Required URLs for Azure Virtual Desktop
In order to deploy and make Azure Virtual Desktop available to your users, you must allow specific URLs that your session host virtual machines (VMs) can access them anytime. Users also need to be able to connect to certain URLs to access their Azure Virtual Desktop resources. This article lists the required URLs you need to allow for your session hosts and users. These URLs could be blocked if you're using Azure Firewall or a third-party firewall or proxy service. Azure Virtual Desktop doesn't support deployments that block the URLs listed in this article.
Important
Proxy Services that perform the following are not recommended with Azure Virtual Desktop. See the above link or Table of Contents regarding Proxy Support Guidelines for further details.
- SSL Termination (Break and Inspect)
- Require Authentication
Session host virtual machines
The following table is the list of URLs your session host VMs need to access for Azure Virtual Desktop.
| Address | Outbound TCP port | Purpose | Service tag |
|---|---|---|---|
login.partner.microsoftonline.cn |
443 | Authentication to Microsoft Online Services | |
| *.wvd.azure.cn | 443 | Service traffic | WindowsVirtualDesktop |
| mooncake.warmpath.chinacloudapi.cn | 443 | Agent traffic | AzureCloud |
| monitoring.core.chinacloudapi.cn | 443 | Agent traffic | AzureCloud |
| *xt.blob.core.chinacloudapi.cn | 443 | Agent traffic | AzureCloud |
| *.servicebus.chinacloudapi.cn | 443 | Agent traffic | AzureCloud |
| *xt.table.core.chinacloudapi.cn | 443 | Agent traffic | AzureCloud |
| *xt.queue.core.chinacloudapi.cn | 443 | Agent traffic | AzureCloud |
| kms.core.chinacloudapi.cn | 1688 | Windows activation | Internet |
| mrsglobalstcne2mc.blob.core.chinacloudapi.cn | 443 | Agent and SXS stack updates | AzureCloud |
| wvdportalcontainer.blob.core.chinacloudapi.cn | 443 | Azure portal support | AzureCloud |
| 169.254.169.254 | 80 | Azure Instance Metadata service endpoint | N/A |
| 168.63.129.16 | 80 | Session host health monitoring | N/A |
| crl.digincert.cn | 443 | Certificates | N/A |
| microsoft.com | 443 | Certificates | N/A |
| *.prod.warm.ingest.monitor.core.chinacloudapi.cn | 443 | Agent traffic |
Important
We've finished transitioning the URLs we use for Agent traffic. We no longer support the following URLs. To prevent your session host VMs from showing a Needs Assistance status due to this, you must allow the URL *.prod.warm.ingest.monitor.core.chinacloudapi.cn if you haven't already. You should also remove the following URLs if you explicitly allowed them before the change:
| Address | Outbound TCP port | Purpose | Service tag |
|---|---|---|---|
production.diagnostics.monitoring.core.chinacloudapi.cn |
443 | Agent traffic | AzureCloud |
*xt.blob.core.chinacloudapi.cn |
443 | Agent traffic | AzureCloud |
*eh.servicebus.chinacloudapi.cn |
443 | Agent traffic | AzureCloud |
*xt.table.core.chinacloudapi.cn |
443 | Agent traffic | AzureCloud |
*xt.queue.core.chinacloudapi.cn |
443 | Agent traffic | AzureCloud |
The following table lists optional URLs that your session host virtual machines might also need to access for other services:
| Address | Outbound TCP port | Purpose | Azure Cloud 21Vianet |
|---|---|---|---|
| *.chinacloudapi.cn | 443 | Authentication to Azure Online Services | login.chinacloudapi.cn |
| *.events.data.microsoft.com | 443 | Telemetry Service | None |
| www.msftconnecttest.com | 443 | Detects if the OS is connected to the internet | None |
| *.prod.do.dsp.mp.microsoft.com | 443 | Windows Update | None |
| *.sfx.ms | 443 | Updates for OneDrive client software | oneclient.sfx.ms |
| *.digicert.com | 443 | Certificate revocation check | None |
| *.azure-dns.com | 443 | Azure DNS resolution | None |
| *.azure-dns.net | 443 | Azure DNS resolution | None |
Tip
You must use the wildcard character (*) for URLs involving service traffic. If you prefer not to use this for agent-related traffic, here's how to find those specific URLs to use without specifying wildcards:
- Ensure your session host virtual machines are registered to a host pool.
- Open Event viewer, then go to Windows logs > Application > WVD-Agent and look for event ID 3701.
- Unblock the URLs that you find under event ID 3701. The URLs under event ID 3701 are region-specific. You'll need to repeat this process with the relevant URLs for each Azure region you want to deploy your session host virtual machines in.
This list doesn't include URLs for other services like Microsoft Entra ID or Office 365. Microsoft Entra URLs can be found under ID 10 on the Office 365 URLs and IP address ranges.
Service tags and FQDN tags
A virtual network service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules. Service tags can be used in both Network Security Group (NSG) and Azure Firewall rules to restrict outbound network access. Service tags can be also used in User Defined Route (UDR) to customize traffic routing behavior.
Azure Firewall supports Azure Virtual Desktop as a FQDN tag. For more information, see Use Azure Firewall to protect Azure Virtual Desktop deployments.
We recommend you use FQDN tags or service tags instead of URLs to prevent service issues. The listed URLs and tags only correspond to Azure Virtual Desktop sites and resources. They don't include URLs for other services like Microsoft Entra ID. For other services, see Available service tags.
Azure Virtual Desktop currently doesn't have a list of IP address ranges that you can unblock to allow network traffic. We only support unblocking specific URLs. If you're using a Next Generation Firewall (NGFW), you'll need to use a dynamic list specifically made for Azure IPs to make sure you can connect.
Remote Desktop clients
Any Remote Desktop clients you use to connect to Azure Virtual Desktop must have access to the following URLs. Select the relevant tab based on which cloud you're using. Opening these URLs is essential for a reliable client experience. Blocking access to these URLs is unsupported and will affect service functionality.
| Address | Outbound TCP port | Purpose | Client(s) | Microsoft Azure operated by 21Vianet |
|---|---|---|---|---|
| *.wvd.azure.cn | 443 | Service traffic | All | *.wvd.azure.cn |
| *.servicebus.chinacloudapi.cn | 443 | Troubleshooting data | All | *.servicebus.chinacloudapi.cn |
| go.microsoft.com | 443 | Microsoft FWLinks | All | None |
| aka.ms | 443 | Microsoft URL shortener | All | None |
| learn.microsoft.com | 443 | Documentation | All | None |
| privacy.microsoft.com | 443 | Privacy statement | All | None |
| query.prod.cms.rt.microsoft.com | 443 | Client updates | Windows Desktop | None |
These URLs only correspond to client sites and resources. This list doesn't include URLs for other services like Microsoft Entra ID or Office 365. Microsoft Entra URLs can be found under ID 10 on the Office 365 URLs and IP address ranges.
Next steps
To learn how to unblock these URLs in Azure Firewall for your Azure Virtual Desktop deployment, see Use Azure Firewall to protect Azure Virtual Desktop.