(MS Azure SAML)Which IP/FQDN should be allow on Firewall

Question

Which IP/FQDN should be allowed on the firewall to authenticate users with SAML(SSO) in a closed network?

Should I allow only the address below in the firewall?

login.microsoftonline.com

My firewall does not support "Asterisk*" for FQDN. ex) *.microsftonlline.com

Answer 1

Hi @Sungsu Lee

See the following post for a similar question (Answered by JamesTran-MSFT):

https://learn.microsoft.com/en-us/answers/questions/306128/azure-sso-minimum-firewall-rules-required.html

When it comes to the SAML IPs/URLs, I was able to find a few more by looking at a Sample SAML Token:

https://sts.windows.net
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey

Additional Link:
Single Sign-On SAML protocol

Hopefully this helps you.

-----------------------------------

If this is helpful please accept answer.