Announcing: New Windows App client-side endpoints for Azure Virtual Desktop

Beginning in early October 2026, Windows App will begin using three new wildcard fully qualified domain names (FQDNs) for client-side service traffic to Azure Virtual Desktop. These domains are already included in the cloud-side connectivity requirements. If your organization applies network controls to devices running Windows App, you must allow these endpoints before activation. If the endpoints are not reachable, users may experience sign-in and connection failures.

This is a client-side change for Windows App and is separate from the previous cloud-side domain update. Organizations that have already completed the cloud-side update should still review proxy, firewall, VPN, DNS filtering, and Secure Web Gateway policies that apply to user devices to ensure these endpoints are allowed.

This work is part of a wider Microsoft approach to unify domain requirements.

Required client-side endpoints

*.windows.cloud.microsoft

• Purpose: General Windows cloud service traffic

• Port: 443/TCP

*.service.windows.cloud.microsoft

• Purpose: Service traffic which requires optimization

• Port: 443/TCP

*.windows.static.microsoft

• Purpose: Static content, installation, and update assets

• Port: 443/TCP

Timeline

Windows App will begin using these endpoints in early October 2026.

Who is affected?

Organizations that:

• Use Windows App to connect to Azure Virtual Desktop.
• Apply firewall, proxy, VPN, DNS filtering, Secure Web Gateway, or similar controls to end-user devices.

Potential Impact

If these endpoints are unavailable, blocked, or inspected in a way that interrupts the connection, users may experience failures during sign-in, resource discovery, connection, or an active session.