Azure Ad Connect Firewall Ports
To set up azure ad connect firewall ports, allow outbound HTTPS traffic from your sync server. You must also open local network ports between the sync host and your domain controllers. Teams often open broad network ranges to get directory sync working fast. Overly broad firewall rules and admin roles expose domain controllers and cloud systems to risk. How azure ad connect firewall ports work in practice The sync tool links your local directory to your cloud identity tenant. It runs on a ded
Azure RBAC + Firewall Configuration: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To set up azure ad connect firewall ports, allow outbound HTTPS traffic from your sync server. You must also open local network ports between the sync host and your domain controllers. Teams often open broad network ranges to get directory sync working fast. Overly broad firewall rules and admin roles expose domain controllers and cloud systems to risk.
How azure ad connect firewall ports work in practice
The sync tool links your local directory to your cloud identity tenant. It runs on a dedicated Windows server inside your private network. That server reads user and group data from your local domain controllers. Then it sends those updates out to the cloud identity service.
Traffic flows in two main parts during every sync cycle. First, the sync server talks to local domain controllers over standard directory ports. This local link uses DNS, Kerberos, LDAP, and RPC traffic to read accounts. Second, the server sends changes to the cloud over outbound HTTPS connections.
The sync tool does not need inbound ports open from the public internet. It starts all cloud connections from inside your local network over the configured port. You also need the configured port open so the server can check certificate lists. If a firewall blocks these outbound checks, the sync job fails to start.
Some teams also turn on hybrid sign-in features like pass-through login. These features use outbound links to read login requests from the cloud queue. The agent checks the password against your local directory and sends back the result. All of this traffic still flows out over standard web ports.
How to scope local and outbound network rules
Start by placing the sync server in a restricted network segment. Only allow local traffic between this host and specific domain controllers. Do not open directory ports to the whole internal network. Tight local rules stop attackers from moving sideways if a host gets breached.
Next, set up your perimeter firewall to allow outbound traffic to cloud endpoints. Allow the sync server to reach Microsoft login and directory domains over HTTPS. Keep the configured port open to certificate authorities so SSL checks can finish. Avoid TLS inspection on this traffic because breaking encryption stops the sync agent.
Azure RBAC + Firewall Configuration: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
You should also limit the service account roles used by the sync tool. Give the local account only the rights it needs to read directory objects. When teams use full domain admin accounts, any server breach becomes a total outage. Least privilege on the account matters just as much as tight firewall rules.
What directory sync solves and what it leaves open
Properly scoped firewall ports and sync rules keep your user list current. When HR adds or removes a worker, that change reaches the cloud fast. Central identity makes it easy to check who can log in to systems. It solves the problem of keeping local and cloud accounts in sync.
Still, directory sync only controls who has an account and a basic role. Once an engineer logs in to a database or server, sync does nothing. Neither firewall ports nor directory groups see what commands run inside a session. A synced admin role often grants full access to read or drop tables.
Static firewall rules also keeps the session active twenty-four hours a day. Anyone who steals a synced account can use those open paths right away. And if a query pulls sensitive data like emails or card numbers, directory tools miss it. You need controls that inspect individual commands and rewrite matched fields in results.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does Azure AD Connect require inbound ports from the internet?
No, the sync server starts all connections from inside your local network. It uses outbound HTTPS on the configured port to talk to the cloud service.
Why does the sync server need the configured port open?
The server uses the configured port to download certificate revocation lists from public authorities. It checks these lists to verify that the cloud SSL certificates are valid.
Can firewall TLS inspection break directory sync?
Yes, decrypting and inspecting outbound HTTPS traffic often breaks the sync agent. You should bypass TLS inspection for official Microsoft identity URLs on your firewall.