Hybrid identity ports and protocols
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ba397ad · +39 −27 lines · also on GitHub
11
---
22
title: 'Hybrid Identity required ports and protocols - Azure'
3
−description: This page is a technical reference page for ports that are required to be open for Azure AD Connect
3
+description: This page is a technical reference page for ports that are required to be open for Microsoft Entra Connect
44
services: active-directory
55
documentationcenter: ''
66
author: billmath
⋯ 12 unchanged lines
1919
# Hybrid Identity Required Ports and Protocols
2020
The following document is a technical reference on the required ports and protocols for implementing a hybrid identity solution. Use the following illustration and refer to the corresponding table.
2121
22
−
22
+
2323
24
−## Table 1 - Azure AD Connect and On-premises AD
25
−This table describes the ports and protocols that are required for communication between the Azure AD Connect server and on-premises AD.
24
+<a name='table-1---azure-ad-connect-and-on-premises-ad'></a>
2625
26
+## Table 1 - Microsoft Entra Connect and On-premises AD
27
+This table describes the ports and protocols that are required for communication between the Microsoft Entra Connect server and on-premises AD.
28
+
2729
| Protocol | Ports | Description |
2830
| --- | --- | --- |
2931
| DNS |53 (TCP/UDP) |DNS lookups on the destination forest. |
3032
| Kerberos |88 (TCP/UDP) |Kerberos authentication to the AD forest. |
31
−| MS-RPC |135 (TCP) |Used during the initial configuration of the Azure AD Connect wizard when it binds to the AD forest, and also during Password synchronization. |
33
+| MS-RPC |135 (TCP) |Used during the initial configuration of the Microsoft Entra Connect wizard when it binds to the AD forest, and also during Password synchronization. |
3234
| LDAP |389 (TCP/UDP) |Used for data import from AD. Data is encrypted with Kerberos Sign & Seal. |
3335
| SMB | 445 (TCP) |Used by Seamless SSO to create a computer account in the AD forest and during password writeback. For more information, see [Change a user account's password](/openspecs/windows_protocols/ms-adod/d211aaba-d188-4836-8007-8c62f7c9402d). |
3436
| LDAP/SSL |636 (TCP/UDP) |Used for data import from AD. The data transfer is signed and encrypted. Only used if you are using TLS. |
35
−| RPC |49152- 65535 (Random high RPC Port) (TCP) |Used during the initial configuration of Azure AD Connect when it binds to the AD forests, and during Password synchronization. If the dynamic port has been changed, you need to open that port. See [KB929851](https://support.microsoft.com/kb/929851), [KB832017](https://support.microsoft.com/kb/832017), and [KB224196](https://support.microsoft.com/kb/224196) for more information. |
36
−|WinRM | 5985 (TCP) |Only used if you are installing AD FS with gMSA by Azure AD Connect Wizard|
37
−|AD DS Web Services | 9389 (TCP) |Only used if you are installing AD FS with gMSA by Azure AD Connect Wizard |
37
+| RPC |49152- 65535 (Random high RPC Port) (TCP) |Used during the initial configuration of Microsoft Entra Connect when it binds to the AD forests, and during Password synchronization. If the dynamic port has been changed, you need to open that port. See [KB929851](https://support.microsoft.com/kb/929851), [KB832017](https://support.microsoft.com/kb/832017), and [KB224196](https://support.microsoft.com/kb/224196) for more information. |
38
+|WinRM | 5985 (TCP) |Only used if you are installing AD FS with gMSA by Microsoft Entra Connect Wizard|
39
+|AD DS Web Services | 9389 (TCP) |Only used if you are installing AD FS with gMSA by Microsoft Entra Connect Wizard |
3840
| Global Catalog | 3268 (TCP) | Used by Seamless SSO to query the global catalog in the forest before creating a computer account in the domain. |
3941
40
−## Table 2 - Azure AD Connect and Azure AD
41
−This table describes the ports and protocols that are required for communication between the Azure AD Connect server and Azure AD.
42
+<a name='table-2---azure-ad-connect-and-azure-ad'></a>
4243
44
+## Table 2 - Microsoft Entra Connect and Microsoft Entra ID
45
+This table describes the ports and protocols that are required for communication between the Microsoft Entra Connect server and Microsoft Entra ID.
46
+
4347
| Protocol | Ports | Description |
4448
| --- | --- | --- |
4549
| HTTP |80 (TCP) |Used to download CRLs (Certificate Revocation Lists) to verify TLS/SSL certificates. |
46
−| HTTPS |443 (TCP) |Used to synchronize with Azure AD. |
50
+| HTTPS |443 (TCP) |Used to synchronize with Microsoft Entra ID. |
4751
48
−For a list of URLs and IP addresses you need to open in your firewall, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) and [Troubleshooting Azure AD Connect connectivity](tshoot-connect-connectivity.md#connectivity-issues-in-the-installation-wizard).
52
+For a list of URLs and IP addresses you need to open in your firewall, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) and [Troubleshooting Microsoft Entra Connect connectivity](tshoot-connect-connectivity.md#connectivity-issues-in-the-installation-wizard).
4953
50
−## Table 3 - Azure AD Connect and AD FS Federation Servers/WAP
51
−This table describes the ports and protocols that are required for communication between the Azure AD Connect server and AD FS Federation/WAP servers.
54
+<a name='table-3---azure-ad-connect-and-ad-fs-federation-serverswap'></a>
5255
56
+## Table 3 - Microsoft Entra Connect and AD FS Federation Servers/WAP
57
+This table describes the ports and protocols that are required for communication between the Microsoft Entra Connect server and AD FS Federation/WAP servers.
