January 5th, 2025

Important: Switching CDN providers

Clayton Kanyika
Technical Program Manager

The current content delivery network (CDN) provider Edgio, used by Azure DevOps is retiring. We’re urgently transitioning to a solution served by Akamai and Azure Front Door CDNs to maintain the responsiveness of our services.

What this means for you

For most of you, this transition will be seamless. To ensure that you can continue to access Azure DevOps without any interruptions, use the following Powershell commands to validate that your current firewall settings allow connectivity to the new CDN providers:

 Invoke-WebRequest -Uri https://cdn.vsassets.io/content/icons/favicon.ico
 Invoke-WebRequest -Method Head -Uri https://vstsagentpackage.azureedge.net/agent/3.248.0/vsts-agent-win-x64-3.248.0.zip

If your network includes firewalls that could affect access to the new CDNs, we recommend adding the following domain URLs to the allow list and not the individual IP addresses.

https://*.vsassets.io

https://vstsagentpackage.azureedge.net

For more details, please refer to this guidance.

Our commitment

We appreciate your patience during this transition. For questions or feedback, please comment below.

Author

Clayton Kanyika
Technical Program Manager

11 comments

  • Rolf van Kuijen

    Question regarding the links.
    Everywhere there is shouting to migrate away from azureedge.net and azurefd.net but what is the replacement for vstsagentpackage.azureedge.net?
    So in the end no azureedge needs to be in any whitelist?

  • Mike Joel

    Hello,

    Could this change be the cause of issues with running/configuring self-hosted agents?

    My self-hosted agent installation on MacOS suddenly stopped working yesterday with this error:
    “ERR AgentServer] System.TimeoutException: The HTTP request timed out after 00:01:00.”

    “GET request to https://dev.azure.com/%5Bmy project]/_apis/connectionData failed”

    Thank you

    • Ondrej KapralMicrosoft employee

      Sorry to hear about the issues you’re facing. This doesn’t seems to be related to this transition, though.

      • Requests to https://dev.azure.com/org/* do not target CDN.
      • The timing does not seem to align. Azure DevOps reached 100% of the traffic on new CDN on January 8th (in the morning hours PST).
      • The only agent-related flow which could get affected by the CDN changes is agent package download/installation. Not the regular processing of jobs.

      Feel free to reach out to Azure support to get further assistance!

    • Ondrej KapralMicrosoft employee

      We use Azure Traffic Manager for geography- and percentage- based rollover on these domains. Currently, we are transitioning from Edgio domains (v0cdn.net) to Akamai (edgesuite.net / akamai.net) and Azure Front Door (azurefd.net) domains.

      As you correctly noted, none of the vsassets.io subdomains are new; only their DNS resolution chain is changing. The blog announcement serves as a heads-up for customers who may have dependencies on specific IP addresses or low-level Edgio domains in their firewall or proxy configurations.

      Thank you for your diligence! Let me know if you have any questions

      Read more
      • Matthew Steeples

        That’s great, thanks for the clarification

  • Melissa P

    …. and yet again, you suggest the next scammer domain vsassets.io as replacement.

    The TLD .io is not under Microsoft control or US control or jurisdiction. I cannot follow your recommendation to make exceptions for vsassets.io

    You people at Microsoft are absolutely resilient to basic security concepts.

    • Ondrej KapralMicrosoft employee

      Hello Mathias, thank you for your question!

      There have been no changes to the list of outbound domains or their associated IP addresses. All recent updates relate to inbound traffic directed toward the CDN.

      • ADM Andris Drulle · Edited

        Our devops organization are on West Europe and now get completly different outbound IPs for Microsoft hosted agents. Those IPs are whitlisted for some services, like for Azure Keyvaults. Address should be “40.74.28.0/23” according https://www.microsoft.com/en-us/download/details.aspx?id=56519 , but now its something completly different. Where i can get correct IP range for devops agents ?