Events
Mar 31, 11 PM - Apr 2, 11 PM
The biggest Fabric, Power BI, and SQL learning event. March 31 – April 2. Use code FABINSIDER to save $400.
Register todayAdd Fabric URLs to your allowlist
This article contains the allowlist of the Microsoft Fabric URLs required for interfacing with Fabric workloads. For the Power BI allowlist, see Add Power BI URLs to your allowlist.
The URLs are divided into two categories: required and optional. The required URLs are necessary for the service to work correctly. The optional URLs are used for specific features that you might not use. To use Fabric, you must be able to connect to the endpoints marked required in the tables in this article, and to any endpoints marked required on the linked sites. If the link to an external site refers to a specific section, you only need to review the endpoints in that section. You can also add endpoints that are marked optional to allowlists for specific functionality to work.
Fabric requires only TCP Port 443 to be opened for the listed endpoints.
The tables in this article use the following conventions:
- Wildcard (*): Represents all levels under the root domain.
- N/A: No specific port required.
The Endpoint column lists domain names and links to external sites, which contain further endpoint information.
| Purpose | Endpoint | Port |
|---|---|---|
| Required: Portal | *.fabric.microsoft.com | TCP 443 |
| Purpose | Endpoint | Port |
|---|---|---|
| For OneLake access for DFS APIs (default Onelake endpoint) | *.onelake.dfs.fabric.microsoft.com | TCP 443 |
| Onelake endpoint for calling Blob APIs | *.onelake.blob.fabric.microsoft.com | TCP 443 |
| Optional: Regional Endpoints for DFS APIs | *<region>-onelake.dfs.fabric.microsoft.com | TCP 443 |
| Optional: Regional Endpoints for Blob APIs | *<region>-onelake.blob.fabric.microsoft.com | TCP 443 |
| Purpose | Endpoint | Port |
|---|---|---|
| For outbound connections | ||
| Required: Portal | *.powerbi.com | TCP 443 |
| Required: Backend APIs for Portal | *.pbidedicated.windows.net | TCP 443 |
| Required: Cloud pipelines | No specific endpoint is required | N/A |
| Optional: On-premises data gateway login | *.login.windows.net login.live.com aadcdn.msauth.net login.microsoftonline.com *.microsoftonline-p.com See the documentation for Adjust communication settings for the on-premises data gateway |
TCP 443 |
| Optional: On-premises data gateway communication | *.servicebus.windows.net | TCP 443 TCP 5671-5672 TCP 9350-9354 |
| Optional: On-premises data gateway pipelines | *.frontend.clouddatahub.net (User can use service tag DataFactory or DataFactoryManagement) |
TCP 443 |
| For inbound connections | No specific endpoints other than the customer's data store endpoints required in pipelines and behinds the firewall. (User can use service tag DataFactory, regional tag is supported, like DataFactory.WestUs) |
| Purpose | Endpoint | Port |
|---|---|---|
| Inbound connections | https://cdn.jsdelivr.net/npm/monaco-editor* | N/A |
| Purpose | Endpoint | Port |
|---|---|---|
| Inbound connections (icons) | http://res.cdn.office.net/ | N/A |
| Required: Notebook backend | https://*.pbidedicated.windows.net wss://*.pbidedicated.windows.net (HTTP/WebSocket) |
N/A |
| Required: Lakehouse backend | https://onelake.dfs.fabric.microsoft.com | N/A |
| Required: Shared backend | https://*.analysis.windows.net | N/A |
| Required: DE/DS extension UX | https://pbides.powerbi.com | N/A |
| Required: Notebooks UX | https://aznb-ame-prod.azureedge.net | N/A |
| Required: Notebooks UX | https://*.notebooks.azuresandbox.ms | N/A |
| Required: Notebooks UX | https://content.powerapps.com | N/A |
| Required: Notebooks UX | https://aznbcdn.notebooks.azure.net | N/A |
| Purpose | Endpoint | Port |
|---|---|---|
| Inbound connections (icons) | http://res.cdn.office.net/ | N/A |
| Inbound connections (library management for PyPI) | https://pypi.org/* | N/A |
| Inbound connections (library management for Conda) | local static endpoints for condaPackages | N/A |
| Purpose | Endpoint | Port |
|---|---|---|
| Required: Datamart SQL | datamart.fabric.microsoft.com | TCP 1433 |
| Required: Datamart SQL | datamart.pbidedicated.microsoft.com | TCP 1433 |
| Required: Datamart SQL | *.pbidedicated.microsoft.com | TCP 1433 |
| Required: Fabric DW SQL | datawarehouse.fabric.microsoft.com | TCP 1433 |
| Required: Fabric DW SQL | datawarehouse.pbidedicated.microsoft.com | TCP 1433 |
| Required: Fabric DW SQL | *.pbidedicated.microsoft.com | TCP 1433 |
| Required: Fabric DW SQL | *.pbidedicated.windows.net | TCP 1433 |
| Purpose | Endpoint | Port |
|---|---|---|
| Inbound connections (library management for PyPI) | https://pypi.org/* | N/A |
| Inbound connections (library management for Conda) | local static endpoints for condaPackages | N/A |
| Purpose | Endpoint | Port |
|---|---|---|
| https://*.z[0-9].kusto.fabric.microsoft.com |
| Purpose | Endpoint | Port |
|---|---|---|
| Customers can send/read events from Eventstream in their custom app | sb://*.servicebus.windows.net | http: 443 amqp: 5672/5673 kafka: 9093 |
Additional resources
Training
Learning path
Get started with Microsoft Fabric - Training
Explore how to implement data analytics solutions on a single platform with Microsoft Fabric. Integrate, transform, and store data to train AI models and create insightful reports.
Certification
Microsoft Certified: Fabric Data Engineer Associate - Certifications
As a Fabric Data Engineer, you should have subject matter expertise with data loading patterns, data architectures, and orchestration processes.
Documentation
-
Service tags - Microsoft Fabric
Learn how to use service tags in Microsoft Fabric.
-
Protect inbound traffic - Microsoft Fabric
Understand the difference between private links and Microsoft Entra Conditional and decide which is best for your organization.
-
Set up and use private links for secure access to Fabric - Microsoft Fabric
Learn how to set up and use private links to provide secure access to Fabric.