IP Whitelisting for Cloud-hosted environments

For a Cloud-hosted (Tier 1) D365 F&O environment, the VM and network resources are in your Azure subscription, so IP whitelisting is typically done in the Azure Network Security Group (NSG) associated with the VM.

Protecting your development VMs is important for several reasons. One of the most significant is that internet-facing RDP endpoints are continuously scanned and indexed by automated services and search engines. If your VM is publicly accessible, it can quickly become a target for unauthorized access attempts (brute-force and password-spraying attacks).

Even when these attempts are unsuccessful due to strong credentials and security controls provided by Lifecycle Services (LCS), repeated failed sign-in attempts may trigger account lockout policies or security protections. This can temporarily prevent legitimate users from accessing the environment, disrupting development activities and reducing productivity.

Restrict RDP Access (Recommended)

If your goal is to control who can log in via Remote Desktop you can follow these simple steps:

1: Open Azure Portal and log in

2: Navigate to the VM shown in your cloud-hosted environment

3: Select Network settings as shown below.

4: Locate the inbound rule for TCP 3389 (RDP), often named rdp-rule.

5: Edit the rule by clicking on the name.

6: In the rdp-rule dialog box you need to change:

    Source = IP Addresses

    Source IP addresses/CIDR ranges = your public IP(s)

    Example: 85.xxx.xxx.xxx

    Multiple IPs can be specified as a list separated by comma.

7: Save the rule and you are done.

Microsoft specifically recommends limiting RDP access to only the client IPs that require access.