Azure CLI endpoints for proxy bypass
If your organization is secured with a firewall or proxy server, you must add certain IP (internet protocol) addresses and domain URLs (uniform resource locators) to the allowlist prior to installing the Azure CLI.
Two URLs are used during installation to download Python packages: pypi.org and files.pythonhosted.org.
The following tables provide lists of the endpoints and suffixes used by the Azure CLI. These endpoints are specific to the Azure cloud where your organization is deployed. We don't recommend adding other Azure CLI-related URLs aside from the URLs needed for specific Azure CLI reference groups, although you may want to add URLs related to other Microsoft products and services.
Endpoints
| Endpoint group | Endpoint |
|---|---|
| management | https://management.core.windows.net/ |
| resource_manager | https://management.azure.com/ |
| sql_management | https://management.core.windows.net:8443/ |
| batch_resource_id | https://batch.core.windows.net/ |
| gallery | https://gallery.azure.com/ |
| active_directory | https://login.microsoftonline.com_ |
| active_directory_resource_id | https://management.core.windows.net/ |
| active_directory_graph_resource_id | https://graph.windows.net/ |
| microsoft_graph_resource_id | https://graph.microsoft.com/ |
| active_directory_data_lake_resource_id | https://datalake.azure.net/ |
| vm_image_alias_doc | https://raw.githubusercontent.com/Azure/azure-rest-api-specs/main/arm-compute/quickstart-templates/aliases.json_ |
| media_resource_id | https://rest.media.azure.net_ |
| ossrdbms_resource_id | https://ossrdbms-aad.database.windows.net_ |
| app_insights_resource_id | https://api.applicationinsights.io_ |
| log_analytics_resource_id | https://api.loganalytics.io_ |
| app_insights_telemetry_channel_resource_id | https://dc.applicationinsights.azure.com/v2/track_ |
| synapse_analytics_resource_id | https://dev.azuresynapse.net_ |
| attestation_resource_id | https://attest.azure.net_ |
| portal | https://portal.azure.com_ |
Endpoint suffixes
| Suffix name | Suffix |
|---|---|
| storage_endpoint | *.core.windows.net |
| storage_sync_endpoint | *.afs.azure.net |
| keyvault_dns | *.vault.azure.net |
| mhsm_dns | *.managedhsm.azure.net |
| sql_server_hostname | *.database.windows.net |
| mysql_server_endpoint | *.mysql.database.azure.com |
| postgresql_server_endpoint | *.postgres.database.azure.com |
| mariadb_server_endpoint | *.mariadb.database.azure.com |
| azure_datalake_store_file_system_endpoint | *.azuredatalakestore.net |
| azure_datalake_analytics_catalog_and_job_endpoint | *.azuredatalakeanalytics.net |
| acr_login_server_endpoint | *.azurecr.io |
| synapse_analytics_endpoint | *.dev.azuresynapse.net |
| attestation_endpoint | *.attest.azure.net |
Extensions
Azure CLI extensions are optional and installed separately. The extensions installation procedure includes two steps: module searching and module installation.
Azure CLI uses https://aka.ms/azure-cli-extension-index-v1 to fetch a list of extensions for module searching, whose endpoint is azcliextensionsync.blob.core.windows.net.
All extensions use endpoint azcliprod.blob.core.windows.net for module installation, with the following exceptions:
| Extension name | Endpoint |
|---|---|
| ai-examples | azurecliprod.blob.core.windows.net |
| aksarc | hybridaksstorage.z13.web.core.windows.net |
| akshybrid | hybridaksstorage.z13.web.core.windows.net |
| alias | azurecliprod.blob.core.windows.net |
| arcappliance | arcplatformcliextprod.blob.core.windows.net |
| arcdata | azurearcdatacli.blob.core.windows.net |
| azure-batch-cli-extensions | github.com |
| azure-cli-ml | azurecliext.blob.core.windows.net |
| azure-devops | github.com |
| azure-iot | github.com |
| azure-iot-ops | github.com |
| azure-sphere | software-static.download.prss.microsoft.com |
| azurestackhci | hybridaksstorage.z13.web.core.windows.net |
| cli-translator | azurecliprod.blob.core.windows.net |
| csvmware | github.com |
| customlocation | arcplatformcliextprod.blob.core.windows.net |
| deploy-to-azure | github.com |
| dev-spaces | azurecliprod.blob.core.windows.net |
| footprint | azurecliprod.blob.core.windows.net |
| fzf | pahealyfzf.blob.core.windows.net |
| hybridaks | hybridaksstorage.z13.web.core.windows.net |
| ip-group | azurecliprod.blob.core.windows.net |
| ml | azuremlsdktestpypi.blob.core.windows.net |
| partnercenter | github.com |
| sap-hana | github.com |
| stack-hci-vm | hciarcvmsstorage.z13.web.core.windows.net |
For example, if you are installing the azure-devops extension, you need to add azcliextensionsync.blob.core.windows.net (for searching) and github.com (for installation) to your allowlist. If you are installing extension account that is not in the list above, you need to allow azcliextensionsync.blob.core.windows.net (for searching) and azcliprod.blob.core.windows.net (for installation).
For users who rely on the dynamic extension module installation from CLI recommendations, please also add azurecliextensionsync.blob.core.windows.net into your allowlist for cmd indexing.
