# Firewall rules for the outbound internet access

> If you want to restrict outbound access, configure the required firewall rules

If you want to restrict outbound access, implement these firewall rules:

* Generic outbound configuration for the Azure Kubernetes Service (AKS) cluster, to lock down the traffic that leaves the AKS subnet. Refer to the [required outbound network rules and fully qualified domain names (FQDNs)](https://learn.microsoft.com/en-us/azure/aks/outbound-rules-control-egress#required-outbound-network-rules-and-fqdns-for-aks-clusters) in the Microsoft documentation.

* Access from the AKS cluster to the Azure Container Registry (ACR) that contains the container images of Self-Hosted Deployment:

  * Login server: `https://uccmpprivatecloud.azurecr.io`
  * Data plane:
    * If dedicated data endpoints aren't enabled:
      * `https://*.blob.core.windows.net`
    * If dedicated data endpoints are enabled:
      * `https://uccmpprivatecloud.eastus.data.azurecr.io`
      * `https://uccmpprivatecloud.northeurope.data.azurecr.io`

* Access from the AKS cluster, for AKS extension agents such as GitOps:
  * `https://*.dp.kubernetesconfiguration.azure.com`

* Access from the AKS cluster to the enterprise identity provider, which Keycloak connects to in order to retrieve user tokens via a backchannel. Specific FQDNs depend on the IdP vendor, for example, it is `https://login.microsoftonline.com` for Microsoft Entra ID.

* Access from the PostgreSQL servers to Entra ID, for traffic that leaves the PostgreSQL subnet. Refer to the description of [private access networking for Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-networking-private) in the Microsoft documentation.
  * All traffic to the `AzureActiveDirectory` service tag.