D365 On-premises, Episode 1: System Architecture, Servers, Services, and Ports

D365 F&O on-premises series · Episode 1

Microsoft Dynamics 365 Finance & Operations (D365 F&O) doesn't only run in the cloud. You can also install it in your own data center as an on-premises deployment. In episode 1, we'll walk through every server, the services that run on each one, and the ports between them, all based on Microsoft documentation.

Key points

• On-premises is five node types in a standalone Service Fabric cluster, plus SQL Server, AD DS, AD FS, and an SMB file server outside the cluster.
• Authentication takes two paths: AD FS for user sign-in, and Microsoft Entra ID for Microsoft Dynamics Lifecycle Services (LCS) and the local agent.
• For the firewall, we only list ports that Microsoft documents: 443, 1433, 445, 19000, 19080, WinRM, and the outbound addresses the local agent needs.

1. On-premises vs cloud
2. Full architecture
3. Servers by node type
4. Servers outside the cluster
5. Services per server
6. Two authentication paths
7. Package flow
8. Ports and firewall
9. Checklist

01Start with how on-premises differs from the cloud

• Application servers and the SQL Server database run in your data center. Deployments and updates start only from LCS.
• According to the setup guide, you buy license keys through the Enterprise Agreements channel and then set up an on-premises project in LCS.
• There are four components: AOS (business logic), BI (SSRS document reports), Financial Reporting/Management Reporter (financial reports), and DMF (data import and export).
• It isn't supported on any public cloud, Azure included. Azure Stack HCI and Azure Stack Hub are supported.

The purchase article also describes deploying on-premises with a Dynamics 365 cloud subscription license, thanks to dual use rights. Check the exact terms in the Licensing guide with your partner.

The four components run on this system software:

• Windows Server (English-language installations only) and Windows PowerShell 5.0 or later
• SQL Server (with Full-Text Search enabled) and SQL Server Management Studio, plus SSRS on the BI node (ReportServerType) and SSIS on the SSIS node (SSISNodeType)
• Standalone Azure Service Fabric
• A domain controller (Windows Server 2012 R2 or later, domain functional level 2012 R2 or higher) and AD FS
• AD CS (optional, but Microsoft highly recommends it)

Some features are cloud only. In Microsoft's comparison table, Copilot and other AI features, PowerBI.com integration, and telemetry sent to the cloud all show "No" for on-premises.

Source: Microsoft Learn · Set up and deploy on-premises environments (10.0.32 and later) · Microsoft Learn · On-premises deployment overview · Microsoft Learn · Buy Finance + Operations (on-premises) · Microsoft Learn · Comparison of cloud and on-premises features

Terms
· On-premises (LBD): a deployment you install in your own data center. Microsoft docs also call these local business data (LBD) environments, and the product name is Finance + Operations (on-premises)
· LCS (Lifecycle Services): the Microsoft portal that deploys, updates, and supports cloud and on-premises environments
· AOS (Application Object Server): the server component that runs business logic for the web client and batch jobs
· DMF (Data Management Framework): the data import and export framework, sometimes written as DIXF

02The full architecture on one page

JGS explanatory diagram · The whole on-premises architecture, based on Microsoft Learn

• In the middle is a standalone Service Fabric cluster, one per environment: one for sandbox and one for production.
• Inside the cluster are five node types: AOS node (AOSNodeType), orchestrator node (OrchestratorType), BI node (ReportServerType), MR node (MRType), and SSIS node (SSISNodeType). Each machine gets exactly one node type.
• Outside the cluster: SQL Server (highly available in production), domain controllers (AD DS and DNS), AD FS, and an SMB 3.0 file server.
• On the cloud side: LCS, which sends deployment commands and packages, and Microsoft Entra ID, which handles LCS sign-in and local agent authentication.

Figure 1 in Microsoft's overview shows the same layout. That figure puts a load balancer in front of the cluster, while the setup guide's example creates one DNS A record with the same name (ax) for each AOS node.

Microsoft original · On-premises deployment overview, Figure 1

Source: Microsoft Learn · On-premises deployment overview (Figure 1) · Microsoft Learn · Configure the infrastructure scripts · Microsoft Learn · Set up and deploy on-premises environments

Terms
· Standalone Service Fabric cluster: a Service Fabric cluster you build on your own Windows Server machines instead of in Azure
· Node type: a group of nodes with the same role. The configuration file assigns one type to each node
· Primary node type: the node type that runs the Service Fabric system services. In D365 on-premises, it's OrchestratorType by default

03Servers by Service Fabric node type

Each node type does a different job, so counts and management differ too. The numbers below are the recommended minimums from the system requirements article. Size your real environment from peak transaction lines per hour and concurrent users.

