Required Outbound Internet Access from AVD Session Host VMs

In some Azure environments, newly created session host VMs are restricted from connecting to the internet. This may be done with custom routing and network security groups (NSG) at the virtual network level or with proxy settings or custom security configurations pushed to the session host VMs via Active Directory GPO.

In order for Nerdio Manager to be able to automate the creation and management of AVD session host VMs, the following access to Azure and Microsoft services must be possible.

Azure Virtual Desktop session hosts require additional ports opened when making use of file shares for FSLogix. Please see this Microsoft article for additional information on FSLogix network requirements.

The following table lists optional URLs that your session host virtual machines might also need to access for other services:

Aside from the above connections, some scripted actions and Nerdio Manager functions pull binaries from various websites, such as Official Download pages and open-source GitHub repos. You should include these addresses in your firewall exclusions if you make use of automated deployment for the applications listed.

If desired, it is possible to read the scripts and retrieve the appropriate downloads, then self-host the files and change the scripted action code to point to your own servers. This allows further control for heavily restricted environments, but may introduce increased maintenance and complexity.