Azure Arc-enabled Kubernetes network requirements

This topic describes the networking requirements for connecting a Kubernetes cluster to Azure Arc and supporting various Arc-enabled Kubernetes scenarios.


Generally, connectivity requirements include these principles:

  • All connections are TCP unless otherwise specified.
  • All HTTP connections use HTTPS and SSL/TLS with officially signed and verifiable certificates.
  • All connections are outbound unless otherwise specified.

To use a proxy, verify that the agents and the machine performing the onboarding process meet the network requirements in this article.


Azure Arc agents require the following outbound URLs on https://:443 to function. For *, websockets need to be enabled for outbound access on firewall and proxy.

Endpoint (DNS) Description Required for the agent to connect to Azure and register the cluster.
https://<region> Data plane endpoint for the agent to push status and fetch configuration information.
Required to fetch and update Azure Resource Manager tokens.
Required to pull container images for Azure Arc agents. Required to get the regional endpoint for pulling system-assigned Managed Identity certificates.
https://* Required to pull system-assigned Managed Identity certificates. az connectedk8s connect uses Helm 3 to deploy Azure Arc agents on the Kubernetes cluster. This endpoint is needed for Helm client download to facilitate deployment of the agent helm chart.
For Cluster Connect and for Custom Location based scenarios.
* For Cluster Connect and for Custom Location based scenarios. Required when Azure RBAC is configured.
* Required to manage connected clusters in Azure portal.
https://<region> Required when Cluster Connect is configured. Required when automatic agent upgrade is enabled.

To translate the * wildcard into specific endpoints, use the command:


To get the region segment of a regional endpoint, remove all spaces from the Azure region name. For example, East US 2 region, the region name is eastus2.

For example: san-af-<region> should be in the East US 2 region.

To see a list of all regions, run this command:

az account list-locations -o table
Get-AzLocation | Format-Table

Additional endpoints

Depending on your scenario, you may need connectivity to other URLs, such as those used by the Azure portal, management tools, or other Azure services. In particular, review these lists to ensure that you allow connectivity to any necessary endpoints:

For a complete list of network requirements for Azure Arc features and Azure Arc-enabled services, see Azure Arc network requirements.

Next steps