Azure portal URL safelist
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-management-docs · commit cb00c3e · +8 −9 lines · also on GitHub
11
---
22
title: Allow the Azure portal URLs on your firewall or proxy server
33
description: To optimize connectivity between your network and the Azure portal and its services, we recommend you add these URLs to your allowlist.
4
−ms.date: 02/03/2026
4
+ms.date: 08/28/2025
55
ms.topic: concept-article
66
# Customer intent: "As a network administrator, I want to add Azure portal URLs to our allowlist on the firewall or proxy server, so that I can ensure optimal connectivity and performance for users accessing Azure services."
77
---
⋯ 5 unchanged lines
1313
Network administrators often deploy proxy servers, firewalls, or other devices, which can help secure and give control over how users access the internet. Rules designed to protect users can sometimes block or slow down legitimate business-related internet traffic. This traffic includes communications between you and Azure over the URLs listed here.
1414
1515
> [!TIP]
16
−> For help diagnosing issues with network connections to these domains, visit [Self-diagnostics](https://portal.azure.com/selfhelp).
16
+> For help with diagnosing issues with network connections to these domains, visit [Self-diagnostics](https://portal.azure.com/selfhelp).
1717
1818
You can use [service tags](/azure/virtual-network/service-tags-overview) to define network access controls on [network security groups](/azure/virtual-network/network-security-groups-overview), [Azure Firewall](/azure/firewall/service-tags), and user-defined routes. Use service tags in place of fully qualified domain names (FQDNs) or specific IP addresses when you create security rules and routes.
1919
2020
## Azure portal URLs for proxy bypass
2121
22
−The URL endpoints to allow for the Azure portal are specific to the Azure cloud where your organization is deployed. To allow network traffic to these endpoints to bypass restrictions, select your cloud, then add the list of URLs to your proxy server or firewall. We do not recommend adding any additional portal-related URLs aside from those listed here, although you may want to add URLs related to other Microsoft products and services. Depending on which services you use, you may not need to include all of these URLs in your allowlist.
22
+The URL endpoints to allow for the Azure portal are specific to the Azure cloud where your organization is deployed. To allow network traffic to these endpoints to bypass restrictions, select your cloud, then add the list of URLs to your proxy server or firewall. We don't recommend adding any other portal-related URLs aside from the endpoints listed here, although you may want to add URLs related to other Microsoft products and services. Depending on which services you use, you may not need to include all of these URLs in your allowlist.
2323
2424
> [!IMPORTANT]
25
−> Including the wildcard symbol (\*) at the start of an endpoint will allow all subdomains. For endpoints with wildcards, we also advise you to add the URL without the wildcard. For example, you should add both `*.portal.azure.com` and `portal.azure.com` to ensure that access to the domain is allowed with or without a subdomain.
25
+> Including the wildcard symbol (\*) at the start of an endpoint allows all subdomains. For endpoints with wildcards, we also advise you to add the URL without the wildcard. For example, you should add both `*.portal.azure.com` and `portal.azure.com` to ensure that access to the domain is allowed with or without a subdomain.
2626
>
27
−> Avoid adding a wildcard symbol to endpoints listed here that don't already include one. Instead, if you identify additional subdomains of an endpoint that are needed for your particular scenario, we recommend that you allow only that particular subdomain.
27
+> Avoid adding a wildcard symbol to endpoints listed here that don't already include one. Instead, if you identify specific subdomains of an endpoint that are needed for your particular scenario, we recommend that you allow only that particular subdomain.
2828
2929
### [Public Cloud](#tab/public-cloud)
3030
3131
> [!TIP]
32
−> The service tags required to access the Azure portal (including authentication and resource listing) are **AzureActiveDirectory**, **AzureResourceManager**, **AzureFrontDoor.Frontend**, and **AzureFrontDoor.FirstParty**. Access to other services may require additional permissions, as described below.
33
−> However, there is a possibility that unnecessary communication other than communication to access the portal may also be allowed. If granular control is required, FQDN-based access control such as Azure Firewall is required.
32
+> The service tags required to access the Azure portal (including authentication and resource listing) are **AzureActiveDirectory**, **AzureResourceManager**, **AzureFrontDoor.Frontend**, and **AzureFrontDoor.FirstParty**. Access to other services may require additional permissions, as described here.
33
+> However, it's possible that unnecessary communication, other than communication to access the portal, may also be allowed. If granular control is required, FQDN-based access control such as Azure Firewall is required.
3434
3535
#### Azure portal authentication
3636
⋯ 11 unchanged lines
4848
```
4949
5050
> [!IMPORTANT]
51
−> Depending on your environment, you may need to allow additional URLs related to authentication, such as those listed in sections 56, 59, and 97 of [Microsoft 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
51
+> Depending on your environment, you might need to allow additional URLs related to authentication, such as those listed in sections 56, 59, and 97 of [Microsoft 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges#microsoft-365-common-and-office-online).
5252
5353
#### Azure portal framework
5454
5555
```
5656
*.portal.azure.com
5757
*.hosting.portal.azure.net
58
−*.ms-hosting.portal.azure.net
5958
*.reactblade.portal.azure.net
6059
management.azure.com
6160
*.ext.azure.com
⋯ 122 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-management-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:37 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.