58
+
5359
| Protocol | Ports | Description |
5460
| --- | --- | --- |
5561
| HTTP |80 (TCP) |Used to download CRLs (Certificate Revocation Lists) to verify TLS/SSL certificates. |
56
−| HTTPS |443 (TCP) |Used to synchronize with Azure AD. |
62
+| HTTPS |443 (TCP) |Used to synchronize with Microsoft Entra ID. |
5763
| WinRM |5985 |WinRM Listener |
5864
5965
## Table 4 - WAP and Federation Servers
⋯ 12 unchanged lines
7278
| TCP |49443 (TCP) |Used for certificate authentication. |
7379
7480
## Table 6a & 6b - Pass-through Authentication with Single Sign On (SSO) and Password Hash Sync with Single Sign On (SSO)
75
−The following tables describes the ports and protocols that are required for communication between the Azure AD Connect and Azure AD.
81
+The following tables describes the ports and protocols that are required for communication between the Microsoft Entra Connect and Microsoft Entra ID.
7682
7783
### Table 6a - Pass-through Authentication with SSO
7884
| Protocol | Ports | Description |
⋯ 1 unchanged line
8086
| HTTP |80 (TCP)|Used to download CRLs (Certificate Revocation Lists) to verify TLS/SSL certificates. Also needed for the connector auto-update capability to function properly. |
8187
| HTTPS |443 (TCP)|Used to enable and disable the feature, register connectors, download connector updates, and handle all user sign-in requests. |
8288
83
−In addition, Azure AD Connect needs to be able to make direct IP connections to the [Azure data center IP ranges](https://www.microsoft.com/download/details.aspx?id=41653).
89
+In addition, Microsoft Entra Connect needs to be able to make direct IP connections to the [Azure data center IP ranges](https://www.microsoft.com/download/details.aspx?id=41653).
8490
8591
### Table 6b - Password Hash Sync with SSO
8692
⋯ 1 unchanged line
8894
| --- | --- | --- |
8995
| HTTPS |443 (TCP)|Used to enable SSO registration (required only for the SSO registration process).
9096
91
−In addition, Azure AD Connect needs to be able to make direct IP connections to the [Azure data center IP ranges](https://www.microsoft.com/download/details.aspx?id=41653). Again, this is only required for the SSO registration process.
97
+In addition, Microsoft Entra Connect needs to be able to make direct IP connections to the [Azure data center IP ranges](https://www.microsoft.com/download/details.aspx?id=41653). Again, this is only required for the SSO registration process.
9298
93
−## Table 7a & 7b - Azure AD Connect Health agent for (AD FS/Sync) and Azure AD
94
−The following tables describe the endpoints, ports, and protocols that are required for communication between Azure AD Connect Health agents and Azure AD
99
+<a name='table-7a--7b---azure-ad-connect-health-agent-for-ad-fssync-and-azure-ad'></a>
95100
96
−### Table 7a - Ports and Protocols for Azure AD Connect Health agent for (AD FS/Sync) and Azure AD
97
−This table describes the following outbound ports and protocols that are required for communication between the Azure AD Connect Health agents and Azure AD.
101
+## Table 7a & 7b - Microsoft Entra Connect Health agent for (AD FS/Sync) and Microsoft Entra ID
102
+The following tables describe the endpoints, ports, and protocols that are required for communication between Microsoft Entra Connect Health agents and Microsoft Entra ID
98103
104
+<a name='table-7a---ports-and-protocols-for-azure-ad-connect-health-agent-for-ad-fssync-and-azure-ad'></a>
105
+
106
+### Table 7a - Ports and Protocols for Microsoft Entra Connect Health agent for (AD FS/Sync) and Microsoft Entra ID
107
+This table describes the following outbound ports and protocols that are required for communication between the Microsoft Entra Connect Health agents and Microsoft Entra ID.
108
+
99109
| Protocol | Ports | Description |
100110
| --- | --- | --- |
101
−| Azure Service Bus |5671 (TCP) | Used to send health information to Azure AD. (recommended but not required in latest versions)|
102
−| HTTPS |443 (TCP) |Used to send health information to Azure AD. (failback)|
111
+| Azure Service Bus |5671 (TCP) | Used to send health information to Microsoft Entra ID. (recommended but not required in latest versions)|
112
+| HTTPS |443 (TCP) |Used to send health information to Microsoft Entra ID. (failback)|
103113
104114
If 5671 is blocked, the agent falls back to 443, but using 5671 is recommended. This endpoint isn't required in the latest version of the agent.
105
−The latest Azure AD Connect Health agent versions only require port 443.
115
+The latest Microsoft Entra Connect Health agent versions only require port 443.
106116
107
−### 7b - Endpoints for Azure AD Connect Health agent for (AD FS/Sync) and Azure AD
108
−For a list of endpoints, see [the Requirements section for the Azure AD Connect Health agent](how-to-connect-health-agent-install.md#requirements).
117
+<a name='7b---endpoints-for-azure-ad-connect-health-agent-for-ad-fssync-and-azure-ad'></a>
118
+
119
+### 7b - Endpoints for Microsoft Entra Connect Health agent for (AD FS/Sync) and Microsoft Entra ID
120
+For a list of endpoints, see [the Requirements section for the Microsoft Entra Connect Health agent](how-to-connect-health-agent-install.md#requirements).
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:48 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.