Question

Your organization deploys an AVD host pool in a subnet that is locked down by a network security group (NSG). The security team wants to deny all outbound internet traffic by default but must still allow the session hosts to reach the AVD control plane (agent registration, broker, gateway, and diagnostics) without maintaining a manually updated list of public IP addresses. Which NSG outbound rule configuration best meets this requirement?

Accepted Answer

Add an outbound Allow rule using the WindowsVirtualDesktop service tag as the destination, then a lower-priority Deny rule for the Internet service tag.

Answer

Add an outbound Allow rule with destination set to a static list of Microsoft datacenter public IP ranges downloaded from the JSON feed.

Answer

Add an outbound Allow rule using the AzureCloud service tag as the destination and rely on Azure Firewall FQDN tags for granularity.

Answer

Add an outbound Allow rule using the VirtualNetwork service tag and enable forced tunneling through an on-premises proxy.