How to Setup IP Allowlisting When Accessing UiPath Automation Cloud Through a Menlo Security Proxy?

News Knowledge Base
1

Why do UiPath Robots and Studio require per-machine IP allowlisting when accessing UiPath Automation Cloud through a Menlo Security proxy?

Context

In enterprise environments, customers often route outbound internet traffic through a centralized proxy server to avoid allowlisting every individual machine. When using standard forward proxies (e.g., Zscaler, Netskope, Blue Coat, Palo Alto, Squid), this works as expected with UiPath Robot and Studio — only the proxy server needs to allowlist UiPath SaaS URLs (*.uipath.com), with no per-machine configuration required.

However, customers using Menlo Security as their proxy solution may encounter the following:

  1. UiPath Robots and Studio are unable to connect to UiPath Automation Cloud unless each individual Robot/Studio machine IP is explicitly allowlisted.
  2. The centralized proxy approach does not eliminate per-machine allowlisting as it would with a standard forward proxy.
  3. The issue appears specific to UiPath traffic — browser-based access through Menlo continues to work normally.

Resolution / Workaround

Route UiPath Robot and Studio traffic around Menlo and through one of the following alternatives:

  1. Standard enterprise forward proxy (recommended): Configure Robot and Studio machines to use a conventional forward proxy (e.g., Zscaler, Netskope, Squid, or equivalent). Only the proxy server needs to allowlist UiPath SaaS URLs — no per-machine allowlisting is required.
  2. Direct firewall exception: If permitted by the customer's security policy, allow outbound HTTPS traffic to *.uipath.com directly through the firewall for Robot/Studio machines, bypassing the proxy entirely.

Once Robot/Studio traffic bypasses Menlo, per-machine IP allowlisting is no longer necessary.

Note: This is not an issue with UiPath software. UiPath Engineering cannot make changes to resolve Menlo compatibility, as UiPath already operates correctly with all standard forward proxy solutions.

Prevention

This situation arises when:

  1. The customer's network routes all outbound traffic through Menlo Security by default.
  2. No exception or bypass rule exists for non-browser clients such as Windows services or automation agents.

Recommendations for customers using Menlo Security:

  • Define a network traffic policy that separates browser (user-driven) traffic from machine/service traffic.
  • Route UiPath Robot and Studio traffic through a standard forward proxy or direct firewall rule, keeping Menlo exclusively for interactive browser sessions.
  • Review Menlo's own documentation regarding supported traffic types before deploying it as a general-purpose proxy for enterprise automation workloads.