Create sandboxes

In Azure Logic Apps Automation, create a sandbox as an isolated compute environment where agents can run code in workflows.

Requirements

A Microsoft work or school account in the same Microsoft Entra tenant as the environment creator-owner.

Your account must exist in the same tenant so the environment creator-owner can add you to the environment. You don’t need an Azure subscription to create apps and workflows in an automation environment.
Access to the Azure Logic Apps Automation portal.
Access to your automation environment.
Contributor or Author role on the environment resource to create sandboxes.

The environment Reader role doesn’t have enough permissions to create sandboxes.

If you don’t have environment access, contact the environment creator-owner so they can add you with the required permissions.
An app in your environment.
A workflow in your app and a coding agent in the workflow.

Just-in-time sandbox

This sandbox provides the fastest and easiest way for you to try running code in an isolated environment.

In the Azure Logic Apps Automation portal, open your environment, app, and workflow.
On the workflow designer, select the coding agent action.
In the action information window, select the Agent harness tab.
Under Execution environment, for Harness type, select GHCP (GitHub Copilot) as the harness runtime to use for agent execution.

GHCP (GitHub Copilot) is the default harness and the only available option at this time.
Under Sandbox configuration, for Sandbox, keep the default base image.

To create and use your own sandbox, see Prebuilt sandbox.
To optionally add files from upstream actions for the agent to process, follow these steps:
1. In the coding agent information window, select the Parameters tab.
2. In the Input files section, select Add item.
3. For Name, enter a name for the item.
4. For Content, enter an expression that gets the body output from an upstream action in your workflow.
  
  For example, the following expression gets the output from an action named Get blob:
  
  @{body('Get_blob')}
When you finish, close the action information window.

When the workflow runs again, the agent runs code inside the sandbox.

Prebuilt sandbox

When your agent needs to work with your code repositories, set up a prebuilt disk image that includes your cloned repositories and installed skills. You can then use this sandbox to set up your agent harness. Subsequent workflow runs spin up instances from this image to reduce cold starts.

1. Create the sandbox

In the Azure Logic Apps Automation portal, open your environment.
On the environment sidebar, select Sandboxes, and then select Create.

In the sandbox setup window, provide the following information:

Property	Description
Name	The name for the sandbox. Use only lowercase letters, numbers, and hyphens. Workflows reference this sandbox name.
Resource tier	The compute capacity and resources for the sandbox.
Repositories	For each repository, provide the following information: - URL: The HTTPS URL for the Azure DevOps or GitHub repository. - Branch: The branch to clone. - Auth type: The required authentication.

The following table shows the authentication that sandboxes support:

Authentication	Azure DevOps	GitHub
Managed identity	Yes, give repository read access to the environment’s managed identity	No
Personal access token (PAT)	Yes	Yes
OAuth	No	Yes

If you specified a GitHub URL and chose OAuth for authentication, follow these steps:
1. In the sandbox setup window, select Connect GitHub.
2. In the GitHub authorization window that opens, select Authorize.
To add another repository to the sandbox, select Add repo.
When you finish, select Create.

The portal starts to build the sandbox, which shows the State property set to Building. The first build might take a few minutes to finish. Larger repositories can take longer.

When the build completes, the State property changes from Building to Ready.

2. Set up the agent with your sandbox

In your environment, open your app and your workflow.
On the workflow designer, select the coding agent action.
In the action information window, select the Agent harness tab.
Under Execution environment, for Harness type, select GHCP (GitHub Copilot) as the harness runtime to use for agent execution.

GHCP (GitHub Copilot) is the default harness and the only available option at this time.
Under Sandbox configuration, select the sandbox you created in your environment.

After you select your sandbox, the Repository skills section appears. If your repository has skills for your agent to use, specify those skill paths in this section.
To optionally point your agent at skills in your repository, provide the following information:

Property Description
Repository The repository name.
Skills folder path The path to the skills folder.
When you finish, close the action information window.

When the workflow runs again, the agent runs code inside the sandbox.

Property	Description
Repository	The repository name.
Skills folder path	The path to the skills folder.

Troubleshoot problems

Problem	Try
The agent action doesn’t show the agent harness tab.	Make sure you selected a coding agent, not a different action.
Sandbox state is stuck at `Building...`	Refresh the sandbox list. If the status for a small repository still says `Building...` for more than 10 minutes, check the repo URL and credentials.
Sandbox state shows `Failed`	Open the error message details for more information. Common causes: bad URL, expired PAT, managed identity needs read access.
Agent doesn’t use your added input files.	Confirm that the file uses `.txt` or `.md` in private preview, and that the `contentType` is set in the code view if needed.
GitHub OAuth dialog never finishes	Open the dialog again, confirm you allowed access at the account level, and that the repo belongs to that account.