Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Network requirements
Azure virtual machines can use either their local virtual network adapter (vNIC) or Azure Private Link to communicate with the machine configuration service.
Azure Arc-enabled machines connect using the on-premises network infrastructure to reach Azure services and report compliance status.
The following table shows the supported endpoints for Azure and Azure Arc-enabled machines:
| Region | Geography | URL | Storage endpoint |
|---|---|---|---|
| EastAsia | Asia Pacific | agentserviceapi.guestconfiguration.azure.com eastasia-gas.guestconfiguration.azure.com ea-gas.guestconfiguration.azure.com |
oaasguestconfigeas1.blob.core.windows.net oaasguestconfigseas1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SoutheastAsia | Asia Pacific | agentserviceapi.guestconfiguration.azure.com southeastasia-gas.guestconfiguration.azure.com sea-gas.guestconfiguration.azure.com |
oaasguestconfigeas1.blob.core.windows.net oaasguestconfigseas1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| AustraliaEast | Australia | agentserviceapi.guestconfiguration.azure.com australiaeast-gas.guestconfiguration.azure.com ae-gas.guestconfiguration.azure.com |
oaasguestconfigases1.blob.core.windows.net oaasguestconfigaes1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| AustraliaSoutheast | Australia | agentserviceapi.guestconfiguration.azure.com australiaeast-gas.guestconfiguration.azure.com ae-gas.guestconfiguration.azure.com |
oaasguestconfigases1.blob.core.windows.net oaasguestconfigaes1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| BrazilSouth | Brazil | agentserviceapi.guestconfiguration.azure.com brazilsouth-gas.guestconfiguration.azure.com brs-gas.guestconfiguration.azure.com |
oaasguestconfigbrss1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| CanadaCentral | Canada | agentserviceapi.guestconfiguration.azure.com canadacentral-gas.guestconfiguration.azure.com cc-gas.guestconfiguration.azure.com |
oaasguestconfigccs1.blob.core.windows.net oaasguestconfigces1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| CanadaEast | Canada | agentserviceapi.guestconfiguration.azure.com canadaeast-gas.guestconfiguration.azure.com ce-gas.guestconfiguration.azure.com |
oaasguestconfigccs1.blob.core.windows.net oaasguestconfigces1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| ChinaEast2 | China | agentserviceapi.guestconfiguration.azure.cn chinaeast2-gas.guestconfiguration.azure.cn chne2-gas.guestconfiguration.azure.cn |
oaasguestconfigchne2s2.blob.core.chinacloudapi.cn |
| ChinaNorth | China | agentserviceapi.guestconfiguration.azure.cn chinanorth-gas.guestconfiguration.azure.cn chnn-gas.guestconfiguration.azure.cn |
oaasguestconfigchnns2.blob.core.chinacloudapi.cn |
| ChinaNorth2 | China | agentserviceapi.guestconfiguration.azure.cn chinanorth2-gas.guestconfiguration.azure.cn chnn2-gas.guestconfiguration.azure.cn |
oaasguestconfigchnn2s2.blob.core.chinacloudapi.cn |
| ChinaNorth3 | China | agentserviceapi.guestconfiguration.azure.cn chinanorth3-gas.guestconfiguration.azure.cn chnn3-gas.guestconfiguration.azure.cn |
oaasguestconfigchnn3s1.blob.core.chinacloudapi.cn |
| NorthEurope | Europe | agentserviceapi.guestconfiguration.azure.com northeurope-gas.guestconfiguration.azure.com ne-gas.guestconfiguration.azure.com |
oaasguestconfignes1.blob.core.windows.net oaasguestconfigwes1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| WestEurope | Europe | agentserviceapi.guestconfiguration.azure.com westeurope-gas.guestconfiguration.azure.com we-gas.guestconfiguration.azure.com |
oaasguestconfignes1.blob.core.windows.net oaasguestconfigwes1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| FranceCentral | France | agentserviceapi.guestconfiguration.azure.com francecentral-gas.guestconfiguration.azure.com fc-gas.guestconfiguration.azure.com |
oaasguestconfigfcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| GermanyNorth | Germany | agentserviceapi.guestconfiguration.azure.com germanynorth-gas.guestconfiguration.azure.com gen-gas.guestconfiguration.azure.com |
oaasguestconfiggens1.blob.core.windows.net oaasguestconfiggewcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| GermanyWestCentral | Germany | agentserviceapi.guestconfiguration.azure.com germanywestcentral-gas.guestconfiguration.azure.com gewc-gas.guestconfiguration.azure.com |
oaasguestconfiggens1.blob.core.windows.net oaasguestconfiggewcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| CentralIndia | India | agentserviceapi.guestconfiguration.azure.com centralindia-gas.guestconfiguration.azure.com cid-gas.guestconfiguration.azure.com |
oaasguestconfigcids1.blob.core.windows.net oaasguestconfigsids1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SouthIndia | India | agentserviceapi.guestconfiguration.azure.com southindia-gas.guestconfiguration.azure.com sid-gas.guestconfiguration.azure.com |