Node type	What it does	Production minimum	Sandbox minimum	Recommended cores and memory (production)
AOSNodeType	Web client, batch, data management	3	2	8 cores, 24 GB
OrchestratorType	Deployment and servicing, Service Fabric primary	3	3	4 cores, 16 GB
ReportServerType	SSRS document reports	1	1	4 cores, 16 GB
MRType	Management Reporter financial reports	2	1	4 cores, 16 GB
SSISNodeType	DMF service (since 10.0.32)	2	1	4 cores, 16 GB

AOSNodeType · business logic

• Why: it's the business logic server that runs the web client and batch jobs your users rely on.
• What runs there: the Service Fabric application fabric:/AXSF (AXSFType), IIS and .NET Framework features that the setup scripts turn on, and the gMSA svc-AXSF$.
• Size: at least 3 in production and 2 in sandbox. Size for AOS, data management, and batch combined, and keep one or two more than you estimate (N+1).
• Management: spread the nodes across upgrade domains so a cluster change doesn't take them all down at once. Restart AOS from the code package in Service Fabric Explorer.

If batch jobs pile up during business hours, you can split nodes into batch-only (BatchOnlyAOSNodeType) and interactive-only (InteractiveOnlyAOSNodeType). This works from 10.0.12 (Platform update 36), with at least 3 of each in production and 2 of each in sandbox.

Menu path
· Restart AOS: Service Fabric Explorer › Nodes › AOS node › fabric:/AXSF › AXSF › Code Packages › Code › … › Restart

OrchestratorType · deployment and cluster management

• Why: it's home to the local agent, which takes deployment and update commands from LCS and runs them in the cluster.
• What runs there: the Service Fabric system services (primary node type), OrchestrationService and ArtifactsManager in fabric:/LocalAgent, and the agent's monitoring and telemetry apps.
• Size: at least 3, spread across three fault domains, sized for the cluster's peak load (4 cores, 16 GB).
• Internet: the orchestrator is the node type that has to reach LCS. If you use a proxy, set it in machine.config on these nodes.

In DNS on the domain controller, you create an A record such as sf.d365ffo.onprem.contoso.com for each orchestrator node. Admins open Service Fabric Explorer on port 19080 of that name and check that all nodes are green.

ReportServerType · SSRS document reports

• Why: it's where SSRS builds document reports, and where AOS sends report requests.
• What runs there: SSRS in Native mode (installed but not configured), a local Database Engine, and ReportingService, the Service Fabric service that configures SSRS during deployment.
• Size: one node (4 cores, 16 GB). From 10.0.17, you can add nodes for high availability.
• Management: keep a preconfigured spare on a different virtual host. Every update redeploys the reports to the BI nodes.

There are two high availability options. You can use a Windows failover cluster with an active and a passive node, or put a load balancer in front with source IP session affinity.

MRType · financial reporting

• Why: it runs Financial Reporting (Management Reporter) and supports the report designer.
• What runs there: the Financial Reporting services, with the gMSAs svc-FRAS$ (application service), svc-FRPS$ (process service), and svc-FRCO$ (ClickOnce designer).
• Size: two nodes are enough in most cases (4 cores, 16 GB). Scale out if you use it heavily.
• Management: back up the FinancialReporting database on SQL Server before updates, and check that the AD FS OpenID address opens from the MR nodes too.

The report designer opens on the user's PC as a ClickOnce app. Edge supports that out of the box, but Chrome needs a ClickOnce extension.

SSISNodeType · data management (DMF)

• Why: it hosts the dedicated DMF service that new environments get from 10.0.32. You no longer need SSIS installed and licensed on every AOS node.
• What runs there: SSIS (Integration Services and SQL Client Connectivity SDK), the DMF service, the gMSA svc-DIXF$, and the dixf-share share on the file server.
• Size: at least 2 in production and 1 in sandbox. Scale out for heavy integration volumes.
• Alternatives: disable SSISNodeType and set hasSSIS=true on other nodes (for example, ReportServerType). If no node has hasSSIS, the service goes to all BatchOnlyAOSNodeType nodes, or to all AOSNodeType nodes if that type doesn't exist.

Environments deployed with a base topology older than 10.0.32 need SSIS on every AOS node and don't have the DMF service. You can switch them to the dedicated service only after you update to 10.0.32 or later.

