Forum Discussion

curious7's avatar
curious7
Brass Contributor
Nov 23, 2025

Can I send MgGraph traffic over Service Endpoint from Azure VM?

I have a Azure VM which resides on a subnet that has UDR to send all traffic to 0.0.0.0/0 through our firewall which in turn sends the http and https traffic to our proxy. I am having problems execut...
Jamony's avatar
Jamony
MCT
Jun 26, 2026

No, Graph will not use a VNet service endpoint.

Service endpoints are for specific Azure resource endpoints that support them. Microsoft Graph is reached through https://graph.microsoft.com, so the VM still needs normal HTTPS egress for the Graph calls after Connect-MgGraph.

In your setup I would focus on this path instead:

VM -> UDR/default route -> firewall or proxy -> graph.microsoft.com:443

Check the firewall logs for graph.microsoft.com right after the failed command. Also check whether the VM has the right proxy settings for PowerShell/WinHTTP if all outbound traffic must go through a proxy. If TLS inspection is enabled, that is also worth testing because Graph SDK auth can fail when certificates are being re-signed.

Service tags may help with firewall rules, but they do not make Graph a service-endpoint destination.

Docs:
https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview
https://learn.microsoft.com/azure/virtual-network/service-tags-overview
https://learn.microsoft.com/graph/overview