To protect Azure virtual machines, allow communication between Commvault components and Azure services.
If your environment uses firewalls, proxies, or network segmentation, verify connectivity before configuring backups.
Prerequisites
Verify connectivity requirements
Verify that access nodes can communicate with the required Azure and Commvault services.
Azure services
Access nodes must have connectivity to communicate with the Azure services that are used for authentication, resource management, snapshots, storage access, and restore operations.
Depending on your Azure cloud environment, these services can include:
-
Azure Resource Manager
-
Microsoft Entra ID
-
Azure Storage
-
Azure Key Vault
If you use managed identity authentication, access nodes must also be able to reach the Azure Instance Metadata Service (IMDS).
Azure Government, Azure China, and Azure Germany environments use different service endpoints than the public Azure cloud.
If your organization restricts outbound traffic, allow the Azure service endpoints that are required by the Azure cloud environment you use.
Commvault services
Depending on your deployment model:
-
Access nodes must communicate with Commvault SaaS services.
-
Access nodes must communicate with the Commvault control plane.
Open the required ports
| Port | Protocol | Source | Destination | Purpose |
|---|---|---|---|---|
| 443 | HTTPS | Access node | Azure services | Azure API communication |
| 443 | HTTPS | Access node | Commvault services | Backup orchestration and control |
HTTP proxy considerations
If access nodes connect to Azure services through an HTTP proxy:
-
Allow HTTPS (TCP 443) connectivity to the required Azure services.
-
Verify that the proxy doesn't block Azure authentication, storage, or management endpoints.
-
Verify that proxy routing doesn't prevent connectivity to private Azure resources you want to protect.