You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/dev-box/concept-dev-box-network-requirements.md
+22-26Lines changed: 22 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -79,18 +79,32 @@ Although most of the configuration is for the cloud-based dev box network, end u
79
79
|Azure Virtual Desktop session host virtual machine |[Link](/azure/virtual-desktop/safe-url-list?tabs=azure#session-host-virtual-machines)|Remote connectivity between dev boxes and the backend Azure Virtual Desktop service.|
80
80
|Windows 365 service |[Link](/windows-365/enterprise/requirements-network?tabs=enterprise%2Cent#windows-365-service)|Provisioning and health checks.|
81
81
82
+
Any device you use to connect to a dev box must have access to the following FQDNs and endpoints. Allowing these FQDNs and endpoints is essential for a reliable client experience. Blocking access to these FQDNs and endpoints is unsupported and affects service functionality.
83
+
84
+
|Address |Protocol |Outbound port |Purpose |Clients |
85
+
|---|---|---|---|---|
86
+
|login.microsoftonline.com |TCP |443 |Authentication to Microsoft Online Services |All |
|query.prod.cms.rt.microsoft.com |TCP |443 |Download an MSI to update the client. Required for automatic updates. |Windows Desktop |
94
+
95
+
These FQDNs and endpoints only correspond to client sites and resources.
96
+
82
97
## Required endpoints
83
98
84
99
The following URLs and ports are required for the provisioning of dev boxes and the Azure Network Connection (ANC) health checks. All endpoints connect over port 443 unless otherwise specified.
85
100
86
-
| Category | Endpoints | FQDN tag or Service tag | More information |
|**Windows 365 Registration endpoints**| For current W365 registration endpoints, see [Windows 365 service](/windows-365/enterprise/requirements-network?tabs=enterprise%2Cent)|
91
-
|**Azure Virtual Desktop service endpoints**| For current AVD service endpoints, see [Session host virtual machines](/azure/virtual-desktop/required-fqdn-endpoint?tabs=azure#session-host-virtual-machines)| FQDN tags: *WindowsVirtualDesktop*, *AzureMonitor*, *AzureFrontDoor.Frontend*, *AzureCloud*, *Internet*||
92
-
|**Microsoft Entra ID**| FQDNs and endpoints for Microsoft Entra ID can be found under ID 56, 59 and 125 in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online). | Service tag: *AzureActiveDirectory*|[Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online)|
93
-
|**Microsoft Intune**| For current FQDNs and endpoints for Microsoft Entra ID, see [Intune core service](/mem/intune/fundamentals/intune-endpoints?tabs=north-america#endpoints)| FQDN tag: *MicrosoftIntune*|[Intune endpoints](/mem/intune/fundamentals/intune-endpoints)|
101
+
| Category | Endpoints | FQDN tag or Service tag |
|**Dev box communication endpoints**|*.agentmanagement.dc.azure.com<br>*.cmdagent.trafficmanager.net | N/A |
104
+
|**Windows 365 service and registration endpoints**| For current Windows 365 registration endpoints, see [Windows 365 network requirements](/windows-365/enterprise/requirements-network?tabs=enterprise%2Cent#windows-365-service). | FQDN tag: *Windows365*|
105
+
|**Azure Virtual Desktop service endpoints**| For current AVD service endpoints, see [Session host virtual machines](/azure/virtual-desktop/required-fqdn-endpoint?tabs=azure#session-host-virtual-machines). | FQDN tags: *WindowsVirtualDesktop*, *AzureMonitor*, *AzureFrontDoor.Frontend*, *AzureCloud*, *Internet*|
106
+
|**Microsoft Entra ID**| FQDNs and endpoints for Microsoft Entra ID can be found under ID 56, 59 and 125 in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online). | Service tag: *AzureActiveDirectory*|
107
+
|**Microsoft Intune**| For current FQDNs and endpoints for Microsoft Entra ID, see [Intune core service](/mem/intune/fundamentals/intune-endpoints?tabs=north-america#intune-core-service).| FQDN tag: *MicrosoftIntune*|
94
108
95
109
The listed FQDNs and endpoints and tags only correspond to the most common resources. They don't include FQDNs and endpoints for all services. For service tags for other services, see [Available service tags](/azure/virtual-network/service-tags-overview#available-service-tags).
96
110
@@ -125,7 +139,6 @@ Configure your Azure Virtual Network where the dev boxes are provisioned as foll
125
139
> Adding at least two DNS servers, as you would with a physical PC, helps mitigate the risk of a single point of failure in name resolution.
126
140
For more information, see configuring [Azure Virtual Networks settings](/azure/virtual-network/manage-virtual-network#change-dns-servers).
127
141
128
-
129
142
## Connecting to on-premises resources
130
143
131
144
You can allow dev boxes to connect to on-premises resources through a hybrid connection. Work with your Azure network expert to implement a [hub and spoke networking topology](/azure/cloud-adoption-framework/ready/azure-best-practices/hub-spoke-network-topology). The hub is the central point that connects to your on-premises network; you can use an Express Route, a site-to-site VPN, or a point-to-site VPN. The spoke is the virtual network that contains the dev boxes. Hub and spoke topology can help you manage network traffic and security. You peer the dev box virtual network to the on-premises connected virtual network to provide access to on-premises resources.
@@ -136,23 +149,6 @@ Some enterprise customers use traffic interception, TLS decryption, deep packet
136
149
137
150
Traffic interception technologies can exacerbate latency issues. You can use a [Remote Desktop Protocol (RDP) Shortpath](/windows-365/enterprise/rdp-shortpath-public-networks) to help minimize latency issues.
138
151
139
-
## End user devices
140
-
141
-
Any device on which you use one of the Remote Desktop clients to connect to Azure Virtual Desktop must have access to the following FQDNs and endpoints. Allowing these FQDNs and endpoints is essential for a reliable client experience. Blocking access to these FQDNs and endpoints is unsupported and affects service functionality.
142
-
143
-
|Address |Protocol |Outbound port |Purpose |Clients |
144
-
|---|---|---|---|---|
145
-
|login.microsoftonline.com |TCP |443 |Authentication to Microsoft Online Services |All |
|query.prod.cms.rt.microsoft.com |TCP |443 |Download an MSI to update the client. Required for automatic updates. |Windows Desktop |
153
-
154
-
These FQDNs and endpoints only correspond to client sites and resources. This list doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID or Office 365. Microsoft Entra FQDNs and endpoints can be found under ID 56, 59 and 125 in Office 365 URLs and IP address ranges.
155
-
156
152
## Troubleshooting
157
153
158
154
This section covers some common connection and network issues.
0 commit comments