Allow Microsoft Azure URLs

You must allow Microsoft Azure URLs to allow Microsoft Entra ID (Azure AD) SSO (Single sign-on) authentication.

Allow URLs for all traffic

You must allow the following Microsoft Azure URLs for all traffic:

For the latest list of Microsoft Azure URLs, see Allow the Azure portal URLs on your firewall or proxy server.

Create an FQDN host

Do the following for each URL:

1. Go to Hosts and services > FQDN host.
2. Click Add.
3. Enter the URL as the name.
4. Enter the URL in FQDN.
5. Click Save.

Create an FQDN host group

1. Go to Hosts and services > FQDN host group.
2. Click Add.
3. Enter a name.
4. Click Add new item and select the FQDN hosts you created.
5. Click Save.

Create a firewall rule

1. Go to Rules and policies > Firewall rules.
2. Click IPv4 > Add firewall rule > New firewall rule.

3. Configure as follows:

   Setting	Value
   Rule name	Enter a name.
   Action	Accept
   Source zones	LAN
   Source networks and devices	Any
   Destination zones	WAN
   Destination networks	Select the FQDN host group you created.
   Services	DNS HTTPS

4. Click Save.

Direct web proxy mode

In direct web proxy mode, in addition to the firewall rules required for authentication, you must add the following Microsoft Azure URLs in a web exception:

To add the Microsoft Azure URLs in a web exception, do as follows:

1. Go to Web > Exceptions and click Add an exception.
2. Enter a name.
3. Select URL pattern matches.
4. Enter each URL in Search/Add and click Add .
5. Select all the checks and actions.
6. Click Save.