPLS configuration steps required to connect Copilot Studio telemetry to the Azure Monitor private endpoint?
Is public ingestion currently required for Copilot Studio agent telemetry to Application Insights?

If this is not feasible, what would be the best option to set up error alerts for the Copilot Studio agent?

Any assistance would be appreciated.

Kind regards,

Nina

Categories:

Bot administration

Bot extensibility

Bot analytics

Hi @Nina131,

Short answer: yes, this scenario is supported, but only through Power Platform Virtual Network support, and there are a few requirements that are easy to miss. Public ingestion is not required.

Microsoft explicitly lists "agents that send telemetry to a private endpoint-enabled instance of Application Insights" as one of the three supported Copilot Studio VNet scenarios (docs). So the architecture is right , something in the chain is likely incomplete. Things I'd check in order:

1. Managed Environment + VNet support actually enabled
Subnet injection alone isn't sufficient. The environment must be a Managed Environment, and Virtual Network support must be enabled on it with two delegated subnets (one per paired region). If either region's subnet is missing or the delegation isn't Microsoft.PowerPlatform/enterprisePolicies, calls silently fall back or fail.

2. Workspace-based App Insights, add the Log Analytics workspace to the AMPLS too
This is the most common cause of zero events. If your App Insights resource is workspace-based (all new ones are), adding only the Application Insights component to the AMPLS isn't enough. The backing Log Analytics workspace must also be connected to the scope, since ingestion terminates there.

3. Private DNS zones
The injected subnet has to resolve the privatelink zones. You need all of these linked to the VNet:

privatelink.monitor.azure.com
privatelink.oms.opinsights.azure.com
privatelink.ods.opinsights.azure.com
privatelink.agentsvc.azure-automation.net
privatelink.blob.core.windows.net

The blob zone is the one people skip, and its absence breaks ingestion specifically.

4. AMPLS access modes
On the AMPLS, confirm ingestion access mode is set as you intend and that the Network Isolation page for the App Insights resource isn't blocking the source network. If you've used the Network Isolation page instead of scope-based config, verify your VNet is explicitly listed.

5. Connection string and republish
Confirm the connection string came from the private endpoint-enabled resource (check Resource group and Subscription on its Overview blade), and that you republished the agent after saving. Also filter on the DesignMode custom dimension when querying, test pane traffic is tagged, so make sure your KQL isn't excluding it.

A quick way to isolate networking from configuration: temporarily set ingestion to allow public access. If events appear, the problem is in the private link path (almost certainly #2 or #3). If they still don't, it's the Copilot Studio side.

On error alerting if you can't get this working: the Power CAT Copilot Studio Kit Agent Insights Hub is the usual fallback, it surfaces agent telemetry through Dataverse, so you can build alerts off Dataverse rows without exposing App Insights publicly.

Hope that helps.

Sources: Configure Virtual Network support for outbound connections from agents, Configure private link for Azure Monitor, Power CAT Copilot Studio Kit – Agent Insights Hub