Source: Microsoft Learn · System requirements for on-premises deployments · Microsoft Learn · Hardware sizing · Microsoft Learn · Batch-only and interactive-only AOS nodes · Microsoft Learn · SSRS high availability · Microsoft Learn · Dedicated DMF service · Microsoft Learn · Configure proxies

Terms
· gMSA (group managed service account): a service account whose password AD manages for you. The name ends with $
· Upgrade domain and fault domain: an upgrade domain is a group of nodes that takes a planned change at the same time; a fault domain is hardware that shares a single point of failure
· Service Fabric Explorer (SFX): the web tool for checking and managing the cluster, nodes, and applications. The default address is the cluster name on port 19080 over HTTPS
· Batch: scheduled work that runs without a user screen

04Four servers outside the cluster

SQL Server

• Why: it holds the business database AXDB, the local agent's OrchestratorData, and the FinancialReporting database.
• High availability: in production, use Always On or a failover cluster with at least two servers. Failover is supported only as active/passive, and read-only replicas aren't supported. A sandbox can use one server.
• Settings: use a default instance (avoid named instances), SQL Server and Windows Authentication mode, Full-Text Search, and the SQL_Latin1_General_CP1_CI_AS collation.
• Location and size: in the same data center as AOS, under 1 ms latency and 100 MBps bandwidth, 8 cores and 32 GB per instance. Keep production and sandbox SQL separate (sandboxes can share one).

Mixing SQL Server versions in one environment isn't supported. The supported software table lists 10.0.44 as the end of life for SQL Server 2019, so for a new build, plan on SQL Server 2022 (CU12 or later, supported from 10.0.39).

AD DS and DNS (domain controllers)

• Why: all VMs that run D365 join this Active Directory domain, and it's where gMSAs and user accounts live.
• Requirements: domain controllers on Windows Server 2012 R2 or later, domain functional level 2012 R2 or higher, and AD DS in native mode.
• DNS: a D365 zone in AD-integrated DNS (for example, d365ffo.onprem.contoso.com), with an ax record for each AOS node and an sf record for each orchestrator node. Other node types don't get A records.
• Count: at least two in production (the shared infrastructure example uses 3 with 4 cores and 16 GB). You can't install Service Fabric on a domain controller.

If your user domain is at the Windows Server 2008 R2 functional level, Microsoft supports a full two-way trust with the D365 service domain. You can't import security groups from that user domain, though.

AD FS

• Why: it's the authentication server for user sign-in to on-premises D365, using forms authentication with the user's email address.
• Version: Windows Server 2019 or later (2016 is deprecated). Windows Server 2022 is supported from 10.0.38.
• What gets registered: the application group "Microsoft Dynamics 365 for Operations On-premises" with its native apps and Web APIs. You enter the client IDs from it when you deploy in LCS.
• Check: from the AOS and MR nodes, the AD FS server's /adfs/.well-known/openid-configuration address should open and return JSON.

If you already use AD FS for Microsoft 365 single sign-on, turn on the "AD FS Microsoft 365 compatibility" option in the local agent configuration in LCS. Microsoft also documents how several D365 environments can share one AD FS.

File server (SMB 3.0)

• Why: it keeps files that several nodes read and write in one SMB 3.0 location.
• Four shares: aos-storage (documents users upload), agent (latest build and configuration files for orchestrating deployments), dixf-share (DMF files), and diagnostics-store (Service Fabric diagnostics).
• Security: Microsoft strongly recommends disabling the SMB 1.0 server and requires BitLocker on every machine.
• Operations: keep share paths as short as possible to avoid hitting the maximum path length, and use highly available SSD-based storage.

The agent share also holds the encrypted credentials file (Credentials.json) and the deployment work folder (wp). Files in it survive a local agent cleanup on the orchestrator node, so you can reuse the share.

Source: Microsoft Learn · Set up and deploy on-premises environments · Microsoft Learn · Supported software · Microsoft Learn · System requirements · Microsoft Learn · AD FS Microsoft 365 compatibility · Microsoft Learn · Reuse the same AD FS instance · Microsoft Learn · Prepare a standalone Service Fabric cluster

Terms
· Always On availability group: a SQL Server high availability feature that replicates databases to other servers so another server takes over if one stops. Clients connect through the listener name
· AD FS application group: the set of apps (D365 native apps and Web APIs) that AD FS is registered to trust
· SMB 3.0: the Windows file sharing protocol version with stronger security features such as encryption

05Services on each server and how to manage them

Running on-premises is easier when you know what actually runs inside each server. Microsoft's docs point you to Service Fabric Explorer to restart applications, and to LCS to clean up deployments and apply updates.

