The download URL for Pipelines Agent is changing soon. Azure DevOps Customers using Pipelines with Self Hosted Agents must update their network configuration and add a new Domain URL to their Firewall allowlist by 1st May 2025.

Question

The download URL for Pipelines Agent is changing soon. Azure DevOps Customers using Pipelines with Self Hosted Agents must update their network configuration and add a new Domain URL to their Firewall allowlist by 1st May 2025.

Lalitha Subramanian 25

I got a message in Azure devops URL that

"The download URL for Pipelines Agent is changing soon. Azure DevOps Customers using Pipelines with Self Hosted Agents must update their network configuration and add a new Domain URL to their Firewall allowlist by 1st May 2025."

How do we find if we are the impacted customer? We are using Pay as you go subscription for Azure.

Would be great to get an immediate help to solve this and find alternate solution. A teams call would also help at ******@nriol.net. The devops URL is https://greenriskmanager.visualstudio.com/

Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T09:06:58.1266667+00:00
Hi Lalitha Subramanian,

How do we find if we are the impacted customer?

To check you are impacted

Navigate to Organization settings => Agent pools => Self hosted agents

If you see any self-hosted agents, then you are impacted.

If you are impacted then, you need to add anew domain through your firewall.

Refer this Dev Blogs for more details.
Lalitha Subramanian 25 Reputation points

2025-04-23T09:26:06.8333333+00:00

yes I see one Hosted agent. where should I add the new domain.. Can you pls put the steps and the URL to add
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T09:45:12.13+00:00

Did you check the Update the firewall Allow list section in the above shared Doc?
Lalitha Subramanian 25 Reputation points

2025-04-23T09:50:28.4433333+00:00

yes I checked. But in azure portal we can restrict /allow only IP address and not the fully qualified domain name. But the IP will be changing for https://download.agent.dev.azure.com right? then how do I add this to the firewall
Lalitha Subramanian 25 Reputation points

2025-04-23T15:29:49.3+00:00

In azure portal we have outbound rule enabled for port 443 and not restricted. Is this enough to allow the specified URL or anything more required to whitelist?
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T15:37:04.97+00:00

Yes, @Lalitha Subramanian

Can you please try this once and check.
Lalitha Subramanian 25 Reputation points

2025-04-23T16:26:38.48+00:00

Outbound.png

yes already checked and attached here. Please let me know if this is sufficient or should we add more to the NSG rules
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T18:01:44.5833333+00:00

Lalitha Subramanian, AFAIK, there is no need to add NSG rules for now, as you have already allowed outbound traffic to port 443.
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-24T10:45:24.7933333+00:00
Hi Lalitha Subramanian,

You will be Impacted if you are using Self-hosted agent pools.

Check the below steps to know whether you are impacted:

Navigate to Organization settings => Agent pools => Self hosted agents

If you see any self-hosted agents, then you are impacted.

As per out discussion in comments, it is clear that you have self-hosted agents.

As mentioned in Dev Blogs, you need to add a new domain through your firewall if you are impacted.

Add firewall under, Network security groups => Outbound security rules

Since outbound traffic on port 443 (HTTPS) is already allowed this is generally sufficient to access https://download.agent.dev.azure.com

Unless outbound traffic is further restricted by IP ranges or another firewall like Azure Firewall.

No changes are needed to your NSG if it's already open for HTTPS.

Network Security Groups (NSGs) do not support FQDN (Fully Qualified Domain Name) based rules. Hope this helps
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-24T15:03:21.2133333+00:00

Hi Lalitha Subramanian, just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Subramani S 0 Reputation points

2025-04-28T09:41:07.4933333+00:00

@Harshitha Veeramalla
How we can add a qualified a network domain URL in Azure (Path)? and how we can identify the agent is self hosted or not?

1 answer

Your answer

Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T09:06:58.1266667+00:00

Hi Lalitha Subramanian,

How do we find if we are the impacted customer?

To check you are impacted

Navigate to Organization settings => Agent pools => Self hosted agents

If you see any self-hosted agents, then you are impacted.

If you are impacted then, you need to add anew domain through your firewall.

Refer this Dev Blogs for more details.
Lalitha Subramanian 25 Reputation points

2025-04-23T09:26:06.8333333+00:00

yes I see one Hosted agent. where should I add the new domain.. Can you pls put the steps and the URL to add
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T09:45:12.13+00:00

Did you check the Update the firewall Allow list section in the above shared Doc?
Lalitha Subramanian 25 Reputation points

2025-04-23T09:50:28.4433333+00:00

yes I checked. But in azure portal we can restrict /allow only IP address and not the fully qualified domain name. But the IP will be changing for https://download.agent.dev.azure.com right? then how do I add this to the firewall
Lalitha Subramanian 25 Reputation points

2025-04-23T15:29:49.3+00:00

In azure portal we have outbound rule enabled for port 443 and not restricted. Is this enough to allow the specified URL or anything more required to whitelist?
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T15:37:04.97+00:00

Yes, @Lalitha Subramanian

Can you please try this once and check.
Lalitha Subramanian 25 Reputation points

2025-04-23T16:26:38.48+00:00

Outbound.png

yes already checked and attached here. Please let me know if this is sufficient or should we add more to the NSG rules
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-23T18:01:44.5833333+00:00

Lalitha Subramanian, AFAIK, there is no need to add NSG rules for now, as you have already allowed outbound traffic to port 443.
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-24T10:45:24.7933333+00:00

Hi Lalitha Subramanian,

You will be Impacted if you are using Self-hosted agent pools.

