Add Copilot voice features to allowlist reference (#61893)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: sunbrye <sunbrye@github.com>

Author: 3 people

content/copilot/reference/copilot-allowlist-reference.md

@@ -44,6 +44,17 @@ Depending on the security policies and editors your organization uses, you may n
 
 Every user of the proxy server or firewall also needs to configure their own environment to connect to {% data variables.product.prodname_copilot_short %}. See [AUTOTITLE](/copilot/configuring-github-copilot/configuring-network-settings-for-github-copilot).
 
+## {% data variables.product.prodname_copilot_short %} voice features
+
+Voice features in {% data variables.copilot.copilot_cli %} and the {% data variables.copilot.github_copilot_app %} use Foundry Local to run a speech-to-text model on your machine. To query the model catalog and download models, these features make outbound requests to the following Azure domains. If you want to use voice features behind a firewall or proxy server, add these URLs to your allowlist:
+
+| Domain and/or URL                              | Purpose |
+|:-----------------------------------------------| :--------------------------------- |
+| `https://ai.azure.com`                         | Model catalog requests |
+| `https://api.catalog.azureml.ms`               | Detecting the optimal Azure region for model downloads |
+| `https://*.api.azureml.ms`                     | Regional model catalog endpoints |
+| `https://amlwlrt4*.blob.core.windows.net`[^7]  | Model downloads from regional Azure Blob Storage |
+
 ## {% data variables.copilot.copilot_cloud_agent %} recommended allowlist
 
 The {% data variables.copilot.copilot_cloud_agent %} includes a built-in firewall with a recommended allowlist that is enabled by default. The recommended allowlist allows access to:
@@ -402,3 +413,4 @@ The allowlist allows access to the following hosts:
 [^4]: Allows access to authorized users via a {% data variables.copilot.copilot_enterprise_short %} plan. Do not add this URL to your allowlist if you want to use subscription-based network routing to block users from using {% data variables.copilot.copilot_enterprise_short %} on your network.
 [^5]: Required for fallback scenarios where {% data variables.product.prodname_copilot_short %} usage metrics report downloads bypass the custom domain and are served from an Azure Front Door CDN.
 [^6]: Required for fallback scenarios where {% data variables.product.prodname_copilot_short %} usage metrics report downloads bypass the Azure Front Door CDN and are served directly from Azure Blob Storage.
+[^7]: The `amlwlrt4*` wildcard matches the regional Azure Blob Storage accounts that Foundry Local voice features use to download models. The specific storage account depends on the Azure region closest to the user.