oaasguestconfigcids1.blob.core.windows.net oaasguestconfigsids1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| IsraelCentral | Israel | agentserviceapi.guestconfiguration.azure.com israelcentral-gas.guestconfiguration.azure.com ilc-gas.guestconfiguration.azure.com |
oaasguestconfigilcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| ItalyNorth | Italy | agentserviceapi.guestconfiguration.azure.com italynorth-gas.guestconfiguration.azure.com itn-gas.guestconfiguration.azure.com |
oaasguestconfigitns1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| JapanEast | Japan | agentserviceapi.guestconfiguration.azure.com japaneast-gas.guestconfiguration.azure.com jpe-gas.guestconfiguration.azure.com |
oaasguestconfigjpws1.blob.core.windows.net oaasguestconfigjpes1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| JapanWest | Japan | agentserviceapi.guestconfiguration.azure.com japanwest-gas.guestconfiguration.azure.com jpw-gas.guestconfiguration.azure.com |
oaasguestconfigjpws1.blob.core.windows.net oaasguestconfigjpes1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| KoreaCentral | Korea | agentserviceapi.guestconfiguration.azure.com koreacentral-gas.guestconfiguration.azure.com kc-gas.guestconfiguration.azure.com |
oaasguestconfigkcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| MexicoCentral | Mexico | agentserviceapi.guestconfiguration.azure.com mexicocentral-gas.guestconfiguration.azure.com mxc-gas.guestconfiguration.azure.com |
oaasguestconfigmxcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| NorwayEast | Norway | agentserviceapi.guestconfiguration.azure.com norwayeast-gas.guestconfiguration.azure.com noe-gas.guestconfiguration.azure.com |
oaasguestconfignoes2.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| PolandCentral | Poland | agentserviceapi.guestconfiguration.azure.com polandcentral-gas.guestconfiguration.azure.com plc-gas.guestconfiguration.azure.com |
oaasguestconfigwcuss1.blob.core.windows.net |
| QatarCentral | Qatar | agentserviceapi.guestconfiguration.azure.com qatarcentral-gas.guestconfiguration.azure.com qac-gas.guestconfiguration.azure.com |
oaasguestconfigqacs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SouthAfricaNorth | SouthAfrica | agentserviceapi.guestconfiguration.azure.com southafricanorth-gas.guestconfiguration.azure.com san-gas.guestconfiguration.azure.com |
oaasguestconfigsans1.blob.core.windows.net oaasguestconfigsaws1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SouthAfricaWest | SouthAfrica | agentserviceapi.guestconfiguration.azure.com southafricawest-gas.guestconfiguration.azure.com saw-gas.guestconfiguration.azure.com |
oaasguestconfigsans1.blob.core.windows.net oaasguestconfigsaws1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SpainCentral | Spain | agentserviceapi.guestconfiguration.azure.com spaincentral-gas.guestconfiguration.azure.com spc-gas.guestconfiguration.azure.com |
oaasguestconfigspcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SwedenCentral | Sweden | agentserviceapi.guestconfiguration.azure.com swedencentral-gas.guestconfiguration.azure.com swc-gas.guestconfiguration.azure.com |
oaasguestconfigswcs1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SwitzerlandNorth | Switzerland | agentserviceapi.guestconfiguration.azure.com switzerlandnorth-gas.guestconfiguration.azure.com stzn-gas.guestconfiguration.azure.com |
oaasguestconfigstzns1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SwitzerlandWest | Switzerland | agentserviceapi.guestconfiguration.azure.com switzerlandwest-gas.guestconfiguration.azure.com stzw-gas.guestconfiguration.azure.com |
oaasguestconfigstzns1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| TaiwanNorth | Taiwan | agentserviceapi.guestconfiguration.azure.com taiwannorth-gas.guestconfiguration.azure.com twn-gas.guestconfiguration.azure.com |
oaasguestconfigtwns1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| UAENorth | United Arab Emirates | agentserviceapi.guestconfiguration.azure.com uaenorth-gas.guestconfiguration.azure.com uaen-gas.guestconfiguration.azure.com |
oaasguestconfiguaens1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| UKSouth | United Kingdom | agentserviceapi.guestconfiguration.azure.com uksouth-gas.guestconfiguration.azure.com uks-gas.guestconfiguration.azure.com |
oaasguestconfigukss1.blob.core.windows.net oaasguestconfigukws1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| UKWest | United Kingdom | agentserviceapi.guestconfiguration.azure.com ukwest-gas.guestconfiguration.azure.com ukw-gas.guestconfiguration.azure.com |
