Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article describes the networking requirements for using the Azure Connected Machine agent to onboard a physical server or virtual machine to Azure Arc-enabled servers.
Details
Generally, connectivity requirements include these principles:
- All connections are TCP unless otherwise specified.
- All HTTP connections use HTTPS and SSL/TLS with officially signed and verifiable certificates.
- All connections are outbound unless otherwise specified.
To use a proxy, verify that the agents and the machine performing the onboarding process meet the network requirements in this article.
Azure Arc-enabled server endpoints are required for all server-based Azure Arc offerings.
Networking configuration
The Azure Connected Machine agent for Linux and Windows communicates outbound securely to Azure Arc over TCP port 443. By default, the agent uses the default route to the internet to reach Azure services. You can optionally configure the agent to use a proxy server if your network requires it. Proxy servers don't make the Connected Machine agent more secure because the traffic is already encrypted.
To further secure your network connectivity to Azure Arc, instead of using public networks and proxy servers, you can implement an Azure Arc private link scope.
Note
Azure Arc-enabled servers doesn't support using a Log Analytics gateway as a proxy for the Connected Machine agent. At the same time, Azure Monitor Agent supports Log Analytics gateways.
If your firewall or proxy server restricts outbound connectivity, make sure that the URLs and service tags listed here aren't blocked.
Service tags
Be sure to allow access to the following service tags:
AzureActiveDirectoryAzureTrafficManagerAzureResourceManagerAzureArcInfrastructureStorageWindowsAdminCenter(if you use Windows Admin Center to manage Azure Arc-enabled servers)
For a list of IP addresses for each service tag/region, see the JSON file Azure IP Ranges and Service Tags - China Cloud. Microsoft publishes weekly updates that contain each Azure service and the IP ranges it uses. The information in the JSON file is the current point-in-time list of the IP ranges that correspond to each service tag. The IP addresses are subject to change. If IP address ranges are required for your firewall configuration, use the AzureCloud service tag to allow access to all Azure services. Don't disable security monitoring or inspection of these URLs. Allow them as you would other internet traffic.
If you filter traffic to the AzureArcInfrastructure service tag, you must allow traffic to the full service tag range. The specific IP address resolved for these endpoints might change over time within the documented ranges. For this reason, using a lookup tool to identify the current IP address for a specific endpoint and allowing access to only that IP address isn't sufficient to ensure reliable access.
For more information, see Virtual network service tags.
Important
To filter traffic by IP addresses in Azure Government or Microsoft Azure operated by 21Vianet, be sure to add the IP addresses from the AzureArcInfrastructure service tag for the Azure public cloud, in addition to using the AzureArcInfrastructure service tag for your cloud. After October 28, 2025, adding the AzureArcInfrastructure service tag for Azure public cloud will be required, and the service tags for Azure Government and Microsoft Azure operated by 21Vianet will no longer be supported.
URLs
This table lists the URLs that must be available to install and use the Connected Machine agent.
| Agent resource | Description | When required |
|---|---|---|
download.microsoft.com |
Used to download the Windows installation package. | Only at installation time.1 |
packages.microsoft.com |
Used to download the Linux installation package. | Only at installation time.1 |
login.chinacloudapi.cn |
Microsoft Entra ID. | Always. |
login.partner.microsoftonline.cn |
Microsoft Entra ID. | Always. |
pas.chinacloudapi.cn |
Microsoft Entra ID. | Always. |
management.chinacloudapi.cn |
Azure Resource Manager is used to create or delete the Azure Arc server resource. | Only when you connect or disconnect a server. |
*.his.arc.azure.cn |
Metadata and hybrid identity services. | Always. |
*.guestconfiguration.azure.cn |
Extension management and guest configuration services. | Always. |
guestnotificationservice.azure.cn, *.guestnotificationservice.azure.cn |
Notification service for extension and connectivity scenarios. | Always. |
azgn*.servicebus.chinacloudapi.cn |
Notification service for extension and connectivity scenarios. | Always. |
*.servicebus.chinacloudapi.cn |
For Windows Admin Center and SSH scenarios. | If you use SSH or Windows Admin Center from Azure. |
*.blob.core.chinacloudapi.cn |
Download source for Azure Arc-enabled servers extensions. | Always, except when you use private endpoints. |
dc.applicationinsights.azure.cn |
Agent telemetry. | Optional. Not used in agent versions 1.24+. |
1 Access to this URL is also needed when updates are preformed automatically.
Cryptographic protocols
To ensure the security of data in transit to Azure, we strongly encourage you to configure machines to use TLS 1.2 and 1.3. Older versions of TLS/Secure Sockets Layer (SSL) were found to be vulnerable. Although they still currently work to allow backward compatibility, they aren't recommended.
Starting from version 1.56 of the Connected Machine agent (Windows only), the following cipher suites must be configured for at least one of the recommended TLS versions:
TLS 1.3 (suites in server-preferred order):
- TLS_AES_256_GCM_SHA384 (0x1302) ECDH secp521r1 (eq. 15360 bits RSA) FS
- TLS_AES_128_GCM_SHA256 (0x1301) ECDH secp256r1 (eq. 3072 bits RSA) FS
TLS 1.2 (suites in server-preferred order):
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH secp521r1 (eq. 15360 bits RSA) FS
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH secp256r1 (eq. 3072 bits RSA) FS
For more information, see Windows TLS configuration issues.
| Platform/Language | Support | More information |
|---|---|---|
| Linux | Linux distributions tend to rely on OpenSSL for TLS 1.2 support. | Check the OpenSSL Changelog to confirm that your version of OpenSSL is supported. |
| Windows Server 2012 R2 and later | Supported and enabled by default. | Confirm that you're still using the default settings. |
| Windows Server 2012 | Partially supported. Not recommended. | Some endpoints still work, but other endpoints require TLS 1.2 or later, which isn't available on Windows Server 2012. |
Subset of endpoints for ESU only
If you use Azure Arc-enabled servers only for Extended Security Updates for either or both of the following products:
- Windows Server 2012
- SQL Server 2012
Note
Azure Arc-enabled servers used for Extended Security Updates for Windows Server 2012 aren't available in Azure operated by 21Vianet regions at this time.
Related content
- For information on more prerequisites for deploying the Connected Machine agent, see Connected Machine agent prerequisites.
- Before you deploy the Connected Machine agent and integrate with other Azure management and monitoring services, review the planning and deployment guide.
- To resolve problems, review the agent connection issues troubleshooting guide.
- For a complete list of network requirements for Azure Arc features and Azure Arc-enabled services, see Azure Arc network requirements (Consolidated).