Firewall settings for labs when using lab accounts


The information in this article applies to early versions of Azure Lab Services prior to the August 2022 Update. Newer updates to the service build upon lab plans instead of lab accounts.

As part of the August 2022 update, Azure Lab Services lab plans replace lab accounts. For new customers, learn how you can get started by creating a lab plan. For existing lab account customers we recommend that you transition from lab accounts to lab plans.

Beginning February 21st, 2023, you won't be able to create a Lab Account to use the service. If you have a new subscription, you will instead be able to create a Lab plan to use the service.

If you already have a Lab account, you can continue to use it and if you need additional lab accounts, as an exception, you can submit an Azure support ticket.

Each organization or school will configure their own network in a way that best fits their needs. Sometimes that includes setting firewall rules that block Remote Desktop Protocol (RDP) or Secure Shell (SSH) connections to machines outside their own network. Because Azure Lab Services runs in the public cloud, some extra configuration maybe needed to allow students to access their VM when connecting from the campus network.

Each lab uses single public IP address and multiple ports. All VMs, both the template VM and student VMs, will use this public IP address. The public IP address won't change for the life of lab. Each VM will have a different port number. The port numbers range is 49152 - 65535. The combination of public IP address and port number is used to connect educators and students to the correct VM. This article will cover how to find the specific public IP address used by a lab. That information can be used to update inbound and outbound firewall rules so students can access their VMs.


Each lab will have a different public IP address.


If your school needs to perform content filtering, such as for compliance with the Children's Internet Protection Act (CIPA), you will need to use 3rd party software. For more information, read guidance on content filtering with Lab Services.

Find public IP for a lab

The public IP addresses for each lab are listed in the All labs page of the Lab Services lab account. For directions how to find the All labs page, see View labs in a lab account.

Screenshot of the all labs page of a lab account.


You won't see the public IP address if the template machine for your lab isn't published yet.


Now we know the public IP address for the lab. Inbound and outbound rules can be created for the organization's firewall for the public IP address and the port range 49152 - 65535. Once the rules are updated, students can access their VMs without the network firewall blocking access.

Next steps