From 04f8d9a4530097c4b3b2a4c447c85eb744dbe2ae Mon Sep 17 00:00:00 2001 From: Neil Bird Date: Tue, 14 Jul 2026 08:22:10 +0100 Subject: [PATCH 1/2] Remove Windows Update endpoints that are no longer required post-2506. --- .../AustraliaEast-hci-endpoints.md | 147 +++++++++-------- .../canadacentral-hci-endpoints.md | 147 +++++++++-------- HCI/EastUSendpoints/eastus-hci-endpoints.md | 151 +++++++++--------- .../IndiaCentral-hci-endpoints.md | 147 +++++++++-------- .../japaneast-hci-endpoints.md | 149 +++++++++-------- .../southcentralus-hci-endpoints.md | 149 +++++++++-------- .../southeastasia-hci-endpoints.md | 147 +++++++++-------- .../westeurope-hci-endpoints.md | 147 +++++++++-------- .../usgovvirginia-hci-endpoints.md | 28 ++-- 9 files changed, 593 insertions(+), 619 deletions(-) diff --git a/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md b/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md index cb62e1bc..2dc6f5da 100644 --- a/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md +++ b/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md @@ -13,78 +13,75 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 5 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 6 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 8 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | australiaeast.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Australia East | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | australiaeast.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 28 |Azure Local Arc agent | ae.his.arc.azure.com | 443 | For Australia East metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | australiaeast-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | australiaeast.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 41 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 42 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 43 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 44 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 48 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 49 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 54 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 55 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 57 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 58 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | australiaeast-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 67 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions | No | Deployment & Post deployment | -| 68 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 69 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 70 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | https://australiaeast.obo.arc.azure.com | 8084 | Required for AKS extensions in Australia East after initial deployment. | No | Post Deployment | -| 72 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 73 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 79 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 80 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 81 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 8 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | australiaeast.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Australia East | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 16 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 17 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | australiaeast.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 27 |Azure Local Arc agent | ae.his.arc.azure.com | 443 | For Australia East metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | australiaeast-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 29 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 33 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 34 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | australiaeast.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 39 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 40 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 41 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 42 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 43 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 46 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 47 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | australiaeast-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 63 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions | No | Deployment & Post deployment | +| 64 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 66 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | https://australiaeast.obo.arc.azure.com | 8084 | Required for AKS extensions in Australia East after initial deployment. | No | Post Deployment | +| 68 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 69 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 76 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 77 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 78 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/CanadaCentralEndpoints/canadacentral-hci-endpoints.md b/HCI/CanadaCentralEndpoints/canadacentral-hci-endpoints.md index 7577a33f..18dcc718 100644 --- a/HCI/CanadaCentralEndpoints/canadacentral-hci-endpoints.md +++ b/HCI/CanadaCentralEndpoints/canadacentral-hci-endpoints.md @@ -14,78 +14,75 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 6 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 8 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | canadacentral.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Canada Central region | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 17 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 18 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local ARB infra | canadacentral.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Canada Central. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 28 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | cc.his.arc.azure.com | 443 | For Canada Central metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 30 |Azure Local Arc agent | canadacentral-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Canada Central. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 34 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 35 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local authentication | canadacentral.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 41 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 42 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 43 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 44 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 48 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 49 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 54 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 55 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 57 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 58 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | canadacentral-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 67 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions | No | Deployment & Post deployment | -| 68 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 69 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 70 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 72 |Azure Local AKS infra | https://canadacentral.obo.arc.azure.com | 8084 | Required for AKS extensions in Canada Central after initial deployment. | No | Post Deployment | -| 73 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 80 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 83 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | canadacentral.