Azure portal URL safelist
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-management-docs · commit 8498102 · +2 −61 lines · also on GitHub
11
---
22
title: Allow the Azure portal URLs on your firewall or proxy server
33
description: To optimize connectivity between your network and the Azure portal and its services, we recommend you add these URLs to your allowlist.
4
−ms.date: 01/27/2025
4
+ms.date: 04/21/2025
55
ms.topic: conceptual
66
---
77
⋯ 23 unchanged lines
3131
> The service tags required to access the Azure portal (including authentication and resource listing) are **AzureActiveDirectory**, **AzureResourceManager**, **AzureFrontDoor.Frontend**, and **AzureFrontDoor.FirstParty**. Access to other services may require additional permissions, as described below.
3232
> However, there is a possibility that unnecessary communication other than communication to access the portal may also be allowed. If granular control is required, FQDN-based access control such as Azure Firewall is required.
3333
34
−<!-- #### Azure portal authentication
35
−
36
−```
37
−*.auth.microsoft.com
38
−*.msftidentity.com
39
−*.msidentity.com
40
−account.activedirectory.windowsazure.com
41
−accounts.accesscontrol.windows.net
42
−adminwebservice.microsoftonline.com
43
−api.passwordreset.microsoftonline.com
44
−autologon.microsoftazuread-sso.combecws
45
−.microsoftonline.com
46
−ccs.login.microsoftonline.com
47
−clientconfig.microsoftonline-p.net
48
−companymanager.microsoftonline.com
49
−device.login.microsoftonline.com
50
−graph.microsoft.com
51
−graph.windows.net
52
−login-us.microsoftonline.com
53
−login.microsoft.com
54
−login.microsoftonline-p.com
55
−login.microsoftonline.com
56
−login.windows.net
57
−logincert.microsoftonline.com
58
−loginex.microsoftonline.com
59
−nexus.microsoftonline-p.com
60
−passwordreset.microsoftonline.com
61
−provisioningapi.microsoftonline.com
62
−*.hip.live.com
63
−*.microsoftonline-p.com
64
−*.microsoftonline.com
65
−*.msauth.net
66
−*.msauthimages.net
67
−*.msecnd.net
68
−*.msftauth.net
69
−*.msftauthimages.net
70
−*.phonefactor.net
71
−enterpriseregistration.windows.net
72
−policykeyservice.dc.ad.msft.net
73
−account.live.com
74
−login.live.com
75
−20.20.32.0/19
76
−20.190.128.0/18
77
−20.231.128.0/19
78
−40.126.0.0/18
79
−2603:1006:2000::/48
80
−2603:1007:200::/48
81
−2603:1016:1400::/48
82
−2603:1017::/48
83
−2603:1026:3000::/48
84
−2603:1027:1::/48
85
−2603:1036:3000::/48
86
−2603:1037:1::/48
87
−2603:1046:2000::/48
88
−2603:1047:1::/48
89
−2603:1056:2000::/48
90
−2603:1057:2::/48
91
−```
92
−-->
93
−
9434
#### Azure portal authentication
9535
```
9636
login.microsoftonline.com
⋯ 115 unchanged lines
212152
*.usgovtrafficmanager.net
213153
*.windowsazure.us
214154
graph.microsoftazure.us
155
+main.ff.marketplacedataprovider.azure.us
215156
```
216157
217158
### [Microsoft Azure operated by 21Vianet Cloud](#tab/azure-china-cloud)
⋯ 20 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-management-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.