Check the below steps to know whether you are impacted:

Navigate to Organization settings => Agent pools => Self hosted agents

If you see any self-hosted agents, then you are impacted.

As per out discussion in comments, it is clear that you have self-hosted agents.

As mentioned in Dev Blogs, you need to add a new domain through your firewall if you are impacted.

Add firewall under, Network security groups => Outbound security rules

Since outbound traffic on port 443 (HTTPS) is already allowed this is generally sufficient to access https://download.agent.dev.azure.com

Unless outbound traffic is further restricted by IP ranges or another firewall like Azure Firewall.

No changes are needed to your NSG if it's already open for HTTPS.

Network Security Groups (NSGs) do not support FQDN (Fully Qualified Domain Name) based rules. Hope this helps
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-24T15:03:21.2133333+00:00

Hi Lalitha Subramanian, just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Subramani S 0 Reputation points

2025-04-28T09:41:07.4933333+00:00

@Harshitha Veeramalla
How we can add a qualified a network domain URL in Azure (Path)? and how we can identify the agent is self hosted or not?

Answer 1

Divyesh Govaerdhanan 6,400

Hello,

Welcome to Microsoft Q&A,

Microsoft is changing the download URL for Azure DevOps Pipelines Agent binaries. If your self-hosted agents are configured to download agent updates and tools behind a firewall or proxy, you may need to allowlist a new domain.

You are not impacted if:

You use only Microsoft-hosted agents in your pipelines
OR your self-hosted agents have unrestricted internet access

You are impacted if:

You are using Self-Hosted Agents (on-premise VMs, internal VMs, hosted within a VNET or DMZ) for Azure Pipelines
AND your environment uses network restrictions, such as:
- Firewalls
- Web proxies
- NSGs restricting outbound traffic
- Private networks (e.g., no internet access unless explicitly allowed)

If you have network restriction enabled, Allow the URL below to your firewall allowlist,

https://vstsagentpackage.azureedge.net

Please Upvote and Accept the answer if it helps!!

Lalitha Subramanian 25 Reputation points

2025-04-23T09:26:41.18+00:00

Thanks for your reply.

Our devops build pipeline is using our VM as an agent and the screenshot attached here Agent.png

We have NSG defined for the VM in Azure portal. Inbound rules define the IP address which can access the VM and there are outbound rules for Antivirus for ports 80 and 443. We pinged the URL https://vstsagentpackage.azureedge.net from our VM and it works fine. Please let me know how and where we need to whitelist this URL
Divyesh Govaerdhanan 6,400 Reputation points

2025-04-23T22:01:21.23+00:00

Hello Lalitha,

At the NSG level, if outbound traffic on ports 80 and 443 (TCP & Any) is already allowed, then you're in good shape.

Based on the image shared above, your configuration appears correct — the agent VM has the necessary access, and no additional changes are required at the moment.Please Upvote and accept this thread as answer if it helps!!
Subramani S 0 Reputation points

2025-04-28T10:07:55.5033333+00:00

@Divyesh Govaerdhanan @Lalitha Subramanian How we can verify self hosted agent has restricted internet access or not?
Subramani S 0 Reputation points

2025-04-29T08:24:03.8166667+00:00

@Divyesh Govaerdhanan @Lalitha Subramanian @Harshitha Veeramalla How we can identify the NSG'S as well, since we have multiple NSG's in Azure portal.
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-29T09:52:49.98+00:00

Hi @Subramani S,
To identify the Network Security Group (NSG) attached to a VM, Navigate to the Azure portal => Virtual Machine => Networking => Network Security Group. If you want to allow internet access from the VM, you can create an outbound rule as shown in the screenshot.
Subramani S 0 Reputation points

2025-04-29T10:49:10.2733333+00:00

@Harshitha Veeramalla Thanks, Image wasn't attached properly could you please share the Image again?

How we can identify where the self-hosted agent is hosted or located?
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-29T11:03:56.6933333+00:00

@Subramani S, please check the updated image.
Subramani S 0 Reputation points

2025-04-29T11:06:24.4966667+00:00

Harshitha Veeramalla Thanks, I can see the updated image now.

Could you please advise how we can identify where Self-hosted agent is located or hosted?
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-04-29T15:22:19.61+00:00

Subramani S, you can see the self-hosted agents at
Organization settings => Agent pools => Self hosted agents

Share via

The download URL for Pipelines Agent is changing soon. Azure DevOps Customers using Pipelines with Self Hosted Agents must update their network configuration and add a new Domain URL to their Firewall allowlist by 1st May 2025.

1 answer

Your answer