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Canada Central region | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local ARB infra | canadacentral.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Canada Central. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | cc.his.arc.azure.com | 443 | For Canada Central metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 29 |Azure Local Arc agent | canadacentral-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Canada Central. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 39 |Azure Local authentication | canadacentral.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 40 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 41 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 42 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 43 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 46 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 47 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | canadacentral-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 63 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions | No | Deployment & Post deployment | +| 64 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 66 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 68 |Azure Local AKS infra | https://canadacentral.obo.arc.azure.com | 8084 | Required for AKS extensions in Canada Central after initial deployment. | No | Post Deployment | +| 69 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 77 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 78 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 80 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/EastUSendpoints/eastus-hci-endpoints.md b/HCI/EastUSendpoints/eastus-hci-endpoints.md index 9cb01382..bce9202f 100644 --- a/HCI/EastUSendpoints/eastus-hci-endpoints.md +++ b/HCI/EastUSendpoints/eastus-hci-endpoints.md @@ -15,80 +15,77 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 7 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 8 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 9 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | eastus.dp.kubernetesconfiguration.azure.com | 443 | Required for initial validation. | Yes. 2408 or later new deployment | Deployment | -| 14 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local AKS infra | raw.githubusercontent.com | 443 | Used for GitHub. | Not required on 2504 and later new deployments | Deployment & Post deployment | -| 17 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 18 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 20 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local ARB infra | eastus.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in East Us. | Yes. 2408 or later new deployment | Deployment | -| 27 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 28 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 29 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 30 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 31 |Azure Local Arc agent | eus.his.arc.azure.com | 443 | For East US metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 32 |Azure Local Arc agent | eastus-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 34 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 35 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 36 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 37 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 38 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 39 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 41 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 42 |Azure Local authentication | eastus.login.microsoft.com | 443 | Required to fetch and update ARM tokens for logging into East Us Azure. | Yes. 2408 or later new deployment | Deployment | -| 43 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 44 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 45 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 48 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 49 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 51 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 54 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 55 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 57 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 58 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 60 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | eastus-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment | -| 62 |Azure Local monitoring | westus-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment | -| 63 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 64 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 65 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 66 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 67 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 68 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 69 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 70 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 71 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 72 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 73 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 74 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 75 |Azure Local AKS infra | https://eastus.obo.arc.azure.com | 8084 | Required for initial validation. | No | Post Deployment | -| 76 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 80 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 81 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 82 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 83 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 84 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 85 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 86 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | eastus.dp.kubernetesconfiguration.azure.com | 443 | Required for initial validation. | Yes. 2408 or later new deployment | Deployment | +| 13 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local AKS infra | raw.githubusercontent.com | 443 | Used for GitHub. | Not required on 2504 and later new deployments | Deployment & Post deployment | +| 16 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 17 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 19 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local ARB infra | eastus.