You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/dev-box/concept-dev-box-network-requirements.md
+57-54Lines changed: 57 additions & 54 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,32 +5,35 @@ services: dev-box
5
5
ms.service: dev-box
6
6
author: RoseHJM
7
7
ms.author: rosemalcolm
8
-
ms.topic: concept
9
-
ms.date: 02/16/2023
8
+
ms.topic: concept-article
9
+
ms.date: 05/29/2024
10
10
ms.custom: template-concept
11
+
11
12
#Customer intent: As a platform engineer, I want to understand Dev Box networking requirements so that developers can access the resources they need.
12
13
---
13
14
14
15
# Microsoft Dev Box networking requirements
15
16
16
-
Microsoft Dev Box is a service that lets users connect to a cloud-based workstation running in Azure through the internet, from any device anywhere. To support these internet connections, you must follow the networking requirements listed in this article. You should work with your organization’s networking team and security team to plan and implement network access for dev boxes.
17
+
Microsoft Dev Box is a service that lets users connect to a cloud-based workstation running in Azure through the internet, from any device anywhere. To support these internet connections, you must follow the networking requirements listed in this article. You should work with your organization's networking team and security team to plan and implement network access for dev boxes.
18
+
17
19
Microsoft Dev box is closely related to the Windows 365 and Azure Virtual Desktop services, and in many cases network requirements are the same.
18
20
19
21
## General network requirements
22
+
20
23
Dev boxes require a network connection to access resources. You can choose between a Microsoft-hosted network connection, and an Azure network connection that you create in your own subscription. Choosing a method for allowing access to your network resources depends on where your resources are based.
21
24
22
25
When using a Microsoft-hosted connection:
23
-
-Microsoft provides and fully manages the infrastructure.
24
-
-You can manage dev box security from Microsoft Intune.
26
+
-Microsoft provides and fully manages the infrastructure.
27
+
-You can manage dev box security from Microsoft Intune.
25
28
26
29
To use your own network and provision [Microsoft Entra joined](/azure/dev-box/how-to-configure-network-connections?branch=main&tabs=AzureADJoin#review-types-of-active-directory-join) dev boxes, you must meet the following requirements:
27
-
-Azure virtual network: You must have a virtual network in your Azure subscription. The region you select for the virtual network is where Azure deploys the dev boxes.
28
-
-A subnet within the virtual network and available IP address space.
29
-
-Network bandwidth: See [Azure’s Network guidelines](/windows-server/remote/remote-desktop-services/network-guidance).
30
+
-Azure virtual network: You must have a virtual network in your Azure subscription. The region you select for the virtual network is where Azure deploys the dev boxes.
31
+
-A subnet within the virtual network and available IP address space.
32
+
-Network bandwidth: See [Azure's Network guidelines](/windows-server/remote/remote-desktop-services/network-guidance).
30
33
31
34
To use your own network and provision [Microsoft Entra hybrid joined](/azure/dev-box/how-to-configure-network-connections?branch=main&tabs=AzureADJoin#review-types-of-active-directory-join) dev boxes, you must meet the above requirements, and the following requirements:
32
-
-The Azure virtual network must be able to resolve Domain name Services (DNS) entries for your Active Directory Domain Services (AD DS) environment. To support this resolution, define your AD DS DNS servers as the DNS servers for the virtual network.
33
-
-The Azure virtual network must have network access to an enterprise domain controller, either in Azure or on-premises.
35
+
-The Azure virtual network must be able to resolve Domain Name Services (DNS) entries for your Active Directory Domain Services (AD DS) environment. To support this resolution, define your AD DS DNS servers as the DNS servers for the virtual network.
36
+
-The Azure virtual network must have network access to an enterprise domain controller, either in Azure or on-premises.
34
37
35
38
When connecting to resources on-premises through Microsoft Entra hybrid joins, work with your Azure network topology expert. Best practice is to implement a [hub-and-spoke network topology](/azure/cloud-adoption-framework/ready/azure-best-practices/hub-spoke-network-topology). The hub is the central point that connects to your on-premises network; you can use an Express Route, a site-to-site VPN, or a point-to-site VPN. The spoke is the virtual network that contains the dev boxes. You peer the dev box virtual network to the on-premises connected virtual network to provide access to on-premises resources. Hub and spoke topology can help you manage network traffic and security.
36
39
@@ -52,12 +55,12 @@ You can check that your dev boxes can connect to these FQDNs and endpoints by fo
52
55
53
56
Although most of the configuration is for the cloud-based dev box network, end user connectivity occurs from a physical device. Therefore, you must also follow the connectivity guidelines on the physical device network.
54
57
55
-
|Device or service|Network connectivity required URLs and ports|Description |
58
+
|Device or service|Network connectivity required URLs and ports|Description |
56
59
|---|---|---|
57
-
|Physical device|[Link](/azure/virtual-desktop/safe-url-list?tabs=azure#remote-desktop-clients)|Remote Desktop client connectivity and updates.|
58
-
|Microsoft Intune service|[Link](/mem/intune/fundamentals/intune-endpoints)|Intune cloud services like device management, application delivery, and endpoint analytics.|
59
-
|Azure Virtual Desktop session host virtual machine|[Link](/azure/virtual-desktop/safe-url-list?tabs=azure#session-host-virtual-machines)|Remote connectivity between dev boxes and the backend Azure Virtual Desktop service.|
60
-
|Windows 365 service|[Link](/windows-365/enterprise/requirements-network?tabs=enterprise%2Cent#windows-365-service)|Provisioning and health checks.|
60
+
|Physical device|[Link](/azure/virtual-desktop/safe-url-list?tabs=azure#remote-desktop-clients)|Remote Desktop client connectivity and updates.|
61
+
|Microsoft Intune service|[Link](/mem/intune/fundamentals/intune-endpoints)|Intune cloud services like device management, application delivery, and endpoint analytics.|
62
+
|Azure Virtual Desktop session host virtual machine|[Link](/azure/virtual-desktop/safe-url-list?tabs=azure#session-host-virtual-machines)|Remote connectivity between dev boxes and the backend Azure Virtual Desktop service.|
63
+
|Windows 365 service|[Link](/windows-365/enterprise/requirements-network?tabs=enterprise%2Cent#windows-365-service)|Provisioning and health checks.|
61
64
62
65
## Required endpoints
63
66
@@ -139,42 +142,42 @@ For more information, see [Use Azure Firewall to manage and secure Windows 365 e
139
142
140
143
The following table is the list of FQDNs and endpoints your dev boxes need to access. All entries are outbound; you don't need to open inbound ports for dev boxes.
This list doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID, Office 365, custom DNS providers, or time services. Microsoft Entra FQDNs and endpoints can be found under ID 56, 59 and 125 in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
172
175
173
176
> [!TIP]
174
177
> You must use the wildcard character (*) for FQDNs involving service traffic. For agent traffic, if you prefer not to use a wildcard, here's how to find specific FQDNs to allow:
175
-
> 1.Ensure your session host virtual machines are registered to a host pool.
176
-
> 2.On a session host, open **Event viewer**, then go to **Windows logs** > **Application** > **WVD-Agent** and look for event ID **3701**.
177
-
> 3.Unblock the FQDNs that you find under event ID 3701. The FQDNs under event ID 3701 are region-specific. You'll need to repeat this process with the relevant FQDNs for each Azure region you want to deploy your session host virtual machines in.
178
+
> 1.Ensure your session host virtual machines are registered to a host pool.
179
+
> 2.On a session host, open **Event viewer**, then go to **Windows logs** > **Application** > **WVD-Agent** and look for event ID **3701**.
180
+
> 3.Unblock the FQDNs that you find under event ID 3701. The FQDNs under event ID 3701 are region-specific. You'll need to repeat this process with the relevant FQDNs for each Azure region you want to deploy your session host virtual machines in.
178
181
179
182
## Remote Desktop Protocol (RDP) broker service endpoints
180
183
@@ -188,9 +191,9 @@ Changing the network routes of a dev box (at the network layer or at the dev box
188
191
As part of the Microsoft Entra hybrid join requirements, your dev boxes must be able to join on-premises Active Directory. Dev boxes must be able to resolve DNS records for your on-premises AD environment to join.
189
192
190
193
Configure your Azure Virtual Network where the dev boxes are provisioned as follows:
191
-
1.Make sure that your Azure Virtual Network has network connectivity to DNS servers that can resolve your Active Directory domain.
3.Enter the IP address of DNS servers that environment that can resolve your AD DS domain.
194
197
195
198
> [!TIP]
196
199
> Adding at least two DNS servers, as you would with a physical PC, helps mitigate the risk of a single point of failure in name resolution.
@@ -211,22 +214,22 @@ Traffic interception technologies can exacerbate latency issues. You can use a [
211
214
212
215
Any device on which you use one of the Remote Desktop clients to connect to Azure Virtual Desktop must have access to the following FQDNs and endpoints. Allowing these FQDNs and endpoints is essential for a reliable client experience. Blocking access to these FQDNs and endpoints is unsupported and affects service functionality.
213
216
214
-
|Address|Protocol|Outbound port|Purpose|Clients |
217
+
|Address|Protocol|Outbound port|Purpose|Clients |
215
218
|---|---|---|---|---|
216
-
|login.microsoftonline.com|TCP|443|Authentication to Microsoft Online Services|All |
|query.prod.cms.rt.microsoft.com|TCP|443|Download an MSI to update the client. Required for automatic updates.|Windows Desktop |
224
227
225
228
These FQDNs and endpoints only correspond to client sites and resources. This list doesn't include FQDNs and endpoints for other services such as Microsoft Entra ID or Office 365. Microsoft Entra FQDNs and endpoints can be found under ID 56, 59 and 125 in Office 365 URLs and IP address ranges.
0 commit comments