Network and antivirus

This page covers three protections: where people may open Genie from, which internal systems Genie itself may connect to, and virus scanning of the files people upload. Everything here is set by a system administrator: a workspace's own network list on that workspace's Workspace info, the rest mostly on Settings → Network & antivirus in the System administration group.

Restrict where people can open Genie

You can allow Genie only from the company network and the VPN. There are two lists, and a request must pass both:

List	Where	Who sets it	What it limits
Workspace list	Settings → Workspace info → Network access	System administrators, working in that workspace	The content of that one workspace
Platform list	Settings → Network & antivirus → IP access restriction	System administrators	The whole of Genie: the sign-in page, the web app, API keys, System administration

A workspace list can only narrow the platform list, never widen it. Both take IPv4 or IPv6 addresses and ranges, one per line, such as 203.0.113.0/24 or 10.20.0.0/16, up to 200 per list. A single address is saved as /32 (or /128 for IPv6).

Before you restrict anything, collect the public addresses of every network people work from: each office (for Contoso, Hanoi, Da Nang and Ho Chi Minh City) and the VPN's address pool. Your network team knows them.

Limit one workspace to the company network

A system administrator sets this list in the workspace it restricts: switch to that workspace first (see Settings of one workspace). You need to be an Admin or Owner there to open its Workspace info. Admins and Owners who are not system administrators do not see Network access.

1. Open Settings → Workspace info.
2. Under Network access, read the line "Genie sees your address as …". This is the address Genie checks for you.
3. Tick Only allow these networks for this workspace.
4. Under Allowed ranges, enter the ranges, one per line. Add my address adds the address you are using now.
5. Optionally tick Also apply to API keys used in this workspace. Without it, only people signed in to Genie are restricted.
6. Choose Save.

Outside these networks, members can still sign in, open their profile and switch to another workspace; only this workspace's content is refused. They see This workspace is not available from this network with a list of their other workspaces.

Restrict the whole platform

System administrators set the platform list:

1. Open Settings → Network & antivirus.
2. In IP access restriction, read the line "Genie sees your address as …". If a warning about a proxy appears, stop here and ask your Genie provider to fix it first: otherwise every person may appear to come from the same address.
3. Under Allowed ranges, enter the ranges, one per line. Add my address adds the address you are using now.
4. Under Apply the list to, tick what to restrict (see the table).
5. Choose Save. The change applies within seconds.

Option	What it restricts
The web app and the API used by signed-in people, including the sign-in page	Everything people do in the browser. People outside the list do not even see the sign-in page.
API keys and MCP endpoints	Integrations that use workspace or platform API keys, and assistants that connect to Genie's MCP server. Leave it off if integrations call Genie from servers outside the list.
System administration	Only the System administration pages.

With no option ticked, the list is saved but restricts nothing.

To keep only administration on the company network while people use Genie from anywhere, tick System administration alone. Outside the list, system administrators then see System administration is not available from this network, while the rest of Genie keeps working for them.

SCIM provisioning ranges (optional) is a separate list for automatic user provisioning (see Members and sign-in). Microsoft Entra ID provisions from Microsoft's cloud, so leave it empty unless you know the addresses.

Some traffic is always allowed, whatever the lists say, because it comes from other services rather than from people: messages from Microsoft Teams, Zalo and other chat channels, the return from single sign-on, the website widget (which has its own list of allowed sites), signed file links, and data source webhooks (which have their own Allowed addresses, see Data sources). Genie in Teams and Zalo therefore keeps working wherever people are.

People outside an allowed network see Not available from this network, with their address and a Try again button.

Avoid locking yourself out

• Genie refuses to save a list that leaves out the address you are using now, both for the platform list (when the web app or System administration is restricted) and for a workspace list. The page says so and offers Add my address. It also refuses to turn on a restriction with an empty list.
• Check that the address Genie shows is really yours: your office's public address or one from the VPN pool. If it is an internal address that everyone shares, ask your Genie provider before you restrict anything.
• Add every office and the whole VPN pool before you turn a restriction on. When the VPN's ranges change, update the list first.
• After saving, test from a phone on mobile data: you should see the access-denied page, while Genie still works from the office.
• Keep a second system administrator who works from another allowed network.
• If everyone is locked out anyway, ask your Genie provider: they can switch the restrictions off on the server until you correct the list. While they are switched off, both pages show a warning that the list is saved but not enforced.
• Every change is recorded in the audit log as IP allowlist changed (platform) or Workspace IP allowlist changed, and refused requests as Blocked by the IP allowlist (see Usage, analytics and audit).

Control what Genie can reach

Genie also connects out to other systems: Microsoft 365 for data sources and sign-in, web search services, the websites it crawls or reads during a chat, MCP services, databases and model services. Public internet addresses are allowed. Addresses on private networks, such as your intranet, file servers and internal databases, are refused unless a system administrator allows them. This stops a crafted link or a prompt from steering Genie into your internal systems.