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in East Us. | Yes. 2408 or later new deployment | Deployment | +| 26 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 27 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 28 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 29 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 30 |Azure Local Arc agent | eus.his.arc.azure.com | 443 | For East US metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 31 |Azure Local Arc agent | eastus-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 33 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 34 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 35 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 36 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 37 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 38 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 39 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 40 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 41 |Azure Local authentication | eastus.login.microsoft.com | 443 | Required to fetch and update ARM tokens for logging into East Us Azure. | No | Deployment | +| 42 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 43 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 44 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 46 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 47 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 48 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 49 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 50 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 53 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 54 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 56 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 57 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 59 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | eastus-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment | +| 61 |Azure Local monitoring | westus-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment | +| 62 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 63 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 64 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 65 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 66 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 67 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 68 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 69 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 70 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 71 |Azure Local AKS infra | https://eastus.obo.arc.azure.com | 8084 | Required for initial validation. | No | Post Deployment | +| 72 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 77 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 79 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 80 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 83 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/IndiaCentralEndpoints/IndiaCentral-hci-endpoints.md b/HCI/IndiaCentralEndpoints/IndiaCentral-hci-endpoints.md index 6bd653bc..120a60a5 100644 --- a/HCI/IndiaCentralEndpoints/IndiaCentral-hci-endpoints.md +++ b/HCI/IndiaCentralEndpoints/IndiaCentral-hci-endpoints.md @@ -13,78 +13,75 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 5 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 6 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 8 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | centralindia.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Central India | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | centralindia.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Central India | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 28 |Azure Local Arc agent | pn.his.arc.azure.com | 443 | For India Central metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | centralindia-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Central India | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | centralindia.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 41 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 42 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 43 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 44 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 58 |Azure Local monitoring | centralindia-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 67 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 68 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | -| 69 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 70 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | https://centralindia.obo.arc.azure.com | 8084 | Required for AKS extensions in Central India after initial deployment. | No | Post Deployment | -| 72 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 73 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 79 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 80 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 81 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 8 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | centralindia.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Central India | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 16 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 17 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | centralindia.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Central India | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 27 |Azure Local Arc agent | pn.his.arc.azure.com | 443 | For India Central metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | centralindia-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Central India | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 29 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 33 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 34 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | centralindia.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 39 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 40 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 41 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 42 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 43 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 46 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 47 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 48 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 53 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 54 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 56 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 57 |Azure Local monitoring | centralindia-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 62 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 63 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 64 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | +| 65 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 66 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | https://centralindia.obo.arc.azure.com | 8084 | Required for AKS extensions in Central India after initial deployment. | No | Post Deployment | +| 68 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 69 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 76 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 77 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 78 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/JapanEastEndpoints/japaneast-hci-endpoints.md b/HCI/JapanEastEndpoints/japaneast-hci-endpoints.md index 80337a4d..adc2317c 100644 --- a/HCI/JapanEastEndpoints/japaneast-hci-endpoints.md +++ b/HCI/JapanEastEndpoints/japaneast-hci-endpoints.md @@ -13,79 +13,76 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 5 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 6 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 8 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | japaneast.