Adventure Works: Integrating a Copilot with Legacy Systems
Adventure Works is integrating a Microsoft Copilot Studio agent with its legacy on-premises ERP system to allow sales reps to check order status and inventory levels. The ERP system exposes a SOAP API that requires Windows authentication and is only accessible from the corporate network. The agent will be used by 300 sales reps on mobile devices, often outside the corporate network. The company has an Azure subscription and uses Azure ExpressRoute to connect to on-premises. The security team mandates that no inbound connections from the internet to on-premises are allowed. The sales reps need responses within 3 seconds. The current ERP API has an average response time of 1.5 seconds for a single query, and the agent may need to make multiple queries per user request. The project has a 3-month timeline.
1. What architecture would you propose to securely connect the Copilot Studio agent to the on-premises ERP system, and how would you meet the 3-second response time requirement?
Read the worked answer
Propose an architecture using Azure API Management (APIM) as a gateway. Deploy APIM in a virtual network (VNet) that is connected to on-premises via ExpressRoute. Configure APIM to use a self-hosted gateway on-premises or use VNet integration to reach the ERP. Since inbound connections are not allowed, use an outbound-only connection from on-premises to Azure: deploy a self-hosted gateway in the on-premises network that initiates an outbound connection to APIM in Azure. The Copilot Studio agent calls APIM over HTTPS. APIM handles Windows authentication by using a certificate or by integrating with on-premises Active Directory via a custom connector. To meet the 3-second response time, implement caching in APIM for frequently accessed data (e.g., order status for recent orders) with a short TTL (e.g., 30 seconds). Also, optimize the ERP queries by batching multiple queries into a single SOAP request if possible. Use asynchronous processing for non-critical data. Additionally, deploy the agent's backend logic in Azure Functions in the same region as APIM to minimize latency. Monitor end-to-end latency with Application Insights and set alerts if P95 exceeds 2.5 seconds. Consider using Azure Front Door for global acceleration if sales reps are geographically dispersed, but ensure it does not introduce additional latency.
2. How would you handle authentication and authorization for the sales reps to ensure they can only access their own orders?
Read the worked answer
Implement authentication using Microsoft Entra ID (Azure AD) with OAuth 2.0. The Copilot Studio agent should be configured to authenticate users via Entra ID. Upon authentication, the agent receives an access token that includes the user's identity and group memberships. APIM validates the token and extracts the user's identity. For authorization, pass the user's identity to the ERP system via a custom header or within the SOAP request. The ERP system must enforce row-level security based on the sales rep's ID, ensuring they can only view orders they are associated with. Alternatively, implement authorization logic in APIM using policies: extract the user ID from the token and add a filter to the SOAP request to restrict results to that user. However, this requires modifying the SOAP request dynamically, which may be complex. A better approach is to have the ERP API accept the user context and enforce access control. Use Azure API Management's validate-jwt policy to ensure the token is valid and has the required scopes. Also, implement conditional access policies in Entra ID to require MFA for mobile access. Log all access attempts in Azure Monitor for auditing.