azure-services-web-domains.md (10710B)
1 --- 2 title: "Azure Services - DNS Suffix" 3 section: "Cloud" 4 sectionSlug: "cloud" 5 sourcePath: "docs/cloud/azure/azure-services-web-domains.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/cloud/azure/azure-services-web-domains.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Azure Services - DNS Suffix 12 13 ## DNS Tables 14 15 Many Azure services dynamically generate custom endpoints utilizing a trusted cloud suffix (such as `.cloudapp.azure.com` or `.windows.net`). Maintaining a structured inventory of these suffixes is critical for security auditing, zero-trust network design, and defensive threat research. 16 17 These services can also be leveraged for domain fronting, subdomain takeover, or communication with an external C2 server when they are whitelisted by proxy or firewall rules. 18 19 --- 20 21 ## DNS Tables by Category 22 23 ### Compute & Containers 24 25 | Service | Domain | 26 | -------------------------------------------------------- | --------------------------------------- | 27 | App Services (Web App / API App / Function App) Suffix | `.azurewebsites.net` | 28 | App Service SCM / Kudu (Deployment Suffix) | `.scm.azurewebsites.net` | 29 | Azure Static Web Apps Suffix | `.azurestaticapps.net` | 30 | Azure Container Apps Environment Suffix | `.<UID>.<REGION>.azurecontainerapps.io` | 31 | Azure Container Registry Suffix | `.azurecr.io` | 32 | Azure Kubernetes Service (AKS) API Suffix | `.azmk8s.io` | 33 | Azure Container Instance (ACI) Suffix | `.azurecontainer.io` | 34 | Azure Container Instance (ACI) Internal Suffix | `.internal.azurecontainer.io` | 35 | Azure Spring Apps Suffix | `.azuremicroservices.io` | 36 | Batch Suffix | `.batch.azure.com` | 37 | Cloud Services (Classic) & VMs Suffix | `.cloudapp.net` | 38 | Cloud Services (Extended Support) & Resource Manager VMs | `.cloudapp.azure.com` | 39 | Service Fabric Suffix | `.cloudapp.azure.com` | 40 41 ### DevOps & Developer Tooling 42 43 | Service | Domain | 44 | -------------------------- | ---------------- | 45 | Azure DevOps Modern Suffix | `.dev.azure.com` | 46 47 ### Management, Hybrid & Observability 48 49 | Service | Domain | 50 | ---------------------------------------------- | -------------------------------- | 51 | Azure Management Services (ARM) Suffix | `.management.core.windows.net` | 52 | Azure Arc Hybrid Suffix | `.azurearc.microsoft.com` | 53 | Azure Bastion Suffix | `.bastion.azure.com` | 54 | Azure Virtual Desktop (WVD) Suffix | `.wvd.microsoft.com` | 55 | Log Analytics Data Ingestion (ODS) Suffix | `.ods.opinsights.azure.com` | 56 | Log Analytics Agent Communication (OMS) Suffix | `.oms.opinsights.azure.com` | 57 | Azure Monitor Suffix | `.monitor.azure.com` | 58 | Azure Automation Agent Service Suffix | `.agentsvc.azure-automation.net` | 59 | Automation Suffix | `.azure-automation.net` | 60 | App Configuration Suffix | `.azconfig.io` | 61 | Microsoft Purview Suffix | `.purview.azure.com` | 62 63 ### Backup & Disaster Recovery 64 65 | Service | Domain | 66 | -------------------------- | ----------------------------------------- | 67 | Azure Backup Suffix | `.backup.windowsazure.com` | 68 | Azure Site Recovery Suffix | `.hypervrecoverymanager.windowsazure.com` | 69 70 ### Storage & Data Lakes 71 72 | Service | Domain | 73 | ---------------------------------------- | ----------------------------- | 74 | Blob Endpoint Suffix | `.blob.core.windows.net` | 75 | File Endpoint Suffix | `.file.core.windows.net` | 76 | Queue Endpoint Suffix | `.queue.core.windows.net` | 77 | Table Endpoint Suffix | `.table.core.windows.net` | 78 | Data Lake Gen2 (DFS) Suffix | `.dfs.core.windows.net` | 79 | Data Lake Store (Gen 1) Suffix | `.azuredatalakestore.net` | 80 | Data Lake Analytics Catalog Suffix | `.azuredatalakeanalytics.net` | 81 | Static Web Sites (Storage-hosted) Suffix | `.web.core.windows.net` | 82 83 ### Databases & Analytics 84 85 | Service | Domain | 86 | ---------------------------------------------- | ------------------------------ | 87 | SQL Database Suffix | `.database.windows.net` | 88 | Cosmos DB (SQL/Document API) Suffix | `.documents.azure.com` | 89 | Cosmos DB (NoSQL API) Suffix | `.cosmos.azure.com` | 90 | Cosmos DB (Cassandra API) Suffix | `.cassandra.cosmos.azure.com` | 91 | Cosmos DB (Gremlin API) Suffix | `.gremlin.cosmos.azure.com` | 92 | Cosmos DB (MongoDB API) Suffix | `.mongo.cosmos.azure.com` | 93 | Cosmos DB (Table API) Suffix | `.table.cosmos.azure.com` | 94 | Azure Database for PostgreSQL Suffix | `.postgres.database.azure.com` | 95 | Azure Database for MySQL Suffix | `.mysql.database.azure.com` | 96 | Azure Database for MariaDB Suffix | `.mariadb.database.azure.com` | 97 | Azure Synapse Analytics (SQL) Suffix | `.sql.azuresynapse.net` | 98 | Azure Synapse Analytics (Dev/Workspace) Suffix | `.dev.azuresynapse.net` | 99 | Azure Databricks Suffix | `.azuredatabricks.net` | 100 | Azure HDInsight Suffix | `.azurehdinsight.net` | 101 | Redis Cache Suffix | `.redis.cache.windows.net` | 102 | Analysis Services Suffix | `.asazure.windows.net` | 103 104 ### Networking & Content Delivery 105 106 | Service | Domain | 107 | ------------------------------------ | ------------------------- | 108 | Traffic Manager Suffix | `.trafficmanager.net` | 109 | Front Door (Classic) Suffix | `.azurefd.net` | 110 | Front Door (Standard/Premium) Suffix | `.<hash>.z01.azurefd.net` | 111 | CDN Suffix | `.azureedge.net` | 112 | CDN Edge / Origin Suffix | `.vo.msecnd.net` | 113 114 ### AI, Machine Learning & Cognitive Services 115 116 | Service | Domain | 117 | --------------------------------------------- | ------------------------------ | 118 | Azure AI Services (Cognitive Services) Suffix | `.cognitiveservices.azure.com` | 119 | Azure OpenAI Suffix | `.openai.azure.com` | 120 | Azure AI Search Suffix | `.search.windows.net` | 121 | Azure Machine Learning API Suffix | `.api.azureml.ms` | 122 | Azure Machine Learning Notebook Suffix | `.notebooks.azure.net` | 123 124 ### Integration & IoT 125 126 | Service | Domain | 127 | ------------------------------------------------ | --------------------------------- | 128 | API Management Suffix | `.azure-api.net` | 129 | Service Bus Suffix | `.servicebus.windows.net` | 130 | Event Hubs Suffix | `.servicebus.windows.net` | 131 | Event Grid (Topic) Suffix | `.eventgrid.azure.net` | 132 | Azure Data Factory Suffix | `.datafactory.azure.net` | 133 | Logic App Suffix | `.azurewebsites.net` | 134 | IoT Hub Suffix | `.azure-devices.net` | 135 | IoT Hub Device Provisioning Service (DPS) Suffix | `.azure-devices-provisioning.net` | 136 | Azure IoT Central Suffix | `.azureiotcentral.com` | 137 | Azure Digital Twins Suffix | `.digitaltwins.azure.net` | 138 | Azure SignalR Service Suffix | `.service.signalr.net` | 139 140 ### Identity & Security 141 142 | Service | Domain | 143 | --------------------------------------- | ----------------------- | 144 | Key Vault Suffix | `.vault.azure.net` | 145 | Managed HSM Suffix | `.managedhsm.azure.net` | 146 | Microsoft Entra ID Suffix (onmicrosoft) | `.onmicrosoft.com` | 147 | Microsoft Graph API Suffix | `.graph.microsoft.com` | 148 149 --- 150 151 ### Sovereign & Cloud Variations 152 153 | Cloud Environment | Domain | 154 | ---------------------- | ------------------------------------------------------------------------------------ | 155 | Azure US Government | `.usgovcloudapi.net`, `.database.usgovcloudapi.net`, `.servicebus.usgovcloudapi.net` | 156 | Azure China (21Vianet) | `.chinacloudapi.cn`, `.core.chinacloudapi.cn`, `.database.chinacloudapi.cn` | 157 | Azure Germany (Legacy) | `.cloudapp.de` | 158 159 --- 160 161 ## References 162 163 * [Azure services URLs and IP addresses for firewall or proxy whitelisting - Daniel Neumann - 20. December 2016](https://www.danielstechblog.io/azure-services-urls-and-ip-addresses-for-firewall-or-proxy-whitelisting/) 164 * [Reference list of Azure domains - Microsoft - 14. May 2024](https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-domains) 165 * [Azure Storage account overview (Endpoints) - Microsoft - 14. February 2024](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview#storage-account-endpoints) 166 * [Compare Azure Government and global Azure - Microsoft - 28. February 2024](https://learn.microsoft.com/en-us/azure/azure-government/compare-azure-government-global-azure) 167 * [Developer guide for Azure China 21Vianet - Microsoft - 15. January 2024](https://learn.microsoft.com/en-us/azure/china/resources-developer-guide)