All Service Fabric nodes

Service	Why it's needed	What it does	How to manage it
FabricHost.exe	Starting point of the node	A Windows service that starts at boot, launches Fabric.exe and FabricGateway.exe, and supervises them	Check it in Task Manager, exclude it from antivirus scans
Fabric.exe	The node itself	Joins the cluster and hosts system services (Cluster Manager, Failover Manager, and others)	Check node health in SFX
FabricGateway.exe	Front door for clients and admin tools	Listens on TCP 19000 (client) and 19080 (HTTP gateway) by default and bridges into the cluster	Allow 19000 and 19080 in the firewall, confirm by opening SFX
FabricDCA.exe	Diagnostics collection	Collects ETW traces, performance counters, and dumps and sends them to the diagnostics store	Watch the diagnostics-store share capacity on the file server, exclude from antivirus
FileStoreService.exe, ImageBuilder.exe	Storing and preparing app packages	Image store (stores and distributes app packages) and app package image builder	Exclude from antivirus
FabricUOS.exe	Standalone cluster upgrades	Orchestrates cluster code and configuration upgrades	Run from one Service Fabric node. Runtime: Start-ServiceFabricClusterUpgrade; configuration: Start-ServiceFabricClusterConfigurationUpgrade
FabricRM.exe, FabricFAS.exe	Repair and fault analysis	Repair Manager and Fault Analysis Service	Exclude from antivirus
FabricInstallerService.exe	Runtime installation	Installs Service Fabric and sets up the cluster	Exclude from antivirus

• Antivirus exclusions: Program Files\Microsoft Service Fabric, the FabricDataRoot and FabricLogRoot folders, and the processes above
• Data and logs: C:\ProgramData\SF by default; a non-OS drive is recommended
• Runtime version: stay at or above the minimum for your D365 version (Service Fabric 10.0 from 10.0.41)

AOS nodes

Service	Why it's needed	What it does	How to manage it
fabric:/AXSF (AXSFType)	Runs business logic	Runs the web client and batch, synchronizes the database during updates	Check status in SFX (InBuild while syncing), restart from Code Packages › Code › Restart, sync events in AX-DatabaseSynchronize in Event Viewer on the AOS node
Gateway app	Gateway on AOS nodes	A gateway application that runs on AOS nodes (the docs only name it and show its health)	Check status in SFX
IIS and .NET Framework features	Foundation for AOS	Windows features the infrastructure scripts install (WAS, Web-Server, .NET 4.x, WCF, and more)	Validate with the configuration test script on the AOS node, or remotely from the computer that runs the scripts (same domain) (episode 2)
DMF service (conditional)	When there's no dedicated node	Goes to batch-only AOS nodes, or all AOS nodes, if no node has hasSSIS	Confirm where SSIS is installed

Orchestrator nodes

Service	Why it's needed	What it does	How to manage it
Service Fabric system services	The cluster's brain	Cluster Manager (application lifecycle), Failover Manager (rebalances after failures), Health Manager, Naming Service, Image Store	Keep 3 primary nodes across 3 fault domains
fabric:/LocalAgent · OrchestrationService	Carries out LCS commands	Orchestrates deployment and servicing; it's stateful, so its primary replica sits on one node	Find the primary in SFX › Applications › LocalAgentType › fabric:/LocalAgent/OrchestrationService
fabric:/LocalAgent · ArtifactsManager	Downloads packages	Downloads files from Azure cloud storage to the agent share on the file server and unzips them	Check agent share capacity and access
fabric:/Agent-Monitoring, LBDTelemetry apps	Watches the agent	Monitoring and telemetry apps for the local agent	Check status in SFX

• Local agent version: the latest is 3.5.0 (February 2026). Don't update it during a servicing operation.
• Event logs: on the primary orchestrator, Event Viewer › Applications and Services Logs › Microsoft › Dynamics › AX-LocalAgent, AX-SetupModuleEvents, AX-SetupInfrastructureEvents, AX-BridgeService
• Diagnostics: keep 30 days of data in a central store, and in production don't put diagnostic tools on the orchestrators

BI nodes

Service	Why it's needed	What it does	How to manage it
SQL Server Reporting Services (ReportingServicesService.exe)	Document report engine	Runs reports and takes AOS requests over HTTPS	Don't configure it yourself (ReportingService does); Native mode, default instance
Local Database Engine	SSRS catalog databases	Holds DynamicsAxReportServer and DynamicsAxReportServerTempDB	Installed with SSRS; back up the SSRS databases before updates
ReportingService (Service Fabric service)	Configures SSRS automatically	Configures SSRS during deployment, using the bootstrapper gMSA svc-ReportSvc$	Reports are redeployed during servicing; check status in SFX

