Which Domains Does ArcGIS Online Need in a Firewall Allowlist?
A map touches portal, basemap, data and storage endpoints. Build the allowlist from Esri's current domain requirements, not from one DNS answer.
A DNS answer tells you what a hostname resolved to at the moment you asked. It does not tell you the address is permanent, and it does not enumerate everything the map touches. That distinction matters most when egress is restricted to a short allowlist someone typed from a single lookup. Start from the workflow, then derive the list from the provider's current requirements. The recurring example is an enterprise GIS client reaching ArcGIS Online through a restricted VPN egress.
List every component the map operation touches
Break the operation into parts: the organization's portal and item access, basemap tiles, hosted feature or analysis services, and any item downloads. Each can sit behind a different endpoint. A map referencing an external ArcGIS Enterprise service or an OGC endpoint adds a dependency the network team has never heard of. Write all of it down before anyone files an allowlist request. A component missing from that inventory fails later, in a way that looks like a credentials problem.
| Component | Example host family | Form | Who owns it |
|---|---|---|---|
| Portal and item access | *.arcgis.com | Wildcard | Esri, under the organization subdomain |
| Basemaps and static tiles | *.arcgisonline.com | Wildcard | Esri |
| Hosted feature and analysis services | *.arcgis.com | Wildcard | Esri, same revision |
| Item downloads and regional storage | storage hosts named in the current revision | Revision-specific | Esri |
| ArcGIS Enterprise service | gis.example.com | FQDN | Your organization |
| OGC or third-party endpoint | provider host | FQDN | The provider |
| Custom domain in front of the portal | maps.example.com | FQDN | Your organization |
The Domain and FQDN Requirements document is where those families come from, and two of them carry most of the workflow: *.arcgis.com covers the organization portal, its items and the hosted services behind them, while *.arcgisonline.com serves basemaps and static tiles. Everything else is organization-specific, because an ArcGIS Enterprise service you host, an OGC endpoint or a custom domain in front of the portal has to be added by name. Take those entries from the same revision you read, since the regional storage hosts change between versions.
Portal sign-in succeeding is weak evidence. It proves the portal endpoint is reachable from the approved path, and nothing about tiles, analysis or downloads.
Choose wildcard or FQDN from the current document
Esri publishes Domain and FQDN Requirements, and the revision matters because the regional storage entries change between versions. The current document offers both a domain-level wildcard approach and a stricter hostname-level inventory. It also calls out regional storage hosts and warns that external systems and custom domains add organization-specific entries. Copy the revision you actually read, date included, into the change record.
A stricter list costs maintenance time; a broader allowance costs security scope. That trade belongs to the network owner, and it should be decided against the document rather than against a set of addresses someone captured once during a working session.
Keep the static-basemap option narrow
Esri's firewall FAQ states that accelerated basemap delivery can return dynamic addresses. The same entry documents a static-IP arrangement specifically for basemaps, which leaves the acceleration path and can reduce performance. Neither statement turns the portal, the hosted data and the storage hosts into one static address. If an IP-only policy is mandatory, obtain the supported arrangement from Esri instead of widening a range you guessed.
An old DNS answer is not a supported arrangement, and it will rot.
Separate the route from the permission
A VPN route selects a path; the egress rules decide whether that path may reach the destination. These are different controls, and a healthy tunnel says nothing about the second one. That is why a map can fail for one user on one network and work for another user on the same account. Check the rule and the route separately before blaming the service.
Both can be correct while the workflow still fails, if the inventory is incomplete.
Verify component by component, then give the list an owner
Reproduce the failing operation and record which component failed: portal, tile, feature service, download, or an external service. Then change one policy element and repeat. A change that fixes tiles tells you nothing about analysis services. That per-component record is also what turns the next regional update into a dependency change rather than another round of guessing. Review diagnostic URLs before pasting them anywhere, because the query string can carry tokens and item identifiers.
Give the requirements list an owner and a review date tied to the document revision. When Esri adds a storage region or a service host, that owner reruns the inventory instead of discovering the gap during an incident.