Network egress - what to allow

If your firewall controls outbound traffic, an install needs the hosts below on HTTPS (port 443) unless another port is given. Lists are per product. Any change is announced on this page first.

PIM Manager

What a PIM Manager install talks toA PIM Manager install runs in your own Azure subscription, beside Azure SQL on port 1433, Key Vault, storage and the container registry, which must be allowed too when outbound traffic is restricted. It always reaches login.microsoftonline.com for tokens, graph.microsoft.com for directory, PIM, mail and the Intune and Defender connectors, management.azure.com for Azure roles and the updater, and invardia.com for status reports, the licence request, the install key and, for Pro, the signed update manifest and release package. Only when the feature is used: Exchange Online, Power BI, Power Platform, Business Central, Dataverse, Azure DevOps, and your own alert webhook and SMTP relay on port 587. All on HTTPS, port 443, unless another port is given.YOUR AZURE SUBSCRIPTIONPIM Manager installthe running product and its updaterHTTPS on port 443 unless another port is givenAZURE SERVICES IN YOUR SUBSCRIPTIONallow these too when outbound traffic is restrictedAzure SQLport 1433Key Vaultcertificate, secretsStoragerelease packagesContainer registryimage pullThe admin's machine reaches Microsoft andinvardia.com during setup tooport 443MICROSOFT - ALWAYSlogin.microsoftonline.comtokens and sign-in keysgraph.microsoft.comdirectory, PIM, mail, Intune, Defendermanagement.azure.comAzure roles, updater roll-out + buildINVARDIA - ALWAYSinvardia.comStatus reports - anonymous for Community, identified for ProThe automatic licence request and the install keyPro: the signed update manifest and every release packageONLY WHEN YOU USE THE FEATUREoutlook.office365.comapi.powerbi.comapi.bap.microsoft.comapi.businesscentral.dynamics.com<org>.crm*.dynamics.comvssps.dev.azure.comand your own alert webhook and SMTP relay (port 587), when you set them upWhat a PIM Manager install talks toA PIM Manager install runs in your own Azure subscription, beside Azure SQL on port 1433, Key Vault, storage and the container registry, which must be allowed too when outbound traffic is restricted. It always reaches login.microsoftonline.com for tokens, graph.microsoft.com for directory, PIM, mail and the Intune and Defender connectors, management.azure.com for Azure roles and the updater, and invardia.com for status reports, the licence request, the install key and, for Pro, the signed update manifest and release package. Only when the feature is used: Exchange Online, Power BI, Power Platform, Business Central, Dataverse, Azure DevOps, and your own alert webhook and SMTP relay on port 587. All on HTTPS, port 443, unless another port is given.YOUR AZURE SUBSCRIPTIONPIM Manager installthe running product and its updaterAZURE SERVICES INSIDEallow these too when outbound is restrictedAzure SQLport 1433Key Vaultcertificate, secretsStoragerelease packagesContainer registryimage pullout over HTTPS, port 443MICROSOFT - ALWAYSlogin.microsoftonline.comtokens and sign-in keysgraph.microsoft.comdirectory, PIM, mail, Intune, Defendermanagement.azure.comAzure roles, updater roll-out + buildINVARDIA - ALWAYSinvardia.comStatus reports (anonymous for Community)The licence request and the install keyPro: the signed update manifest andevery release packageONLY WHEN YOU USE THE FEATUREoutlook.office365.comapi.powerbi.comapi.bap.microsoft.comapi.businesscentral.dynamics.com<org>.crm*.dynamics.comvssps.dev.azure.comand your own alert webhook and SMTPrelay (port 587), when you set them up
Every host in the drawing is in the tables below, with what it is used for. Community installs pull their updates from GitHub on the admin's machine; the running product never contacts GitHub.

Reached from outside your Azure - always

HostUsed for
login.microsoftonline.comTokens, and the signing keys for the Manager and MCP sign-in.
graph.microsoft.comAll directory and PIM work, mail through Microsoft Graph, and the Intune and Defender connectors.
management.azure.comAzure RBAC and Azure role PIM, and the updater's roll-out and image build.
invardia.comTelemetry (on by default; anonymous for Community, identified for Pro), the automatic licence request, the install key, and for Pro the signed update manifest and release package. Every Pro download is served from this host.

Reached from outside your Azure - only when the feature is used

HostUsed for
outlook.office365.comExchange Online (mailbox forwarding features).
api.powerbi.comThe Power BI workload.
api.bap.microsoft.comThe Power Platform workload.
api.businesscentral.dynamics.comThe Business Central workload.
<org>.crm*.dynamics.comThe Dataverse workload.
vssps.dev.azure.comThe Azure DevOps workload.
Your own alert webhook (Teams, Slack or another https address) and SMTP relay (port 587)Only when you configure them.

Azure services in your own subscription - only when outbound traffic is restricted

HostUsed for
<server>.database.windows.net (port 1433)Azure SQL.
<vault>.vault.azure.netKey Vault (certificate, SMTP password, MSP signing).
<account>.table.core.windows.netOnly with the access request portal.
<account>.blob.core.windows.netMSP central publish, the release package store for Pro private updates, and the image build upload.
<registry>.azurecr.ioImage pull (done by the platform).
The managing tenant's <store>.blob.core.windows.netMSP managed tenants only: reading the signed baseline.

The admin's own machine during setup

login.microsoftonline.com, graph.microsoft.com, management.azure.com,invardia.com (enrollment), and for Community github.com (updates are pulled on the admin's machine; the running product never contacts GitHub).

On a private network see also the PIM Manager network guides.

SecurityInsight

The SecurityInsight list is being verified against its code and will be published here.