MR nodes

Service	Why it's needed	What it does	How to manage it
Financial Reporting application service	Where Financial Reporting clients connect	Exposed under the AOS address at /FinancialReporting, runs as svc-FRAS$	Check the Financial Reporting native app and Web API in the application group on the AD FS server
Financial Reporting process service	Financial Reporting processing	Runs as svc-FRPS$ with db_owner on AXDB and FinancialReporting (the docs only list the account and permissions)	Keep database permissions on SQL Server, back up FinancialReporting on SQL Server before updates
ClickOnce designer	Delivers the report designer	Serves the report designer to user PCs through ClickOnce, runs as svc-FRCO$	Make sure the user's browser supports ClickOnce

SSIS nodes

Service	Why it's needed	What it does	How to manage it
SQL Server Integration Services (MsDtsSrvr.exe)	Foundation for DMF	Manages Integration Services package storage and execution	Select Integration Services and SQL Client Connectivity SDK during setup
DMF service	Dedicated import and export	The dedicated service added in 10.0.32, runs as svc-DIXF$, uses dixf-share on the file server	Node tags are managed automatically (infrastructure scripts 2.20.0 and local agent 3.3.0 or later)

SQL Server

Service	Why it's needed	What it does	How to manage it
Database Engine (sqlservr.exe, default instance)	Stores D365 data	Hosts AXDB, OrchestratorData, and FinancialReporting; encrypts connections with a certificate installed on SQL Server (ForceEncryption)	Latest CU in production, run as a domain user or gMSA, full backup before updates
Full-Text Search	Required by D365	Builds full-text indexes	Always select it during setup
SQL Server Agent	Scheduled work	Runs jobs, monitors SQL Server, fires alerts	Check job and alert status
Always On availability group listener	A fixed connection name	Clients connect to the listener name (for example, LBDEN01SQLA), which points to the active node after failover	Failover is active/passive only
SQL Server Browser	Resolves named instances	Provides connection info for named instances on UDP 1434	D365 recommends default instances

Domain controllers

Service	Why it's needed	What it does	How to manage it
Active Directory Domain Services	Domain and accounts	Computer, user, and gMSA accounts, Kerberos authentication	At least 2 in production, functional level 2012 R2 or higher
DNS Server (AD-integrated)	Name resolution	The D365 zone and the ax and sf A records	Make sure the records match node IPs
KDS root key	Basis for gMSA passwords	Needed the first time the domain uses gMSAs	How to create it is in episode 2
AD CS (optional)	Issues certificates	Used when the infrastructure scripts create certificate templates and certificates	Certificate prep is in episode 2

AD FS server

Service	Why it's needed	What it does	How to manage it
AD FS service	User sign-in	Forms authentication, email sign-in, token issuance, CORS for Office add-ins	Restart the AD FS service after setting changes, check AD FS Management › Application Groups
AD FS configuration database (WID or SQL Server)	Stores AD FS settings	Holds the farm configuration	Run it per the AD FS documentation
OpenID metadata endpoint	Trust check	Serves the configuration JSON at /adfs/.well-known/openid-configuration	Confirm it opens from AOS and MR nodes

File server

Service	Why it's needed	What it does	How to manage it
File Server role (FS-FileServer)	Provides shares	Serves the four SMB 3.0 shares	Disable SMB 1.0, BitLocker, highly available storage
agent share	Deployment workspace	Build and configuration files, Credentials.json, the wp folder, the scripts folder (PreDeployment.ps1, PostDeployment.ps1)	Not removed by a local agent cleanup
aos-storage	Document storage	Documents users upload to AOS	Keep the path short
dixf-share	DMF files	DMF import and export files	Confirm access from SSIS nodes
diagnostics-store	Diagnostics	Service Fabric diagnostics data	Separate volume example (Microsoft's Contoso example)

Source: Microsoft Learn · Service Fabric terminology · Microsoft Learn · Service Fabric architecture · Microsoft Learn · Create a standalone Service Fabric cluster · Microsoft GitHub · Service Fabric process list · Microsoft Learn · Troubleshoot on-premises deployments (management paths) · Microsoft Learn · Update the local agent · Microsoft Learn · Update Service Fabric clusters · Microsoft Learn · On-premises diagnostics · Microsoft Learn · SQL Server service accounts · Microsoft Learn · AD FS requirements

Terms
· System services: services Service Fabric runs for itself, such as Cluster Manager, Failover Manager, Naming Service, and Image Store
· Primary replica: of the several replicas of a stateful service, the one doing the work right now; the others stand by
· CU (cumulative update): a bundle of SQL Server fixes
· WID (Windows Internal Database): the built-in Windows database that AD FS can use to store its settings

