Plan for change:Azure Network Connection health check enforcement for required Windows 365 endpoints

Starting April 2026, Windows 365 will enforce errors (not warnings) for unreachable required endpoints during Azure Network Connection health checks, blocking provisioning until resolved. No new endpoints are added; existing configurations allowing these endpoints need no changes. Microsoft Hosted Network deployments remain unaffected. Prepare by reviewing network settings.

Beginning in April 2026, Windows 365 will begin enforcing additional required endpoint validations during Azure Network Connection (ANC) health checks.

Currently, ANC health checks return a “Warning” if any of the following required endpoints are not reachable:

• *.service.windows.cloud.microsoft.com
• *.windows.cloud.microsoft.com
• *.windows.static.microsoft.com

With this update, the status of these health check failures will be changed to “Error” and new provisioning attempts using that ANC will fail until the issue is resolved. No new endpoint requirements are being introduced. This update only changes how existing ANC health checks are enforced when the checks run, including during ANC creation, upon any subsequent ANC changes, and as part of the recurring six‑hour health check cycle.

[How this will affect your organization]

For ANC deployments, Windows 365 uses Azure Network Connection health checks to validate required network connectivity before Cloud PCs are provisioned.

Microsoft Hosted Network deployments are not affected because Microsoft automatically provides and manages this connectivity.

Starting in April 2026:

• If required endpoints are reachable, provisioning proceeds as expected.
• If required endpoints are not reachable, the health check returns an error, and provisioning is blocked until the issue is resolved.
• Health check results indicate which required endpoint connectivity checks did not pass.

This enforcement ensures required network configuration issues are addressed before provisioning is attempted.

Endpoints enforced

The following existing required endpoints will be enforced:

• *.service.windows.cloud.microsoft.com
• *.windows.cloud.microsoft.com
• *.windows.static.microsoft.com

If these endpoints are already allowed in your firewall or network configuration, no action is required.

Note: These endpoints must be reachable from the Cloud PC environment; they do not need to be reachable from the local device used to connect to a Cloud PC.

What is not changing

• No new endpoint requirements are being added.
• The underlying ANC connectivity validation process remains the same.
• Existing successfully provisioned Cloud PCs are not impacted.
• Microsoft Hosted Network deployments are not impacted.

[What you need to do to prepare]

Before April 2026, review your network configuration for Azure Network Connections and confirm that the required endpoints listed above are allowed through firewalls, proxies, and other network security devices.

You may also want to consider taking the following steps:

• Inform your helpdesk and support teams of this enforcement change.
• Update internal IT documentation and provisioning guidance as needed.

Additional Information

• Network requirements for Windows 365
• Azure network connection health checks
• Network requirements - allow network connectivity

[Compliance considerations]

No compliance considerations identified, review as appropriate for your organization