Microsoft Copilot Cowork connections Fail via WSS Agent enabled
Article ID: 443335
Updated On:
Products
Issue/Introduction
Users accessing internet sites/services via Cloud SWG using WSS Agents, predominantly on Windows.
Users claim that the Microsoft Copilot Cowork agent is not working with WSS Agent enabled.
No errors reported, but the prompts did not appear.
Enabling SSL interception bypass for domain cin-ia101.gateway.prod.island.powerapps.com appears to workaround the problem.
Environment
WSS Agent.
Microsoft Copilot Cowork.
Cause
Malware scanning errors for long living streaming sessions.
Resolution
If using Management Center to push the Cloud SWG policy, disable malware scans for streaming sessions to the domains reporting the errors (mcsaetherruntime.cin-ia101.gateway.prod.island.powerapps.com in our case), or for the generic domain with the following CPL. Make sure that there is not another layer after this statement that enabled the icap_service().
<Proxy>
url.domain=gateway.prod.island.powerapps.com response.header.Content-Type="text/event-stream" response.icap_service(no)
For those managing Cloud SWG policies using the Portal, log in to the Symantec Cloud SWG Portal and navigate to your Malware Scanning policy. Create a new rule targeting the destination domain object:
Target Domain: mcsaetherruntime.cin-ia101.gateway.prod.island.powerapps.com (or use the more generic gateway.prod.island.powerapps.com)
and set the Action to Bypass Malware Scanning (or disable response optimization/buffering for this destination).
Additional Information
The HAR file initially provided showed errors accessing mcsaetherruntime.cin-ia101.gateway.prod.island.powerapps.com, where requests were being generated every 30 seconds as shown below:
Tracking these requests within the Cloud SWG access logs, we could correlate the failures to ICAP errors, where the ICAP service was malware related as shown below. In each case, the content-type was event streaming related and long living.
Result : FAILED
Url : https://mcsaetherruntime.cin-ia101.gateway.prod.island.powerapps.com/v1/mru/subscribe?_nonce=#####
:
Content Type : text/event-stream; charset=utf-8 *****
Download Bytes : 4.5 KB
File Type : No File Type
Response HTTP Version : HTTP/2
Response ICAP Status : ICAP_COMMUNICATION_ERROR
Result : FAILED
Url : https://mcsaetherruntime.cin-ia101.gateway.prod.island.powerapps.com/v1/subscribe?conversationId=######
:
Upload Bytes : 3.0 KB
Content Type : text/event-stream; charset=utf-8 ******
Download Bytes : 14.6 KB
File Type : No File Type
Response HTTP Version : HTTP/2
Response ICAP Status : ICAP_REQUEST_ABANDONED
Microsoft Cowork relies heavily on Server-Sent Events (SSE) to push real-time data back and forth between the cloud engine and the client application. By design, Cloud SWG attempts to buffer and fully download an incoming payload to perform anti-malware inspection before releasing it to the endpoint. Because an SSE stream is open-ended and "incomplete" by nature, the gateway holds the connection open indefinitely while waiting for an end-of-file (EOF) marker, causing the client connection to time out and drop.
Feedback