oaasguestconfigukss1.blob.core.windows.net oaasguestconfigukws1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| EastUS | US | agentserviceapi.guestconfiguration.azure.com eastus-gas.guestconfiguration.azure.com eus-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| EastUS2 | US | agentserviceapi.guestconfiguration.azure.com eastus2-gas.guestconfiguration.azure.com eus2-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| WestUS | US | agentserviceapi.guestconfiguration.azure.com westus-gas.guestconfiguration.azure.com wus-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| WestUS2 | US | agentserviceapi.guestconfiguration.azure.com westus2-gas.guestconfiguration.azure.com wus2-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| WestUS3 | US | agentserviceapi.guestconfiguration.azure.com westus3-gas.guestconfiguration.azure.com wus3-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| CentralUS | US | agentserviceapi.guestconfiguration.azure.com centralus-gas.guestconfiguration.azure.com cus-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| NorthCentralUS | US | agentserviceapi.guestconfiguration.azure.com northcentralus-gas.guestconfiguration.azure.com ncus-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| SouthCentralUS | US | agentserviceapi.guestconfiguration.azure.com southcentralus-gas.guestconfiguration.azure.com scus-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| WestCentralUS | US | agentserviceapi.guestconfiguration.azure.com westcentralus-gas.guestconfiguration.azure.com wcus-gas.guestconfiguration.azure.com |
oaasguestconfigeuss1.blob.core.windows.net oaasguestconfigeus2s1.blob.core.windows.net oaasguestconfigwuss1.blob.core.windows.net oaasguestconfigwus2s1.blob.core.windows.net oaasguestconfigncuss1.blob.core.windows.net oaasguestconfigcuss1.blob.core.windows.net oaasguestconfigscuss1.blob.core.windows.net oaasguestconfigwus3s1.blob.core.windows.net oaasguestconfigwcuss1.blob.core.windows.net |
| USGovArizona | US Gov | agentserviceapi.guestconfiguration.azure.us usgovarizona-gas.guestconfiguration.azure.us usga-gas.guestconfiguration.azure.us |
oaasguestconfigusgas1.blob.core.usgovcloudapi.net |
| USGovTexas | US Gov | agentserviceapi.guestconfiguration.azure.us usgovtexas-gas.guestconfiguration.azure.us usgt-gas.guestconfiguration.azure.us |
oaasguestconfigusgts1.blob.core.usgovcloudapi.net |
| USGovVirginia | US Gov | agentserviceapi.guestconfiguration.azure.us usgovvirginia-gas.guestconfiguration.azure.us usgv-gas.guestconfiguration.azure.us |
oaasguestconfigusgvs1.blob.core.usgovcloudapi.net |
Communicate over virtual networks in Azure
To communicate with the machine configuration resource provider in Azure, machines require outbound
access to Azure datacenters on port 443*. If a network in Azure doesn't allow outbound traffic,
configure exceptions with Network Security Group rules. The service tags
AzureArcInfrastructure and Storage can be used to reference the guest configuration and Storage
services rather than manually maintaining the list of IP ranges for Azure datacenters. Both
tags are required because Azure Storage hosts the machine configuration content packages.
Communicate over Private Link in Azure
Virtual machines can use private link for communication to the machine configuration service.
Apply tag with the name EnablePrivateNetworkGC and value TRUE to enable this feature. The tag
can be applied before or after machine configuration policy definitions are applied to the machine.
Important
Azure VMs using private link do not require the regional GAS endpoints to be allowlisted or publicly resolvable. Private link traffic is routed through the host connection rather than the internet, so the regional endpoint is never consulted in that path. Custom configuration packages are downloaded from the location specified in the policy assignment. If the package is hosted in an Azure Storage account with a private endpoint configured in the VM's VNet, the download follows the same private link path and no additional URL allowlisting is required. If the package is hosted at a public Azure Storage URL or any non-Azure URL, that URL must be reachable from the VM and added to the allowed URLs list.
Traffic is routed using the Azure virtual public IP address to establish a secure, authenticated channel with Azure platform resources.
Communicate over public endpoints outside of Azure
Servers located on-premises or in other clouds can be managed with machine configuration by connecting them to Azure Arc.
For Azure Arc-enabled servers, allow traffic using the following patterns:
- Port: Only TCP 443 required for outbound internet access
- Global URL:
*.guestconfiguration.azure.com
See the Azure Arc-enabled servers network requirements for a full list of all network endpoints required by the Azure Connected Machine Agent for core Azure Arc and machine configuration scenarios.
Communicate over Private Link outside of Azure
When you use private link with Arc-enabled servers, built-in policy packages are automatically downloaded over the private link. You don't need to set any tags on the Arc-enabled server to enable this feature.
Next steps
Now that you understand the network requirements, continue to the next article to learn about operations and troubleshooting: