You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If your organization is secured with a firewall or proxy server, you must add certain internet protocol (IP) addresses and domain uniform resource locators (URLs) to the **allowlist**. Adding these IPs and URLs to the allowlist helps to ensure that you have the best experience with Azure DevOps. You know that you need to update your allowlist if you can't access Azure DevOps on your network. See the following sections in this article:
18
+
If your organization is secured with a firewall or proxy server, you must add certain internet protocol (IP) addresses and domain uniform resource locators (URLs) to the **allowlist**. Adding these IPs and URLs to the allowlist helps to ensure that you have the best experience with Azure DevOps. You know that you need to update your allowlist if you can't access Azure DevOps on your network.
19
+
20
+
**Required ports:**
21
+
-**Port 443 (HTTPS)**: Required for all Azure DevOps web access, REST API calls, and most service connections
22
+
-**Port 22 (SSH)**: Required only for Git operations using SSH protocol
23
+
24
+
See the following sections in this article:
19
25
20
26
-[Allowed domain URLs](#allowed-domain-urls)
21
27
-[IP addresses and range restrictions](#ip-addresses-and-range-restrictions)
@@ -37,7 +43,7 @@ _Outbound connections_ target other dependent sites. Examples of such connection
37
43
- Azure Pipelines agents installed on your organization's network connecting to Azure DevOps to poll for pending jobs
38
44
- CI events sent from a source code repository hosted within your organization's network to Azure DevOps
39
45
40
-
Ensure the following IP addresses are allowed for outbound connections, so your organization works with any existing firewall or IP restrictions. The endpoint data in the following chart lists requirements for connectivity from a machine in your organization to Azure DevOps Services.
46
+
Ensure the following IP addresses are allowed for outbound connections on **port 443 (HTTPS)**, so your organization works with any existing firewall or IP restrictions. The endpoint data in the following chart lists requirements for connectivity from a machine in your organization to Azure DevOps Services.
41
47
42
48
#### [IP V4 ranges](#tab/IP-V4)
43
49
@@ -86,7 +92,7 @@ _Inbound connections_ originate from Azure DevOps and target resources within yo
86
92
- Azure Pipelines connecting to on-premises source code repositories such as [GitHub Enterprise](../../pipelines/repos/github-enterprise.md) or [Bitbucket Server](../../pipelines/repos/on-premises-bitbucket.md)
87
93
- Azure DevOps Services [Audit Streaming](../audit/auditing-streaming.md) connecting to on-premises or cloud-based Splunk
88
94
89
-
Ensure the following IP addresses are allowed for inbound connections, so your organization works with any existing firewall or IP restrictions. The endpoint data in the following chart lists requirements for connectivity from Azure DevOps Services to your on-premises or other cloud services.
95
+
Ensure the following IP addresses are allowed for inbound connections on **port 443 (HTTPS)**, so your organization works with any existing firewall or IP restrictions. The endpoint data in the following chart lists requirements for connectivity from Azure DevOps Services to your on-premises or other cloud services.
90
96
91
97
> [!div class="mx-tdCol2BreakAll"]
92
98
> | Geography | Region | IP V4 ranges |
@@ -114,7 +120,7 @@ Ensure the following IP addresses are allowed for inbound connections, so your o
114
120
Azure Service Tags are supported only for *inbound* connections. Instead of allowing the previously listed IP ranges, you may use the **AzureDevOps** service tag for Azure Firewall and Network Security Group (NSG) or on-premises firewall via a JSON file download.
115
121
116
122
> [!NOTE]
117
-
> The Service Tag or previously mentioned inbound IP addresses don't apply to Microsoft Hosted agents. Customers are still required to allow the [entire geography for the Microsoft Hosted agents](../../pipelines/agents/hosted.md#agent-ip-ranges). If allowing the entire geography is a concern, we recommend using the [Microsoft Managed DevOps Pools](../../managed-devops-pools/overview.md). Alternatively, you can also use [Azure Virtual Machine Scale Set agents](../../pipelines/agents/scale-set-agents.md). Managed DevOps Pools and Scale Set agents are a form of self-hosted agents that can be auto-scaled to meet your demands.
123
+
> The Service Tag or previously mentioned inbound IP addresses don't apply to Microsoft Hosted agents. Customers are still required to allow the [entire geography for the Microsoft Hosted agents](../../pipelines/agents/hosted.md#agent-ip-ranges). If allowing the entire geography is a concern, we recommend using the [Microsoft Managed DevOps Pools](../../managed-devops-pools/overview.md). Alternatively, you can also use [Azure Virtual Machine Scale Set agents](../../pipelines/agents/scale-set-agents.md). Managed DevOps Pools and Scale Set agents are a form of self-hosted agents that can be auto-scaled to meet your demands.
118
124
Hosted macOS agents are hosted in GitHub's macOS cloud. IP ranges can be retrieved using the [GitHub metadata API](https://docs.github.com/en/rest/reference/meta#get-github-meta-information) using the instructions provided [here](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#ip-addresses).
