You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-desktop/required-fqdn-endpoint.md
+55-58Lines changed: 55 additions & 58 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,19 +4,29 @@ description: A list of FQDNs and endpoints you must allow, ensuring your Azure V
4
4
ms.topic: conceptual
5
5
author: dknappettmsft
6
6
ms.author: daknappe
7
-
ms.date: 10/29/2024
7
+
ms.date: 11/21/2024
8
8
---
9
9
10
10
# Required FQDNs and endpoints for Azure Virtual Desktop
11
11
12
12
In order to deploy Azure Virtual Desktop and for your users to connect, you must allow specific FQDNs and endpoints. Users also need to be able to connect to certain FQDNs and endpoints to access their Azure Virtual Desktop resources. This article lists the required FQDNs and endpoints you need to allow for your session hosts and users.
13
13
14
-
These FQDNs and endpoints could be blocked if you're using a firewall, such as [Azure Firewall](../firewall/protect-azure-virtual-desktop.md), or proxy service. For guidance on using a proxy service with Azure Virtual Desktop, see [Proxy service guidelines for Azure Virtual Desktop](proxy-server-support.md). This article doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID, Office 365, custom DNS providers or time services. Microsoft Entra FQDNs and endpoints can be found under ID *56*, *59* and *125* in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
14
+
These FQDNs and endpoints could be blocked if you're using a firewall, such as [Azure Firewall](../firewall/protect-azure-virtual-desktop.md), or proxy service. For guidance on using a proxy service with Azure Virtual Desktop, see [Proxy service guidelines for Azure Virtual Desktop](proxy-server-support.md).
15
15
16
16
You can check that your session host VMs can connect to these FQDNs and endpoints by following the steps to run the *Azure Virtual Desktop Agent URL Tool* in [Check access to required FQDNs and endpoints for Azure Virtual Desktop](check-access-validate-required-fqdn-endpoint.md). The Azure Virtual Desktop Agent URL Tool validates each FQDN and endpoint and show whether your session hosts can access them.
17
17
18
18
> [!IMPORTANT]
19
-
> Microsoft doesn't support Azure Virtual Desktop deployments where the FQDNs and endpoints listed in this article are blocked.
19
+
> - Microsoft doesn't support Azure Virtual Desktop deployments where the FQDNs and endpoints listed in this article are blocked.
20
+
>
21
+
> - This article doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID, Office 365, custom DNS providers or time services. Microsoft Entra FQDNs and endpoints can be found under ID *56*, *59* and *125* in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
22
+
23
+
## Service tags and FQDN tags
24
+
25
+
[Service tags](../virtual-network/service-tags-overview.md) represent groups of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules. Service tags can be used in rules for [Network Security Groups](../virtual-network/network-security-groups-overview.md) (NSGs) and [Azure Firewall](../firewall/service-tags.md) to restrict outbound network access. Service tags can be also used in [User Defined Routes](../virtual-network/virtual-networks-udr-overview.md#user-defined) (UDRs) to customize traffic routing behavior.
26
+
27
+
Azure Firewall also supports [FQDN tags](../firewall/fqdn-tags.md), which represent a group of fully qualified domain names (FQDNs) associated with well known Azure and other Microsoft services. Azure Virtual Desktop doesn't have a list of IP address ranges that you can unblock instead of FQDNs to allow network traffic. If you're using a Next Generation Firewall (NGFW), you need to use a dynamic list made for Azure IP addresses to make sure you can connect. For more information, see [Use Azure Firewall to protect Azure Virtual Desktop deployments](../firewall/protect-azure-virtual-desktop.md).
28
+
29
+
Azure Virtual Desktop has both a service tag and FQDN tag entry available. We recommend you use service tags and FQDN tags to simplify your Azure network configuration.
20
30
21
31
## Session host virtual machines
22
32
@@ -26,45 +36,44 @@ The following table is the list of FQDNs and endpoints your session host VMs nee
26
36
27
37
| Address | Protocol | Outbound port | Purpose | Service tag |
28
38
|--|--|--|--|--|
29
-
|`login.microsoftonline.com`| TCP | 443 | Authentication to Microsoft Online Services |
30
-
|`*.wvd.microsoft.com`| TCP | 443 | Service traffic | WindowsVirtualDesktop |
This list doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID, Office 365, custom DNS providers or time services. Microsoft Entra FQDNs and endpoints can be found under ID *56*, *59* and *125* in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
88
-
89
96
> [!TIP]
90
-
> You must use the wildcard character (\*) for FQDNs involving *service traffic*. For *agent traffic*, if you prefer not to use a wildcard, here's how to find specific FQDNs to allow:
97
+
> You must use the wildcard character (\*) for FQDNs involving **service traffic**.
91
98
>
92
-
> 1. Ensure your session host virtual machines are registered to a host pool.
99
+
> For **agent traffic**, if you prefer not to use a wildcard, here's how to find specific FQDNs to allow:
100
+
>
101
+
> 1. Ensure your session hosts are registered to a host pool.
93
102
> 1. On a session host, open **Event viewer**, then go to **Windows logs** > **Application** > **WVD-Agent** and look for event ID **3701**.