06Two authentication paths

JGS explanatory diagram · User sign-in and the LCS connection, two separate paths

• User line: browser → AOS address (…/namespaces/AXSF) → AD FS forms sign-in (email address) → back to AOS with a token.
• Other single sign-on options aren't supported. Microsoft recommends turning off Windows Integrated Authentication (WIA) for intranet sign-in unless AD FS is set up for mixed environments.
• LCS line: the local agent uses the OnPremLocalAgent certificate to act as a Microsoft Entra app (service principal) for your tenant and talk to LCS.
• Recommended: a separate Entra app, service principal, and certificate for each environment. When the certificate expires, renew it and register it with the service principal again.

Microsoft Entra ID handles authentication for LCS and Azure DevOps. Most business data stays on-premises, and only a small set, like LCS project content and onboarding information, is stored in Azure data centers in the United States.

Source: Microsoft Learn · Set up and deploy on-premises environments (authentication) · Microsoft Learn · Configure LCS connectivity · Microsoft Learn · Plan on-premises deployments (authentication methods)

Terms
· Service principal: the security identity a registered Entra app uses to receive permissions in a tenant
· Forms authentication: signing in by typing a user name and password on a sign-in page
· WIA (Windows Integrated Authentication): automatic sign-in with the Windows credentials of a domain-joined PC

07How code and packages reach the cluster

JGS explanatory diagram · How a package moves through LCS and the local agent

• ① Build a deployable package on a dev VM or build environment. The development tools and process are the same as in the cloud.
• ② Upload it to the Software deployable packages tab of your LCS project's Asset library.
• ③ LCS assembles the Service Fabric application packages and sends a message to the local agent (preparation, no downtime yet).
• ④ The local agent downloads the files to the agent share on the file server, runs PreDeployment.ps1, sets up the modules, runs PostDeployment.ps1, and reports back to LCS.

An update has to succeed in sandbox before it can go to production. Once you mark the sandbox package as a release candidate, it shows up in the production environment's update list.

You get the infrastructure scripts and the empty or demo database backups from the LCS Shared asset library, and the local agent installer from the LCS on-premises connector, then unzip it on one orchestrator node. We'll cover the download and setup order in episode 2.

Caution · Downtime starts when the update is applied, and an LCS rollback doesn't roll back the database. Take full backups first: AXDB and FinancialReporting (MR) on SQL Server, and the SSRS databases on the BI node.

Source: Microsoft Learn · Develop and deploy custom models to on-premises environments · Microsoft Learn · Apply updates to on-premises deployments · Microsoft Learn · Local agent pre- and post-deployment scripts · Microsoft Learn · Obtain the infrastructure scripts · Microsoft Learn · LCS on-premises projects

Terms
· Deployable package: models and code bundled so you can apply them to an environment
· Asset library: the file library of an LCS project. The Shared asset library holds common files Microsoft publishes
· Release candidate: a package marked as validated in sandbox and ready for production

08Ports and firewall

JGS explanatory diagram · Ports to open, line by line

This table only includes connections where a Microsoft article gives the port. The infrastructure scripts' node definition file (NodeTopologyDefinition.xml) also has a list of firewall ports to open, but the public docs don't show the values, so check the scripts you download.

From	To	Port and protocol	Purpose	Source article
User's browser	AOS nodes (ax name)	HTTPS 443	Web client at /namespaces/AXSF	D365 setup
User's browser	AD FS server	HTTPS 443	Sign-in	AD FS requirements
AOS and MR nodes	AD FS server	HTTPS 443	OpenID configuration check	D365 setup, AD FS reuse
AOS nodes	BI node	HTTPS 443	Report requests	SSRS high availability (default 443)
AOS, orchestrator, and MR nodes	SQL Server (listener)	TCP 1433	AXDB, OrchestratorData, FinancialReporting (default instance)	SQL Server firewall
Client machine	Cluster (sf name)	HTTPS 19080	Service Fabric Explorer	D365 setup, SFX
Client machine and local agent	Cluster	TCP 19000	Client connections (PowerShell, SDK)	SF cluster settings, D365 certificate rotation
Node ↔ node	Inside the cluster	TCP 19001, 19002	Node-to-node communication and lease checks	SF cluster settings
Within a node	Same node	TCP 19003	Services to the node's SF client	SF cluster settings
Node ↔ node	Inside the cluster	Application port range	Service Fabric app endpoints; Service Fabric opens these firewall rules itself	SF cluster settings
Node (OS)	Same node	Ephemeral (dynamic) port range	Overrides the OS dynamic ports; keep at least 255 ports between start and end	SF cluster settings
Service Fabric nodes	Each other and file server	TCP 445, plus 135, 137, 138, 139	SMB file sharing and Remote Registry	SF preparation
All VMs	Domain controllers	AD DS ports (Appendix E)	Domain, Kerberos, LDAP, DNS	AD firewall
Computer that runs the scripts (same domain)	All nodes	WinRM 5985 (HTTP), 5986 (HTTPS)	Remoting scripts, CredSSP only when needed	D365 setup, WinRM
Orchestrator nodes	LCS, Entra ID, Azure storage	HTTPS 443	Local agent communication (Appendix D)	D365 proxy configuration
Service Fabric nodes	go.microsoft.com, download.microsoft.com	Allowlisted domains	Service Fabric automatic upgrades (without internet, turn off automatic upgrade and telemetry)	SF preparation

