{ "format": "changeintel.gsa-web-filtering-v2", "graphShapeDocumented": false, "note": "Neutral review format. Create the rule in the Microsoft Entra admin center: Global Secure Access \u003E Secure \u003E Web Filtering Policies (V2).", "rules": [ { "name": "ChangeIntel Azure Arc-enabled servers", "action": "Allow", "destinations": [ { "type": "url", "value": "download.microsoft.com", "purpose": "Only at installation time. Used to download the Windows installation package.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "packages.microsoft.com", "purpose": "Only at installation time. Used to download the Linux installation package.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "login.microsoftonline.com", "purpose": "Always. Global Microsoft Entra token endpoint used during onboarding and as a fallback when a regional endpoint can\u0027t be reached.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "*.login.microsoft.com", "purpose": "Always. Regional Microsoft Entra token endpoints used during normal agent operation.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "A *. wildcard matches subdomains of login.microsoft.com but not login.microsoft.com itself; list the apex separately only if a source publishes it.", "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "pas.windows.net", "purpose": "Always. Microsoft Entra ID.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "management.azure.com", "purpose": "Only when you connect or disconnect a server. Azure Resource Manager is used to create or delete the Azure Arc server resource.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "*.his.arc.azure.com", "purpose": "Always. Metadata and hybrid identity services.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "A *. wildcard matches subdomains of his.arc.azure.com but not his.arc.azure.com itself; list the apex separately only if a source publishes it.", "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "*.guestconfiguration.azure.com", "purpose": "Always. Extension management and guest configuration services.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "A *. wildcard matches subdomains of guestconfiguration.azure.com but not guestconfiguration.azure.com itself; list the apex separately only if a source publishes it.", "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "guestnotificationservice.azure.com", "purpose": "Always. Notification service for extension and connectivity scenarios.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "*.guestnotificationservice.azure.com", "purpose": "Always. Notification service for extension and connectivity scenarios.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "A *. wildcard matches subdomains of guestnotificationservice.azure.com but not guestnotificationservice.azure.com itself; list the apex separately only if a source publishes it.", "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "*.servicebus.windows.net", "purpose": "Always. Notification service for extension and connectivity scenarios.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "A *. wildcard matches subdomains of servicebus.windows.net but not servicebus.windows.net itself; list the apex separately only if a source publishes it.", "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "*.waconazure.com", "purpose": "If you use Windows Admin Center. For Windows Admin Center connectivity.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "A *. wildcard matches subdomains of waconazure.com but not waconazure.com itself; list the apex separately only if a source publishes it.", "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did." ] }, { "type": "url", "value": "dc.services.visualstudio.com", "purpose": "Optional. Not used in agent versions 1.24\u002B. Agent telemetry.", "required": false, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "In Microsoft 365 Common endpoint set 75 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "dls.microsoft.com", "purpose": "Required when you use hotpatching, Windows Server Azure Benefits, or Windows Server pay-as-you-go billing on Azure Arc-enabled machines. Used by Azure Arc machines to perform license validation.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "eastus2.login.microsoft.com", "purpose": "URLs", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.", "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "https://graph.microsoft.com/", "purpose": "If you use Azure Arc-enabled SQL Server. For Microsoft Entra authentication with Azure Arc-enabled SQL Server.", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "Public material indicates the Microsoft Entra system profile takes this before Internet Access (indicated, not confirmed), so this rule is probably redundant. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] }, { "type": "url", "value": "www.microsoft.com/pkiops/certs", "purpose": "If you use Extended Security Updates enabled by Azure Arc. Always required for automatic updates or temporarily if you download certificates manually. Intermediate certificate updates for Extended Security Updates (uses HTTP/TCP 80 and HTT\u2026", "required": true, "sources": [ "https://learn.microsoft.com/en-us/azure/azure-arc/servers/network-requirements?tabs=azure-cloud#urls" ], "caveats": [ "In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile." ] } ] } ], "notes": [ "In V2 a security profile contains exactly one web filtering policy. Each rule carries its own Allow or Block action and the policy has a default action (Allow, Block, or the preview Continue Evaluation).", "V2 has no standalone FQDN type: FQDNs are expressed as URL destinations, and a URL destination matches the address and its sub-paths.", "A former exact-host FQDN evaluated with URL logic can match sub-paths of the address rather than only the exact host; review destinations to confirm they match the intended traffic.", "V2 runs before V1. A V2 Block is terminal; a V2 Allow isn\u0027t, so a V1 policy can still block the same traffic.", "Without TLS inspection, HTTPS traffic is evaluated by Server Name Indication (SNI); only unencrypted HTTP exposes the full URL." ] }