119
125
120
126
### Other IP addresses
@@ -138,7 +144,7 @@ For more information, see [Worldwide endpoints](/microsoft-365/enterprise/urls-a
138
144
139
145
### Azure DevOps ExpressRoute connections
140
146
141
-
If your organization uses ExpressRoute, ensure the following IP addresses are allowed for both outbound and inbound connections.
147
+
If your organization uses ExpressRoute, ensure the following IP addresses are allowed for both outbound and inbound connections on **port 443 (HTTPS)**.
142
148
143
149
#### [IP V4 ranges](#tab/IP-V4)
144
150
@@ -216,9 +222,13 @@ For more information about Azure DevOps and ExpressRoute, see [ExpressRoute for
216
222
217
223
## Allowed Domain URLs
218
224
219
-
Network connection issues could occur because of your security appliances, which may be blocking connections - Visual Studio uses TLS 1.2 and above. When you're using [NuGet](#nuget-connections) or connecting from Visual Studio 2015 and later, update the security appliances to support TLS 1.2 and above for the following connections.
225
+
Network connection issues could occur because of your security appliances, which might be blocking connections - Visual Studio uses TLS 1.2 and above. When you're using [NuGet](#nuget-connections) or connecting from Visual Studio 2015 and later, update the security appliances to support TLS 1.2 and above for the following connections.
226
+
227
+
**Port requirements for domain URLs:**
228
+
-**Port 443 (HTTPS)**: Required for all domain URLs listed in this article
229
+
-**Port 22 (SSH)**: Required only for SSH Git connections (see [SSH connections](#ssh-connections) section)
220
230
221
-
To ensure your organization works with any existing firewall or IP restrictions, ensure that `dev.azure.com` and `*.dev.azure.com` are open.
231
+
To ensure your organization works with any existing firewall or IP restrictions, ensure that `dev.azure.com` and `*.dev.azure.com` are open on **port 443**.
222
232
223
233
The following section includes the most common domain URLs to support sign in and licensing connections.
224
234
@@ -275,7 +285,7 @@ https://live.com
275
285
https://login.live.com
276
286
```
277
287
278
-
The following URL is required if you're migrating from Azure DevOps server to the cloud service using our data migration tool.
288
+
The following URL is required if you're migrating from Azure DevOps Server to the cloud service using our data migration tool.
We recommend you open port `443` to all traffic on the following IP addresses and domains. We also recommend you open port `22` to a smaller subset of targeted IP addresses.
292
302
293
-
|More domain URLs |Descriptions |
294
-
|---------|---------|
295
-
|https://login.microsoftonline.com |Authentication and sign-in related |
296
-
|https://*.vssps.visualstudio.com |Authentication and sign-in related |
|https://download.agent.dev.azure.com | Required to set up self-hosted agent in machines within your network |443 |
317
+
|https://amp.azure.net | Needed for deploying to Azure app service |443 |
318
+
|https://go.microsoft.com | Accesses go links |443 |
305
319
306
320
### Azure Artifacts
307
321
@@ -329,15 +343,15 @@ https://*.nuget.org
329
343
330
344
### SSH connections
331
345
332
-
If you need to connect to Git repositories on Azure DevOps with SSH, allow requests to port 22 for the following hosts:
346
+
If you need to connect to Git repositories on Azure DevOps with SSH, allow requests to **port 22** for the following hosts:
333
347
334
348
```SSHDomainHosts
335
349
336
350
ssh.dev.azure.com
337
351
vs-ssh.visualstudio.com
338
352
```
339
353
340
-
Also allow IP addresses in the "name": "AzureDevOps" section of [this downloadable file](https://www.microsoft.com/download/details.aspx?id=56519) (updated weekly) named: **Azure IP ranges and Service Tags - Public Cloud**
354
+
Also allow **port 22** for IP addresses in the "name": "AzureDevOps" section of [this downloadable file](https://www.microsoft.com/download/details.aspx?id=56519) (updated weekly) named: **Azure IP ranges and Service Tags - Public Cloud**
341
355
342
356
### Azure Pipelines Microsoft-hosted agents
343
357
@@ -351,9 +365,9 @@ If you're running a firewall and your code is in Azure Repos, see [Self-hosted L
351
365
352
366
> [!IMPORTANT]
353
367
> [Edgio CDN for Azure DevOps was retired](https://devblogs.microsoft.com/devops/important-switching-cdn-providers/), which required a new domain URL to be allow-listed in firewall rules for agent software download.
354
-
> The new domain to allow-list for agent download is `https://*.dev.azure.com`. If your firewall rules don't allow wildcards, use `https://download.agent.dev.azure.com`.
368
+
> The new domain to allowlist for agent download is `https://*.dev.azure.com`. If your firewall rules don't allow wildcards, use `https://download.agent.dev.azure.com`.
355
369
>
356
-
> The Azure DevOps team recommends to make this change by the following date:
370
+
> The Azure DevOps team recommended making this change by the following date:
0 commit comments