Service Fabric port values live in the cluster configuration file (ClusterConfig.json), one set per node type. Microsoft's settings article shows 19000 to 19003, 19080, and 19081 (optional), with application ports 20575 to 20605 and ephemeral ports 20606 to 20861. The official X.509 multi-machine template on GitHub uses application ports 20001 to 20031 and ephemeral ports 49152 to 65535. Base your firewall rules on the ClusterConfig.json that the D365 scripts actually generate.

All the LCS addresses are an allowlist that the orchestrator nodes need to reach outbound. User PCs work without internet access, but some features, like the Help pane and the Excel add-in, won't be available.

Caution · Turn on CredSSP for remoting scripts only while you use it, and turn it off when setup is done. Leaving it on risks credential theft.

Source: Microsoft Learn · Standalone Service Fabric cluster settings · Microsoft GitHub · X.509 multi-machine template · Microsoft Learn · Prepare a standalone Service Fabric cluster · Microsoft Learn · SQL Server firewall · Microsoft Learn · WinRM installation and configuration · Microsoft Learn · Firewall for AD domains and trusts · Microsoft Learn · Proxies and allowlist · Microsoft Learn · Certificate rotation (local agent connection) · Microsoft Learn · Client internet connectivity · Microsoft Learn · Service Fabric Explorer · Microsoft Learn · Local agent deployment options (CRL)

Terms
· Ephemeral (dynamic) ports: the port range the OS hands out on the fly for outgoing connections
· Lease: how Service Fabric nodes keep checking that each other are still alive
· WinRM and CredSSP: WinRM is the Windows remote management service; CredSSP is an authentication method that passes credentials on to a remote machine

09Episode 1 checklist · for the network team

Item	What to record · standard
Static node IPs	IPs per node type, one node type per machine
DNS	D365 zone, ax A records (one per AOS node) and sf A records (one per orchestrator)
User's browser → AOS nodes and AD FS server	HTTPS 443, at least 50 KBps per user, latency of 250 to 300 ms or less
AOS nodes → SQL Server	TCP 1433 (default instance), same data center, under 1 ms, 100 MBps
AOS nodes → BI node	HTTPS 443
Node ↔ node	19000 to 19003, 19080, and the application and ephemeral ranges from ClusterConfig.json
Nodes → file server	TCP 445, SMB 3.0, SMB 1.0 off
Nodes → domain controllers	AD DS ports in Appendix E
Computer that runs the scripts (same domain) → all nodes	WinRM 5985 and 5986, CredSSP off when done
Orchestrator nodes → internet	Appendix D allowlist on 443, proxy in machine.config
Client machine → cluster	19080 (SFX) and 19000 (PowerShell), client certificate
Certificate revocation list (CRL)	Public CA certificates need access to CRL addresses; if blocked, turn on the local agent's skip-CRL option in LCS (the environment owner owns the risk)

Documentation checked on October 28, 2026. We based this on Microsoft Learn's "Application 10.0.32 and later" setup article (updated August 19, 2026) and the supported software article (updated April 2, 2026). We used no customer stories, only Microsoft's example names such as contoso.com.