What	Where it is set	Who
Internal hosts Genie may connect to: an intranet to crawl, a file server, an internal database or MCP service	Settings → System settings → Security & privacy → SSRF protection allowlist	System administrators
Genie Search, a workspace's own search services, and the sites web search avoids or prefers	Settings → Web search (in the System administration group), see Web search settings	System administrators, for the whole company; one workspace can get its own setting. A workspace's admins can only turn web search off for it, under Features
What code in the System default sandbox may reach	Settings → Network & antivirus → System default sandbox network, see below	System administrators, for every workspace or for one workspace
What code in a workspace's own sandbox configuration may reach	Settings → Sandbox (in the System administration group), with the workspace picked at the top: the configuration's Network policy, see Sandbox and skills	System administrators
Firewalls, the connection between Genie and your office network, proxies, and whether Genie can be reached from the internet (needed for Microsoft 365 change notifications)	Server side	Your Genie provider

Allow an internal host

1. Open Settings → System settings and choose the Security & privacy tab.
2. In SSRF protection allowlist, type an entry and press Enter: a host (intranet.contoso.test), a wildcard (*.contoso.test), an IP address or a range (10.20.0.0/16). Confirm.
3. The change applies at once. Test the data source, database or MCP service again.

Allow as little as you can: a single host rather than a whole domain or range. An allowed host can be reached by everything in Genie, including agents that read web pages during a chat. The allowlist only lets Genie try to connect: your Genie provider still has to connect Genie to your network. They may also have allowed some hosts on the server, which do not appear in this list.

Limit what sandbox code can reach

Code that agents and skills run in the System default sandbox, such as scripts and package installs, connects out only as the system administrators allow. Genie's own web search and page reading are not affected.

1. Open Settings → Network & antivirus and find System default sandbox network.
2. Next to Default for every workspace, click Edit.
3. Choose Open: may connect anywhere, or Denied: only the destinations below are allowed and list the destinations, one per line:
   • Full access: domains (*.contoso.test works), IP addresses or ranges the code may send data to and receive data from;
   • Download only: hosts the code may only download from, so it can install packages but cannot send files out. Add PyPI (pip install) adds the Python package index.
4. Click Save.

For a workspace that needs another policy, click Add workspace under Per workspace, choose the workspace and set its policy. Use the default puts a workspace back on the default, and Use the deployment configuration puts the default back to what your Genie provider set. A new policy applies to sandboxes started after you save; running sandboxes keep the old one until Genie reclaims them. If your deployment has no System default sandbox, the card says so.

A workspace's own sandbox configurations keep their own Network policy. Open Settings → Sandbox and pick the workspace in the Workspace box at the top (see Sandbox and skills): on most sandbox types, Default egress set to Deny by default (recommended) blocks the internet, and Allowed destinations lists the sites the code may still use. To stop code from running at all, turn off Run code under Running code in every workspace on the same page.

Scan uploaded files for viruses

When scanning is on, every file people hand to Genie is checked by Smart AntiVirus before Genie stores or reads it:

• documents uploaded to a knowledge base, and new versions of documents;
• files and images attached in a chat, including in the website widget;
• skill bundles;
• images and files used to test models;
• files sent to Genie in Microsoft Teams and other chat channels;
• files imported by data sources, only when Also scan files imported by data sources (SharePoint, Exchange and others) is ticked.

Your Genie provider installs the scanner and keeps its virus signatures up to date. A system administrator decides what happens to the files.

Set the scanning policy

1. Open Settings → Network & antivirus.
2. In Smart AntiVirus, check the status. Connected means scanning works. Not configured or Not reachable means the scanner is missing or down: ask your Genie provider.
3. Choose the options in the table. Each change is saved at once.

Setting	Choices
Scanning	Scan and block infected files, or Off.
When a file cannot be scanned	Reject the file (recommended): uploads stop while the scanner is down. Accept it unscanned: Genie stays usable, but unscanned files get in, and each one is recorded in the audit log as File could not be scanned for viruses.
Also scan files imported by data sources (SharePoint, Exchange and others)	Off by default. Turn it on to scan synced files before they are stored.

A file cannot be scanned when the scanner does not answer in time or the file is larger than the Largest file scanned shown on the card. The card also shows the Smart AntiVirus version, the Signature database and Signatures from (check that this date is recent), the number of files scanned, infected and failed, and the Recent scan errors.

What people see when a file is rejected

An infected file is never stored. The person who uploaded it sees a message in their language, for example: "The file "invoice.pdf" was rejected: the virus scanner found Win.Test.EICAR_HDB-1." Genie records Infected file rejected in the system audit log and in the workspace's audit log, with the file name, the virus found and who uploaded it.

Situation	What the person sees
The file is infected	The message above. The file is not stored.
The scanner is down and the policy rejects such files	"The file could not be checked for viruses, so it was not accepted. Try again in a few minutes or contact your administrator."
The file is larger than the scan limit	"The file is larger than the virus scan limit (… MB), so it was not accepted."
A file sent to Genie in Teams or another chat channel is rejected	Genie replies in the chat with the same reason.
A data source imports an infected file	The file is not imported, the sync ends as Partial and the file is listed under Failed documents in the sync history.

To check that scanning works, upload the EICAR test file (a harmless file published on eicar.org that every scanner reports as a virus) to a test knowledge base. Genie should reject it, and the audit log should show Infected file rejected. Your computer's own antivirus may delete the file as soon as you save it.

Good to know

• Network and antivirus settings apply to every Genie server within seconds.
• The lists check the address Genie sees. Behind a company firewall, everyone in an office usually shares one public address, so you allow the office, not individual computers.
• If your offices or VPN use IPv6, add their IPv6 ranges too.
• A workspace list never affects System administration: only the platform list does.
• No list stops chat channels, the website widget or data source webhooks. They have their own controls: the widget's allowed sites and the webhook's Allowed addresses.
• Documents that Genie downloads itself when importing from a web address are not scanned.
• To change the scan size limit or the scan timeout, ask your Genie provider.

Related pages

• System administration
• Members and sign-in
• Data sources
• Web search settings
• Sandbox and skills
• Usage, analytics and audit