Azure Virtual Desktop session hosts

What Azure Virtual Desktop session host virtual machines need, from the Azure cloud list, including the Azure fabric addresses.

Server or agent · Commercial · checked against its pages today 02:28 UTC · Azure Virtual Desktop

Where these entries come from

30 from 1 publisher page

Required FQDNs and endpoints for Azure Virtual Desktop 3 sections · 30 entries · read today 02:28 UTC

Changes in the last 90 days

None of these pages added or removed a destination in the sections this bundle reads.

ChangeIntel reads each page once a day: the destinations in its tables, lists and code blocks, under the sections named above. Entries follow the page; nothing is added that it does not publish.

Downloads

Built from the pages and endpoint sets above, as last read

Format	Destinations	Left out	Download
Plain list, one per line	30	0	Open
GSA V1 domain list	26	4	Open
GSA V1 Graph request body	26	4	Download
GSA V2 rules (review JSON)	26	4	Download
GSA V2 rules (CSV)	26	4	Download

About these formats and checking them on a device

"Left out" counts entries a format cannot hold: IP ranges in web filtering, mid-name wildcards, URLs in a V1 domain list, and unfilled values. The V2 JSON is a review format; Microsoft publishes no Graph request shape for V2 rules yet. See how V1 and V2 evaluate.

The same entries are JSON at /api/v1/access-bundles/avd-session-hosts. To check them from the workstation itself, run Test-ChangeIntelAccessBundle -Bundle avd-session-hosts from the ChangeIntel PowerShell module there: it resolves DNS and tries TCP and TLS to each published host, and reports certificate issuers that suggest TLS inspection.

The profile each destination goes to is inferred from Microsoft's published material, not confirmed. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.

Expected to reach web filtering

15expected to go through the Internet Access profile, where a block-by-default web filtering policy would have to allow the ones your scenario needs

Expected to reach web filtering
Destination	Why it's needed	Source
`168.63.129.16/32`TCP 80, 32526TCP/UDP 53	Azure Platform Service Connectivity	Required FQDNs and endpoints for Azure Virtual Desktop · Azure fabric communication IPs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`169.254.169.254/32`TCP 80	Azure Instance Metadata Service (IMDS)	Required FQDNs and endpoints for Azure Virtual Desktop · Azure fabric communication IPs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`51.5.0.0/16`UDP 3478	Relayed RDP connectivity	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`azcsprodeusaikpublish.blob.core.windows.net`TCP 80	Certificates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`azkms.core.windows.net`TCP 1688	Windows activation	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`catalogartifact.azureedge.net`TCP 443	Azure Marketplace	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gcs.prod.monitoring.core.windows.net`TCP 443	Agent traffic	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.microsoftaik.azure.net`TCP 80	Certificates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mrsglobalsteus2prod.blob.core.windows.net`TCP 443	Agent and side-by-side (SXS) stack updates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.prod.warm.ingest.monitor.core.windows.net`TCP 443	Agent traffic Diagnostic output	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`wvdportalstorageblob.blob.core.windows.net`TCP 443	Azure portal support	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.azure-dns.com`optionalTCP 443	Azure DNS resolution	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.azure-dns.net`optionalTCP 443	Azure DNS resolution	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*eh.servicebus.windows.net`optionalTCP 443	Diagnostic settings	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`www.msftconnecttest.com`optionalTCP 80	Detects if the session host is connected to the internet	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.

Not determined

13public material doesn't settle it; check the client's forwarding profile

Not determined
Destination	Why it's needed	Source
`*.aikcertaia.microsoft.com`TCP 80	Certificates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`aka.ms`TCP 443	Microsoft URL shortener, used during session host deployment on Azure Local	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Teams / Skype endpoint set 17 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`ctldl.windowsupdate.com`TCP 80	Certificates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`oneocsp.microsoft.com`TCP 80	Certificates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.service.windows.cloud.microsoft`TCP 443	Service Traffic	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 184 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.windows.cloud.microsoft`TCP 443	Service Traffic	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 184 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.windows.static.microsoft`TCP 443	Service Traffic	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 193 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.wvd.microsoft.com`TCP 443	Service traffic including TCP based RDP connectivity	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`www.microsoft.com`TCP 80	Certificates	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.digicert.com`optionalTCP 80	Certificate revocation check	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Profile not determined Broader than the Microsoft 365 entries it includes (such as set 125): those parts are expected to go to a Microsoft profile and the rest to Internet Access.
`*.events.data.microsoft.com`optionalTCP 443	Telemetry Service	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.prod.do.dsp.mp.microsoft.com`optionalTCP 443	Windows Update	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.sfx.ms`optionalTCP 443	Updates for OneDrive client software	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Profile not determined Broader than the Microsoft 365 entries it includes (such as set 36): those parts are expected to go to a Microsoft profile and the rest to Internet Access.

Probably taken before Internet Access

2public material indicates the Microsoft Entra system profile or the Microsoft traffic profile takes them first, so web filtering wouldn't evaluate them; not confirmed

Probably taken before Internet Access
Destination	Why it's needed	Source
`login.microsoftonline.com`TCP 443	Authentication to Microsoft Online Services	Required FQDNs and endpoints for Azure Virtual Desktop · Session host virtual machines Microsoft Entra system profile · indicated, not confirmed In Microsoft 365 endpoint set 56, one of the Entra identity sets. Microsoft documents that the always-on Entra system profile covers sign-in and Graph, and that the Microsoft traffic profile is built from this list, so it is expected to be taken before Internet Access. Microsoft publishes neither profile's host list.
`login.windows.net`optionalTCP 443	Sign in to Microsoft Online Services and Microsoft 365	Required FQDNs and endpoints for Azure Virtual Desktop · Other Endpoints Microsoft Entra system profile · indicated, not confirmed In Microsoft 365 endpoint set 56, one of the Entra identity sets. Microsoft documents that the always-on Entra system profile covers sign-in and Graph, and that the Microsoft traffic profile is built from this list, so it is expected to be taken before Internet Access. Microsoft publishes neither profile's host list.