Azure Arc-enabled servers

What the Azure Connected Machine agent needs to onboard a server to Azure Arc and keep it connected in its Azure cloud.

Server or agent · Commercial · checked against its pages 19 Oct 02:22 UTC · Azure Arc

Where these entries come from

21 from 1 publisher page

Connected Machine agent network requirements 1 section · 21 entries · read 19 Oct 02:22 UTC

Changes in the last 90 days

https://{azurekeyvaultname}.vault.azure.net/added to URLs · TCP 443 · required · 12 Oct 23:22 UTC
https://graph.microsoft.com/added to URLs · TCP 443 · required · 12 Oct 23:22 UTC
www.microsoft.com/pkiops/certsadded to URLs · TCP 80, 443 · required · 12 Oct 23:22 UTC
{azurekeyvaultname}.vault.azure.netremoved from URLs · required · 12 Oct 23:22 UTC
graph.microsoft.comremoved from URLs · required · 12 Oct 23:22 UTC
www.microsoft.com/pkiops/certsremoved from URLs · required · 12 Oct 23:22 UTC

ChangeIntel reads each page once a day: the destinations in its tables, lists and code blocks, under the sections named above. Entries follow the page; nothing is added that it does not publish.

Downloads

Built from the pages and endpoint sets above, as last read

Entries with {region}, {azurekeyvaultname} are left out of downloads until you fill in your value.

Format	Destinations	Left out	Download
Plain list, one per line	18	3	Open
GSA V1 domain list	15	6	Open
GSA V1 Graph request body	17	4	Download
GSA V2 rules (review JSON)	17	4	Download
GSA V2 rules (CSV)	17	4	Download

About these formats and checking them on a device

"Left out" counts entries a format cannot hold: IP ranges in web filtering, mid-name wildcards, URLs in a V1 domain list, and unfilled values. The V2 JSON is a review format; Microsoft publishes no Graph request shape for V2 rules yet. See how V1 and V2 evaluate.

The same entries are JSON at /api/v1/access-bundles/azure-arc-servers. To check them from the workstation itself, run Test-ChangeIntelAccessBundle -Bundle azure-arc-servers -Value @{ region = '...'; azurekeyvaultname = '...' } from the ChangeIntel PowerShell module there: it resolves DNS and tries TCP and TLS to each published host, and reports certificate issuers that suggest TLS inspection.

The profile each destination goes to is inferred from Microsoft's published material, not confirmed. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.

Expected to reach web filtering

11expected to go through the Internet Access profile, where a block-by-default web filtering policy would have to allow the ones your scenario needs

Expected to reach web filtering
Destination	Why it's needed	Source
`azgn*.servicebus.windows.net`	Always. Notification service for extension and connectivity scenarios.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.guestconfiguration.azure.com`	Always. Extension management and guest configuration services.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`guestnotificationservice.azure.com`	Always. Notification service for extension and connectivity scenarios.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.guestnotificationservice.azure.com`	Always. Notification service for extension and connectivity scenarios.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.his.arc.azure.com`	Always. Metadata and hybrid identity services.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`https://{azurekeyvaultname}.vault.azure.net/`TCP 443	If you use Azure Arc-enabled SQL Server. For Microsoft Entra authentication with Azure Arc-enabled SQL Server.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`management.azure.com`	Only when you connect or disconnect a server. Azure Resource Manager is used to create or delete the Azure Arc server resource.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`pas.windows.net`	Always. Microsoft Entra ID.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.servicebus.windows.net`	Always. Notification service for extension and connectivity scenarios.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.waconazure.com`	If you use Windows Admin Center. For Windows Admin Center connectivity.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.{region}.arcdataservices.com`	If you use Azure Arc-enabled SQL Server. For Azure Arc-enabled SQL Server. Sends data processing service, service telemetry, and performance monitoring to Azure. Allows Transport Layer Security (TLS) 1.2 or 1.3 only.	Connected Machine agent network requirements · URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.

Not determined

8public material doesn't settle it; check the client's forwarding profile

Not determined
Destination	Why it's needed	Source
`dls.microsoft.com`	Required when you use hotpatching, Windows Server Azure Benefits, or Windows Server pay-as-you-go billing on Azure Arc-enabled machines. Used by Azure Arc machines to perform license validation.	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`download.microsoft.com`	Only at installation time. Used to download the Windows installation package.	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`eastus2.login.microsoft.com`	URLs	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`*.login.microsoft.com`	Always. Regional Microsoft Entra token endpoints used during normal agent operation.	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`packages.microsoft.com`	Only at installation time. Used to download the Linux installation package.	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`www.microsoft.com/pkiops/certs`TCP 80, 443	If you use Extended Security Updates enabled by Azure Arc. Always required for automatic updates or temporarily if you download certificates manually. Intermediate certificate updates for Extended Security Updates (uses HTTP/TCP 80 and HTT…	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`{region}.login.microsoft.com`	URLs	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`dc.services.visualstudio.com`optional	Optional. Not used in agent versions 1.24+. Agent telemetry.	Connected Machine agent network requirements · URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 75 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.

Probably taken before Internet Access

2public material indicates the Microsoft Entra system profile or the Microsoft traffic profile takes them first, so web filtering wouldn't evaluate them; not confirmed

Probably taken before Internet Access
Destination	Why it's needed	Source
`https://graph.microsoft.com/`TCP 443	If you use Azure Arc-enabled SQL Server. For Microsoft Entra authentication with Azure Arc-enabled SQL Server.	Connected Machine agent network requirements · URLs Microsoft Entra system profile · indicated, not confirmed In Microsoft 365 endpoint set 56, one of the Entra identity sets. Microsoft documents that the always-on Entra system profile covers sign-in and Graph, and that the Microsoft traffic profile is built from this list, so it is expected to be taken before Internet Access. Microsoft publishes neither profile's host list.
`login.microsoftonline.com`	Always. Global Microsoft Entra token endpoint used during onboarding and as a fallback when a regional endpoint can't be reached.	Connected Machine agent network requirements · URLs Microsoft Entra system profile · indicated, not confirmed In Microsoft 365 endpoint set 56, one of the Entra identity sets. Microsoft documents that the always-on Entra system profile covers sign-in and Graph, and that the Microsoft traffic profile is built from this list, so it is expected to be taken before Internet Access. Microsoft publishes neither profile's host list.