Document Azure CLI firewall/proxy requirements

[janegilring]

Related commands

• az login
• az login -identity
• az ssh

Is your feature request related to a problem? Please describe. No

Describe the solution you'd like For the Azure portal, there are documentation for which URLs needs to be allowed when working behind a network proxy or firewall: Allow the Azure portal URLs on your firewall or proxy server - Azure portal

It would be good to have similar documentation for the Azure CLI.

Suggested text for the documentation

Azure CLI is a command-line tool used to manage and interact with Azure services from the command line. Depending on the specific commands you're using and the Azure services you're interacting with, different firewall requirements may apply. However, here are some general guidelines that may help:

• Authentication: Azure CLI uses Azure Active Directory (Azure AD) for authentication and authorization. If your organization has a restrictive firewall policy that blocks outbound traffic to external services, you may need to configure your firewall to allow outbound traffic to Azure AD:
  • URL: https://login.microsoftonline.com
    • If using Azure Firewall or Network Security Groups, it is also possible to allow traffic to the Service Tag AzureActiveDirectory as an alternative to whitelisting the URL.
• Management plane: Azure CLI communicates with the Azure Resource Manager REST API
  • URL: https://management.azure.com
    • If using Azure Firewall or Network Security Groups, it is also possible to allow traffic to the Service Tag AzureResourceManager as an alternative to whitelisting the URL.
• Data plane
  • Virtual machines: If you're using Azure CLI to manage virtual machines, you may need to allow inbound traffic to the virtual machine for the specific ports and protocols required by the application or service running on the VM.
  • Azure Storage: If you're using Azure CLI to manage Azure Storage accounts, you may need to allow outbound traffic to the specific endpoints used by Azure Storage (such as blob.core.windows.net and queue.core.windows.net).
  • Azure Key Vault: Accessing and managing objects (keys and secrets) stored in a Key Vault is going through individual Key Vault-specific endpoints (for example, https://yourvaultname.vault.azure.net).

This is not an exhaustive list of all data planes. You should review the Azure documentation for the specific Azure services you're working with to determine the exact firewall requirements. It's also important to note that these are just general guidelines, and the specific firewall requirements for Azure CLI will depend on your specific use case and configuration.

[yonzhan]

@jiasli for awareness

[bebound]

Please see https://learn.microsoft.com/en-us/cli/azure/azure-cli-endpoints?tabs=azure-cloud

[navba-MSFT]

@janegilring Thanks for reaching out to us and reporting this issue. Could you please check if the above article is what you were looking for ? Awaiting your reply.

[janegilring]

@navba-MSFT The referred article is a good starting point, but I have some feedback to add:

• It would be great to lay out the difference between the management plane and the data plane, similar to what I layed out as an example. The current matrix in the article is not exhaustive for all scenarios (although it might give an impression it is), and it is likely very hard to keep up to date with all Azure services and all scenarios within each service. For example, there are different network requirements for using az ssh arc vs az ssh vm, as the former is proxying traffic via the Azure Arc Connected Machine Agent, while the latter requires a line of sight to the private or public IP of the target machine. Hence, it might make sense to list the endpoint requirements for common services as you already have, but also inform about the list not being exhaustive.
• Informing about the option to leverage service tags in Azure Firewall and Azure Network Security Groups would also be helpful for the target audience.
• Discoverability: I did some research for what is required for using Azure CLI regarding firewalls, but I did not find the article. Would it make sense to add "firewall" to the heading to improve discoverability? For example Allow the Azure CLI URLs on your firewall or proxy server. And also consider to link the Allow the Azure portal URLs on your firewall or proxy server - Azure portal from the CLI article and vice versa since they are related,

[navba-MSFT]

@janegilring Thanks for your reply. I have added the Service team to take this forward.