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Japan East | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | japaneast.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Japan East | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 28 |Azure Local Arc agent | je.his.arc.azure.com | 443 | For Japan East metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | japaneast-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Japan East | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | japaneast.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 41 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 42 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 43 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 44 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 58 |Azure Local monitoring | japaneast-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 67 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 68 |Microsoft Update | tsfe.trafficshaping.dsp.mp.microsoft.com | 443 | For Microsoft Update content regulation | No | Deployment & Post deployment | -| 69 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | -| 70 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 72 |Azure Local AKS infra | https://japaneast.obo.arc.azure.com | 8084 | Required for AKS extensions in Japan East after initial deployment. | No | Post Deployment | -| 73 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 80 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 83 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 8 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | japaneast.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in Japan East | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 16 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 17 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | japaneast.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in Japan East | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 27 |Azure Local Arc agent | je.his.arc.azure.com | 443 | For Japan East metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | japaneast-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Japan East | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 29 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 33 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 34 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | japaneast.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 39 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 40 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 41 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 42 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 43 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 46 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 47 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 48 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 53 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 54 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 56 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 57 |Azure Local monitoring | japaneast-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 62 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 63 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 64 |Microsoft Update | tsfe.trafficshaping.dsp.mp.microsoft.com | 443 | For Microsoft Update content regulation | No | Deployment & Post deployment | +| 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | +| 66 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 68 |Azure Local AKS infra | https://japaneast.obo.arc.azure.com | 8084 | Required for AKS extensions in Japan East after initial deployment. | No | Post Deployment | +| 69 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 77 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 78 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 80 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md b/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md index c80b16b8..60083db4 100644 --- a/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md +++ b/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md @@ -13,79 +13,76 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 5 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 6 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 8 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | southcentralus.dp.kubernetesconfiguration.azure.com| 443 | Used for Azure Arc configuration in South Central US | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | scus.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in South Central US | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 28 |Azure Local Arc agent | scus.his.arc.azure.com | 443 | For South Central US metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | southcentralus-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in South Central US | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | southcentralus.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 41 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 42 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 43 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 44 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 58 |Azure Local monitoring | southcentralus-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 67 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 68 |Microsoft Update | tsfe.trafficshaping.dsp.mp.microsoft.com | 443 | For Microsoft Update content regulation | No | Deployment & Post deployment | -| 69 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | -| 70 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 72 |Azure Local AKS infra | https://southcentralus.obo.arc.azure.com | 8084 | Required for AKS extensions in South Central US after initial deployment. | No | Post Deployment | -| 73 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 80 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 83 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 8 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | southcentralus.dp.kubernetesconfiguration.azure.com| 443 | Used for Azure Arc configuration in South Central US | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 16 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 17 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | scus.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in South Central US | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 27 |Azure Local Arc agent | scus.his.arc.azure.com | 443 | For South Central US metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | southcentralus-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in South Central US | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 29 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 33 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 34 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | southcentralus.