94
-
> 1. Unblock the FQDNs that you find under event ID 3701. The FQDNs under event ID 3701 are region-specific. You'll need to repeat this process with the relevant FQDNs for each Azure region you want to deploy your session host virtual machines in.
95
-
96
-
### Service tags and FQDN tags
97
-
98
-
A [virtual network service tag](../virtual-network/service-tags-overview.md) represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules. Service tags can be used in both Network Security Group ([NSG](../virtual-network/network-security-groups-overview.md)) and [Azure Firewall](../firewall/service-tags.md) rules to restrict outbound network access. Service tags can be also used in User Defined Route ([UDR](../virtual-network/virtual-networks-udr-overview.md#user-defined)) to customize traffic routing behavior.
99
-
100
-
Azure Firewall supports Azure Virtual Desktop as a [FQDN tag](../firewall/fqdn-tags.md). For more information, see [Use Azure Firewall to protect Azure Virtual Desktop deployments](../firewall/protect-azure-virtual-desktop.md).
101
-
102
-
We recommend you use FQDN tags or service tags to simplify configuration. The listed FQDNs and endpoints and tags only correspond to Azure Virtual Desktop sites and resources. They don't include FQDNs and endpoints for other services such as Microsoft Entra ID. For service tags for other services, see [Available service tags](../virtual-network/service-tags-overview.md#available-service-tags).
103
-
104
-
Azure Virtual Desktop doesn't have a list of IP address ranges that you can unblock instead of FQDNs to allow network traffic. If you're using a Next Generation Firewall (NGFW), you need to use a dynamic list made for Azure IP addresses to make sure you can connect.
103
+
> 1. Unblock the FQDNs that you find under event ID 3701. The FQDNs under event ID 3701 are region-specific. You need to repeat this process with the relevant FQDNs for each Azure region you want to deploy your session hosts in.
105
104
106
105
## End user devices
107
106
108
-
Any device on which you use one of the [Remote Desktop clients](users/connect-windows.md?toc=/azure/virtual-desktop/toc.json&bc=/azure/virtual-desktop/breadcrumb/toc.json) to connect to Azure Virtual Desktop must have access to the following FQDNs and endpoints. Allowing these FQDNs and endpoints is essential for a reliable client experience. Blocking access to these FQDNs and endpoints is unsupported and affects service functionality.
107
+
Any device on which you use one of the [Remote Desktop clients](users/connect-windows.md?toc=/azure/virtual-desktop/toc.json&bc=/azure/virtual-desktop/breadcrumb/toc.json) to connect to Azure Virtual Desktop must have access to the following FQDNs and endpoints. Allowing these FQDNs and endpoints is essential for a reliable client experience. Blocking access to these FQDNs and endpoints isn't supported and affects service functionality.
109
108
110
109
Select the relevant tab based on which cloud you're using.
111
110
@@ -120,7 +119,7 @@ Select the relevant tab based on which cloud you're using.
120
119
|`aka.ms`| TCP | 443 | Microsoft URL shortener | All |
121
120
|`learn.microsoft.com`| TCP | 443 | Documentation | All |
122
121
|`privacy.microsoft.com`| TCP | 443 | Privacy statement | All |
123
-
|`query.prod.cms.rt.microsoft.com`| TCP | 443 |Download an MSI or MSIX package to update the client. Required for automatic updates.|[Windows Desktop](users/connect-windows.md)|
|`graph.microsoft.com`| TCP | 443 | Service traffic | All |
125
124
|`windows.cloud.microsoft`| TCP | 443 | Connection center | All |
126
125
|`windows365.microsoft.com`| TCP | 443 | Service traffic | All |
@@ -137,17 +136,15 @@ Select the relevant tab based on which cloud you're using.
137
136
|`aka.ms`| TCP | 443 | Microsoft URL shortener | All |
138
137
|`learn.microsoft.com`| TCP | 443 | Documentation | All |
139
138
|`privacy.microsoft.com`| TCP | 443 | Privacy statement | All |
140
-
|`query.prod.cms.rt.microsoft.com`| TCP | 443 |Download an MSI or MSIX package to update the client. Required for automatic updates.|[Windows Desktop](users/connect-windows.md)|
|`graph.microsoft.com`| TCP | 443 | Service traffic | All |
142
141
|`windows.cloud.microsoft`| TCP | 443 | Connection center | All |
143
142
|`windows365.microsoft.com`| TCP | 443 | Service traffic | All |
144
143
|`ecs.office.com`| TCP | 443 | Connection center | All |
145
144
146
145
---
147
146
148
-
These FQDNs and endpoints only correspond to client sites and resources. This list doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID or Office 365. Microsoft Entra FQDNs and endpoints can be found under ID *56*, *59* and *125* in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
149
-
150
-
If you're on a closed network with restricted internet access, you may also need to allow the FQDNs listed here for certificate checks: [Azure Certificate Authority details | Microsoft Learn](../security/fundamentals/azure-CA-details.md#certificate-downloads-and-revocation-lists).
147
+
If you're on a closed network with restricted internet access, you might also need to allow the FQDNs listed here for certificate checks: [Azure Certificate Authority details | Microsoft Learn](../security/fundamentals/azure-CA-details.md#certificate-downloads-and-revocation-lists).
0 commit comments