Windows 365 Cloud PCs

What the network Cloud PCs are provisioned on needs for provisioning and health checks, from the Windows 365 network requirements.

Managed device · GCC High · checked against its pages today 02:28 UTC · Windows 365

Where these entries come from

27 from 1 publisher page

Network requirements the whole page · 27 entries · read today 02:28 UTC

Changes in the last 90 days

global.azure-devices-provisioning.usadded to Microsoft Entra ID-dependent URLs · TCP 443, 5671 · required · 12 Oct 23:22 UTC
hm-iot-in-ghp-ghp01.azure-devices.usadded to Microsoft Entra ID-dependent URLs · TCP 443, 5671 · required · 12 Oct 23:22 UTC
hm-iot-in-gcp-gcp01.azure-devices.usadded to Microsoft Entra ID-dependent URLs · TCP 443, 5671 · required · 12 Oct 23:22 UTC
hm-iot-in-gcb-gcb01.azure-devices.usadded to Microsoft Entra ID-dependent URLs · TCP 443, 5671 · required · 12 Oct 23:22 UTC
hm-iot-in-ghb-ghb01.azure-devices.usadded to Microsoft Entra ID-dependent URLs · TCP 443, 5671 · required · 12 Oct 23:22 UTC
global.azure-devices-provisioning.usremoved from Microsoft Entra ID-dependent URLs · required · 12 Oct 23:22 UTC
hm-iot-in-ghp-ghp01.azure-devices.usremoved from Microsoft Entra ID-dependent URLs · required · 12 Oct 23:22 UTC
hm-iot-in-gcp-gcp01.azure-devices.usremoved from Microsoft Entra ID-dependent URLs · required · 12 Oct 23:22 UTC
hm-iot-in-gcb-gcb01.azure-devices.usremoved from Microsoft Entra ID-dependent URLs · required · 12 Oct 23:22 UTC
hm-iot-in-ghb-ghb01.azure-devices.usremoved from Microsoft Entra ID-dependent URLs · required · 12 Oct 23:22 UTC

ChangeIntel reads each page once a day: the destinations in its tables, lists and code blocks, under the sections named above. Entries follow the page; nothing is added that it does not publish.

Downloads

Built from the pages and endpoint sets above, as last read

Format	Destinations	Download
Plain list, one per line	27	Open
GSA V1 domain list	27	Open
GSA V1 Graph request body	27	Download
GSA V2 rules (review JSON)	27	Download
GSA V2 rules (CSV)	27	Download

About these formats and checking them on a device

"Left out" counts entries a format cannot hold: IP ranges in web filtering, mid-name wildcards, URLs in a V1 domain list, and unfilled values. The V2 JSON is a review format; Microsoft publishes no Graph request shape for V2 rules yet. See how V1 and V2 evaluate.

The same entries are JSON at /api/v1/access-bundles/windows-365-cloud-pcs?cloud=USGovGCCHigh. To check them from the workstation itself, run Test-ChangeIntelAccessBundle -Bundle windows-365-cloud-pcs -Cloud USGovGCCHigh from the ChangeIntel PowerShell module there: it resolves DNS and tries TCP and TLS to each published host, and reports certificate issuers that suggest TLS inspection.

The profile each destination goes to is inferred from Microsoft's published material, not confirmed. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.

Expected to reach web filtering

25expected to go through the Internet Access profile, where a block-by-default web filtering policy would have to allow the ones your scenario needs

Expected to reach web filtering
Destination	Why it's needed	Source
`download.microsoft.com`TCP 443	GCCH, GCC. Localization package	Network requirements · Localization package Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`enterpriseregistration.microsoftonline.us`	GCCH. Microsoft Entra ID-dependent URLs	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`enterpriseregistration.windows.net`	GCCH. Microsoft Entra ID-dependent URLs	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`fef.fxpasu01.manage.microsoft.us`TCP 443	GCCH. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`fef.msuc03.manage.microsoft.com`TCP 443	GCC. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`global.azure-devices-provisioning.us`TCP 443, 5671	GCC, GCCH. Microsoft Entra ID-dependent URLs port 443 and 5671	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`hm-iot-in-gcb-gcb01.azure-devices.us`TCP 443, 5671	GCC. Microsoft Entra ID-dependent URLs port 443 and 5671	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`hm-iot-in-gcp-gcp01.azure-devices.us`TCP 443, 5671	GCC. Microsoft Entra ID-dependent URLs port 443 and 5671	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`hm-iot-in-ghb-ghb01.azure-devices.us`TCP 443, 5671	GCCH. Microsoft Entra ID-dependent URLs port 443 and 5671	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`hm-iot-in-ghp-ghp01.azure-devices.us`TCP 443, 5671	GCCH. Microsoft Entra ID-dependent URLs port 443 and 5671	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.infra.windows365.microsoft.us`	GCC, GCCH. Cloud PC required URLs	Network requirements · Cloud PC required URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`login.live.com`TCP 443	GCCH, GCC. Microsoft Entra ID-dependent URLs	Network requirements · Microsoft Entra ID-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`m.manage.microsoft.com`TCP 443	GCC. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`m.manage.microsoft.us`TCP 443	GCCH. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mam.manage.microsoft.com`TCP 443	GCC. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mam.manage.microsoft.us`TCP 443	GCCH. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`portal.manage.microsoft.com`TCP 443	GCC. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`portal.manage.microsoft.us`TCP 443	GCCH. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`rdbroker.wvd.azure.us`TCP 443	GCCH. Azure Virtual Device-dependent URLs	Network requirements · Azure Virtual Device-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`rdbroker.wvd.microsoft.com`TCP 443	GCC. Azure Virtual Device-dependent URLs	Network requirements · Azure Virtual Device-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`rdweb.wvd.azure.us`TCP 443	GCCH. Azure Virtual Device-dependent URLs	Network requirements · Azure Virtual Device-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`rdweb.wvd.microsoft.com`TCP 443	GCC. Azure Virtual Device-dependent URLs	Network requirements · Azure Virtual Device-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`software-download.microsoft.com`TCP 443	GCCH, GCC. Localization package	Network requirements · Localization package Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`wip.mam.manage.microsoft.com`TCP 443	GCC. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`wip.mam.manage.microsoft.us`TCP 443	GCCH. Intune-dependent URLs	Network requirements · Intune-dependent URLs Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.

Not determined

1public material doesn't settle it; check the client's forwarding profile

Not determined
Destination	Why it's needed	Source
`login.microsoftonline.com`TCP 443	GCC. Microsoft Entra ID-dependent URLs	Network requirements · Microsoft Entra ID-dependent URLs Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 14 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.

Probably taken before Internet Access

1public material indicates the Microsoft Entra system profile or the Microsoft traffic profile takes them first, so web filtering wouldn't evaluate them; not confirmed

Probably taken before Internet Access
Destination	Why it's needed	Source
`login.microsoftonline.us`	GCCH. Microsoft Entra ID-dependent URLs	Network requirements · Microsoft Entra ID-dependent URLs Microsoft traffic profile · indicated, not confirmed In Microsoft 365 Common endpoint set 13 (Allow category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.