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 39 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 40 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 41 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 42 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 43 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 46 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 47 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 48 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 53 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 54 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 56 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 57 |Azure Local monitoring | southcentralus-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 62 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 63 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 64 |Microsoft Update | tsfe.trafficshaping.dsp.mp.microsoft.com | 443 | For Microsoft Update content regulation | No | Deployment & Post deployment | +| 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | +| 66 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 68 |Azure Local AKS infra | https://southcentralus.obo.arc.azure.com | 8084 | Required for AKS extensions in South Central US after initial deployment. | No | Post Deployment | +| 69 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 77 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 78 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 80 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/SouthEastAsiaEndpoints/southeastasia-hci-endpoints.md b/HCI/SouthEastAsiaEndpoints/southeastasia-hci-endpoints.md index 1d181456..b6444ef2 100644 --- a/HCI/SouthEastAsiaEndpoints/southeastasia-hci-endpoints.md +++ b/HCI/SouthEastAsiaEndpoints/southeastasia-hci-endpoints.md @@ -14,78 +14,75 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 6 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 8 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | southeastasia.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in SouthEast Asia | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 17 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 18 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local ARB infra | southeastasia.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in SouthEast Asia | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 28 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | sea.his.arc.azure.com | 443 | For South East Asia metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 30 |Azure Local Arc agent | southeastasia-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in SouthEast Asia | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 34 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 35 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local authentication | southeastasia.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 41 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 42 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 43 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 44 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 48 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 49 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 54 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 55 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 57 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 58 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | southeastasia-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 67 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 68 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 69 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 70 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 72 |Azure Local AKS infra | https://southeastasia.obo.arc.azure.com | 8084 | Required for AKS extensions in SouthEast Asia after initial deployment. | No | Post Deployment | -| 73 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 80 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 83 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | southeastasia.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in SouthEast Asia | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local ARB infra | southeastasia.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in SouthEast Asia | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | sea.his.arc.azure.com | 443 | For South East Asia metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 29 |Azure Local Arc agent | southeastasia-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in SouthEast Asia | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 39 |Azure Local authentication | southeastasia.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 40 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 41 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 42 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 43 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 46 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 47 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | southeastasia-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 63 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 64 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 66 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 68 |Azure Local AKS infra | https://southeastasia.obo.arc.azure.com | 8084 | Required for AKS extensions in SouthEast Asia after initial deployment. | No | Post Deployment | +| 69 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 77 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 78 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 80 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/WestEuropeendpoints/westeurope-hci-endpoints.md b/HCI/WestEuropeendpoints/westeurope-hci-endpoints.md index 202477e5..d39fa25e 100644 --- a/HCI/WestEuropeendpoints/westeurope-hci-endpoints.md +++ b/HCI/WestEuropeendpoints/westeurope-hci-endpoints.md @@ -14,78 +14,75 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 6 |Azure Local AKS infra | azurearcfork8sdev.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 7 |Azure Local AKS infra | hybridaks.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 8 |Azure Local AKS infra | aszk8snetworking.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 9 |Azure Local AKS infra | *.dl.delivery.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 10 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 11 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 12 |Azure Local AKS infra | westeurope.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in West Europe. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 13 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 14 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 15 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 16 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 17 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | -| 18 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 19 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 20 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 21 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 22 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 23 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 24 |Azure Local ARB infra | westeurope.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in West Europe. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 25 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 26 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 27 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 28 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 29 |Azure Local Arc agent | weu.his.arc.azure.com | 443 | For West Europe metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 30 |Azure Local Arc agent | westeurope-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in West Europe. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 31 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 32 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 33 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 34 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | -| 35 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | -| 36 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | -| 37 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 38 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 39 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 40 |Azure Local authentication | westeurope.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 41 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 42 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | -| 43 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 44 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 45 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 46 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 47 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 48 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | -| 49 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 50 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 51 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 52 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 53 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 54 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | -| 55 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 56 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 57 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | -| 58 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 59 |Azure Local monitoring | westeurope-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 60 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 61 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 62 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 63 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 64 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 65 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 66 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 67 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 68 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 69 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 70 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 71 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 72 |Azure Local AKS infra | https://westeurope.obo.arc.azure.com | 8084 | Required for AKS extensions in West Europe after initial deployment. | No | Post Deployment | -| 73 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | -| 80 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | -| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | -| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | -| 83 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 9 |Azure Local AKS infra | *.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 10 |Azure Local AKS infra | *.prod.do.dsp.mp.microsoft.com | 443 | Used for AKS Arc VHD image download and update. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 11 |Azure Local AKS infra | westeurope.dp.kubernetesconfiguration.azure.com | 443 | Used for Azure Arc configuration in West Europe. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 12 |Azure Local AKS infra | sts.windows.net | 443 | For Cluster Connect and Custom Location-based scenario. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 13 |Azure Local AKS infra | ecpacr.azurecr.io | 443 | Used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 14 |Azure Local ARB infra | msk8s.api.cdp.microsoft.com | 443 | Download product catalog, product bits, and OS images from SFS. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 15 |Azure Local ARB infra | msk8s.sb.tlu.dl.delivery.mp.microsoft.com | 443 | Download the Arc Resource Bridge OS images. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 16 |Azure Local ARB infra | time.windows.com | 123 | OS time sync in appliance VM & Management machine (Windows NTP). | No | Deployment & Post deployment | +| 17 |Azure Local ARB infra | k8connecthelm.azureedge.net | 443 | deploy Azure Arc agent. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 18 |Azure Local ARB infra | kvamanagementoperator.azurecr.io | 443 | Pull artifacts for Appliance managed components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 19 |Azure Local ARB infra | packages.microsoft.com | 443 | Download Linux installation package. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 20 |Azure Local ARB infra | k8sconnectcsp.azureedge.net | 443 | Required for Custom Location. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 21 |Azure Local ARB infra | *.prod.hot.ingest.monitor.core.windows.net | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 22 |Azure Local ARB infra | prod5.prod.hot.ingestion.msftcloudes.com | 443 | Periodically sends Microsoft required diagnostic data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 23 |Azure Local ARB infra | westeurope.dp.prod.appliances.azure.com | 443 | Used for ARB data plane operations in West Europe. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 24 |Azure Local Arc agent | download.microsoft.com | 443 | For downloading the Windows installation package. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 25 |Azure Local Arc agent | pas.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 26 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 27 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 28 |Azure Local Arc agent | weu.his.arc.azure.com | 443 | For West Europe metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | +| 29 |Azure Local Arc agent | westeurope-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in West Europe. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 30 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 32 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 33 |Azure Local WAC | *.waconazure.com | 443 | For Windows Admin Center management after deployment. | Yes. 2408 or later new deployment | Post deployment | +| 34 |Azure Local Arc gateway | yourarcgatewayendpointid.gw.arc.azure.com | 443 | Required if using Arc gateway for Azure Local. ENSURE THIS IS YOUR UNIQUE GATEWAY NAME | No. Arc registration required | Deployment & Post deployment | +| 35 |Azure Local authentication | login.microsoftonline.com | 443 | For Active Directory Authority and authentication, token fetch, and validation. | No. Arc registration required | Deployment & Post deployment | +| 36 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 37 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 38 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 39 |Azure Local authentication | westeurope.login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | +| 40 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 41 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | +| 42 |Azure Local deployment | www.powershellgallery.com | 443 | To install required PSGallery modules for Arc registration. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 43 |Azure Local deployment | portal.azure.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 44 |Azure Local deployment | *.blob.core.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 45 |Azure Local deployment | hciarcvmscontainerregistry.azurecr.io | 443 | For Arc VM container registry on Azure Local 23H2. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 46 |Azure Local deployment | azurestackreleases.download.prss.microsoft.com | 443 | For Azure Local Arc extensions deployment. | No | Deployment & Post deployment | +| 47 |Azure Local authentication | yourhcikeyvaultname.vault.azure.net | 443 | Key vault for deployment secrets. ENSURE THIS IS YOUR UNIQUE KEY VAULT NAME | No | Deployment & Post deployment | +| 48 |Azure Local deployment | settings-win.data.microsoft.com | 443 | For Azure Local deployment | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 49 |Azure Local diag & billing | dp.stackhci.azure.com | 443 | For Data plane diagnostics and billing data. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 50 |Azure Local diag & billing | licensing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 51 |Azure Local diag & billing | billing.platform.edge.azure.com | 443 | For Data plane licensing billing data. Required only for Azure Local. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 52 |Azure Local diag & billing | azurestackhci.azurefd.net | 443 | Previous URL for Data plane for backwards compatibility. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 53 |Azure Local management | management.azure.com | 443 | Initial Azure Local cluster registration, bootstrapping and management operations. | No. Arc registration required | Deployment & Post deployment | +| 54 |Azure Local monitoring | global.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 55 |Azure Local monitoring | prod5.prod.microsoftmetrics.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 56 |Azure Local monitoring | dc.services.visualstudio.com | 443 | Used for metrics and monitoring telemetry traffic. | No. Arc registration required | Deployment & Post deployment | +| 57 |Azure Local monitoring | qos.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 58 |Azure Local monitoring | westeurope-shared.prod.warm.ingest.monitor.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 59 |Azure Local monitoring | gcs.prod.monitoring.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 60 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 61 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 62 |Azure Local deployment | aka.ms | 443 | For resolving addresses to discover Azure Local | No | Deployment & Post deployment | +| 63 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 64 |Microsoft Update | go.microsoft.com | 443 | For Microsoft Update, allowing the OS to receive updates. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 66 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 67 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 68 |Azure Local AKS infra | https://westeurope.obo.arc.azure.com | 8084 | Required for AKS extensions in West Europe after initial deployment. | No | Post Deployment | +| 69 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | +| 77 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | +| 78 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 79 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | Yes. 2503 or later new deployment | Deployment & Post deployment | +| 80 |Azure Local ARB infra | arcplatformcliextprod.z13.web.core.windows.net | 443 | Used to deploy ARB extensions | Yes. 2503 or later new deployment | Deployment & Post deployment | diff --git a/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md b/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md index 997db162..30ad62d2 100644 --- a/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md +++ b/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md @@ -73,18 +73,16 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 65 |Azure Local monitoring | gcs.monitoring.core.usgovcloudapi.net | 443 | Used for metrics and monitoring telemetry traffic. | No | Deployment & Post deployment | | 66 |Azure Local monitoring | adhs.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | No | Deployment & Post deployment | | 67 |Azure Local monitoring | v20.events.data.microsoft.com | 443 | Used for metrics and monitoring telemetry traffic. | No | Deployment & Post deployment | -| 68 |Azure Local Updates | fe3.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 69 |Azure Local Updates | fe3cr.delivery.mp.microsoft.com | 443 | For updating Azure Local. | No | Deployment & Post deployment | -| 70 |Azure Local Updates | tlu.dl.delivery.mp.microsoft.com | 80 | For updating Azure Local. | No | Deployment & Post deployment | -| 71 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | -| 72 |Microsoft Update | tsfe.trafficshaping.dsp.mp.microsoft.com | 443 | For Microsoft Update content regulation | No | Deployment & Post deployment | -| 73 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | -| 74 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | No | Deployment & Post deployment | -| 75 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 76 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 77 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 78 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 79 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 80 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | -| 81 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | No | Deployment & Post deployment | -| 82 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | No | Deployment & Post deployment | +| 68 |Azure Local CRLs | crl.microsoft.com/pkiinfra | 80 | Azure Local certificate revocation list for mandatory Arc extensions. | No | Deployment & Post deployment | +| 69 |Microsoft Update | tsfe.trafficshaping.dsp.mp.microsoft.com | 443 | For Microsoft Update content regulation | No | Deployment & Post deployment | +| 70 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | No | Deployment & Post deployment | +| 71 |Azure Local authentication | login.microsoft.com | 443 | Required to fetch and update Azure Resource Manager tokens. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 75 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 76 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 77 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 78 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 79 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | No | Deployment & Post deployment | +| 80 |Azure Local AKS infra | azurewatsonanalysis-prod.core.windows.net | 443 | Used for metrics and monitoring telemetry traffic. | No | Deployment & Post deployment | From 93efc6de681d750f5ce5f0db3a0bbeca8774570a Mon Sep 17 00:00:00 2001 From: Neil Bird Date: Tue, 14 Jul 2026 08:28:35 +0100 Subject: [PATCH 2/2] Remove Windows Update endpoints that are no longer required post-2506. - Minor fixes --- .../AustraliaEast-hci-endpoints.md | 14 +++++++------- HCI/EastUSendpoints/eastus-hci-endpoints.md | 2 +- .../southcentralus-hci-endpoints.md | 2 +- .../usgovvirginia-hci-endpoints.md | 2 +- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md b/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md index 2dc6f5da..3390d51b 100644 --- a/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md +++ b/HCI/AustraliaEastendpoints/AustraliaEast-hci-endpoints.md @@ -73,13 +73,13 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 65 |Microsoft Defender | *.endpoint.security.microsoft.com | 443 | Required only if using Microsoft Defender extension (MDE.windows). | Yes. 2411 or later new deployment | Deployment & Post deployment | | 66 |Azure Local AKS infra | *.blob.storage.azure.net | 443 | To access blob storage. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 67 |Azure Local AKS infra | https://australiaeast.obo.arc.azure.com | 8084 | Required for AKS extensions in Australia East after initial deployment. | No | Post Deployment | -| 68 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 69 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 70 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 71 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 72 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 73 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | -| 74 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities' certificate revocation list. | No | Deployment & Post deployment | +| 68 |Azure Local CRLs | oneocsp.microsoft.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 69 |Azure Local CRLs | ts-crl.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 70 |Azure Local CRLs | ts-ocsp.ws.symantec.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 71 |Azure Local CRLs | s.symcd.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 72 |Azure Local CRLs | ocsp.digicert.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 73 |Azure Local CRLs | ocsp.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | +| 74 |Azure Local CRLs | ocsp2.globalsign.com | 80 | Required for Public authorities’ certificate revocation list. | No | Deployment & Post deployment | | 75 |Azure Local AKS infra | hciarcvmsstorage.z13.web.core.windows.net | 443 | Storage account for stack-hci-vm CLI extension files. | Yes. 2411 or later new deployment | Deployment & Post deployment | | 76 |Azure Local AKS infra | www.msftconnecttest.com/connecttest.txt | 80 | Bootstrap Windows outbound connectivity validation | No | Deployment | | 77 |Azure Local AKS infra | edgesupprd.trafficmanager.net | 443 | Remote Support Extension | Yes. 2408 or later new deployment | Deployment & Post deployment | diff --git a/HCI/EastUSendpoints/eastus-hci-endpoints.md b/HCI/EastUSendpoints/eastus-hci-endpoints.md index bce9202f..4b6abf2c 100644 --- a/HCI/EastUSendpoints/eastus-hci-endpoints.md +++ b/HCI/EastUSendpoints/eastus-hci-endpoints.md @@ -36,7 +36,7 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 28 |Azure Local Arc agent | guestnotificationservice.azure.com | 443 | For the notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 29 |Azure Local Arc agent | gbl.his.arc.azure.com | 443 | For global metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | | 30 |Azure Local Arc agent | eus.his.arc.azure.com | 443 | For East US metadata and hybrid identity services. | No. Arc registration required | Deployment & Post deployment | -| 31 |Azure Local Arc agent | eastus-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in Australia East. | Yes. 2408 or later new deployment | Deployment & Post deployment | +| 31 |Azure Local Arc agent | eastus-gas.guestconfiguration.azure.com | 443 | For extension management and guest configuration services in East US. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 32 |Azure Local Arc agent | agentserviceapi.guestconfiguration.azure.com | 443 | For notification service for extension and connectivity scenarios. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 33 |Azure Local Arc agent | azgn*.servicebus.windows.net | 443 | Not required if endpoint 41 below is whitelisted. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 34 |Azure Local Arc agent | *.servicebus.windows.net | 443 | For multiple Azure Local components. | Yes. 2408 or later new deployment | Deployment & Post deployment | diff --git a/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md b/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md index 60083db4..032e186d 100644 --- a/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md +++ b/HCI/SouthCentralUSEndpoints/southcentralus-hci-endpoints.md @@ -4,7 +4,7 @@ This page provides a comprehensive overview of the necessary endpoints for deplo **This list was last updated on November 27th, 2025** - Review GitHub History and PRs for detailed information. -| Id | Azure Local Component | Endpoint URL | Port | Notes | Arc gateway support | Required | +| Id | Azure Local Component | Endpoint URL | Port | Notes | Arc gateway support | Required for | |----|---------------------------------|----------------------------------------------------|------|----------------------------------------------------------------------------------------|-----------------------------------|------------------------------| | 1 |Azure Local AKS infra | mcr.microsoft.com | 443 | Global site used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | | 2 |Azure Local AKS infra | westus.data.mcr.microsoft.com | 443 | West US site used for official Microsoft artifacts such as container images. | Yes. 2408 or later new deployment | Deployment & Post deployment | diff --git a/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md b/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md index 30ad62d2..709be9e7 100644 --- a/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md +++ b/HCI/usgovvirginia-hci-endpoints/usgovvirginia-hci-endpoints.md @@ -54,7 +54,7 @@ This page provides a comprehensive overview of the necessary endpoints for deplo | 46 |Azure Local authentication | graph.windows.net | 443 | For Graph authentication, token fetch, and validation. | No | Deployment & Post deployment | | 47 |Azure Local authentication | graph.microsoft.com | 443 | For Graph authentication and Azure Resource Bridge RBAC. | No | Deployment & Post deployment | | 48 |Azure Local authentication | login.windows.net | 443 | For Microsoft Entra ID. | No | Deployment & Post deployment | -| 49 |Azure Local authentication | login.microsoftonline.us | 443 | Required to fetch and update ARM tokens for logging into East Us Azure. | No | Deployment | +| 49 |Azure Local authentication | login.microsoftonline.us | 443 | Required to fetch and update ARM tokens for logging into US Gov Virginia Azure. | No | Deployment | | 50 |Azure Local authentication | usgovvirginia.login.microsoftonline.us | 443 | Required to fetch and update Azure Resource Manager tokens for logging into Azure. | No | Deployment & Post deployment | | 51 |Azure Local benefits | crl3.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment | | 52 |Azure Local benefits | crl4.digicert.com | 80 | Platform attestation service on Azure Local to perform a certificate revocation list. | No | Deployment & Post deployment |