10Appendix

Appendix A. Recommended sizing and minimum counts by role

Topology	Role	Recommended cores	Recommended memory (GB)	Minimum instances
Production	AOS (including data management and batch)	8	24	3
Production	SSIS	4	16	2
Production	Management Reporter	4	16	2
Production	SSRS	4	16	1
Production	Orchestrator	4	16	3
Production	SQL Server	8	32	2
Sandbox	AOS (including data management and batch)	4	24	2
Sandbox	SSIS, MR, SSRS	4	16	1 each
Sandbox	Orchestrator	4	16	3
Sandbox	SQL Server	8	32	1
Shared infrastructure	Active Directory	4	16	3 (example)

• These values come from the system requirements article. The planning article lists lower production minimums (1 SSIS, 1 MR, 2 or more AD), so the articles differ.
• AOS sizing: 2,000 to 6,000 lines per core, 16 GB per instance, 4 to 24 cores per standard box, 10 to 15 Enterprise users, 15 to 25 Activity users, or 25 to 50 Team members per core, and 1 to 4 batch threads per core.
• SQL sizing: 3,000 to 15,000 transaction lines per hour per core, a typical AOS-to-SQL core ratio of 3:1 (2:1 for database-heavy work), and TempDB at 15% of the database size.
• Storage: at least 2,000 IOPS for SQL Server and data management, at least 100 write IOPS per VM, and no VM snapshots or Dynamic Memory when you virtualize.

Appendix B. Supported software versions (checked October 28, 2026)

Software	Supported since	End of life
Windows Server 2022	10.0.38	Not available
Windows Server 2019	10.0.17	10.0.41
Windows Server 2016	Original release	10.0.26
SQL Server 2022 (CU12)	10.0.39	Not available
SQL Server 2019	10.0.21	10.0.44
SQL Server 2016 SP2	10.0.9	10.0.28
AD FS on Windows Server 2022	10.0.38	Not available
AD FS on Windows Server 2019	10.0.17	Not available
AD FS on Windows Server 2016	Original release	10.0.26
Minimum Service Fabric runtime	10.0 (from 10.0.41)	Not applicable
Minimum .NET Framework	4.8.0 (from 10.0.42)	Not applicable
Minimum Visual C++ 2015-2022	v14.44.35208.0 (from 10.0.45)	Not applicable
Latest local agent	3.5.0 (February 2026)	Not applicable

• Windows Server: en-US installations only; Standard and Datacenter are both supported.
• Service updates: 10.0.49 became generally available on September 11, 2026, and 10.0.50 is planned for December 22, 2026. On-premises also follows the Modern Lifecycle Policy, so you need to keep updating.

Appendix C. Service Fabric processes

Process	What it does	Runs as
FabricHost.exe	Parent supervisor service	System
Fabric.exe	Hosts system services (Cluster Manager, Failover Manager, and others)	Network Service
FabricGateway.exe	Listens on TCP 19000 and HTTP(S) 19080 by default, bridges management and REST calls	Network Service
FabricDCA.exe	Diagnostics collection (ETL, performance, dumps → diagnostics store)	Network Service
FileStoreService.exe	File store and image store for app packages	Network Service
ImageBuilder.exe	Builds app package images	Network Service
FabricUOS.exe	Upgrade orchestration for standalone clusters	Network Service
FabricRM.exe	Repair Manager	Network Service
FabricFAS.exe	Fault Analysis Service	Network Service
FabricInstallerService.exe, FabricSetup.exe, FabricDeployer.exe	Runtime installation, cluster setup, configuration deployment	System

• Antivirus exclusions cover these processes plus Program Files\Microsoft Service Fabric, FabricDataRoot, and FabricLogRoot.

Appendix D. Local agent allowlist (orchestrator nodes → outbound 443)

LCS Global	LCS EU
lcsapi.lcs.dynamics.com	lcsapi.eu.lcs.dynamics.com
login.windows.net	login.windows.net
uswelcs1lcm.queue.core.windows.net	euweprodlcm.queue.core.windows.net
www.office.com	www.office.com
login.microsoftonline.com	login.microsoftonline.com
dc.services.visualstudio.com	dc.services.visualstudio.com
uswelcs1lcm.blob.core.windows.net	euweprodlcm.blob.core.windows.net

• The troubleshooting article's Global list also includes uswedpl1catalog.blob.core.windows.net:443.
• Pick the list for the LCS region you deploy from.

Appendix E. AD DS ports (Windows Server 2008 and later)

Service	Server port
DNS	53/TCP and UDP
Kerberos	88/TCP and UDP
Kerberos password change	464/TCP and UDP
W32Time	123/UDP
RPC Endpoint Mapper	135/TCP
RPC (LSA, SAM, NetLogon)	49152 to 65535/TCP
LDAP	389/TCP and UDP
LDAP SSL	636/TCP
LDAP GC and GC SSL	3268 and 3269/TCP
SMB	445/TCP
Active Directory Web Services	9389/TCP

• As the article notes, not every port is needed in every scenario (for example, skip 636 and 3269 if no client uses LDAP over SSL).

Appendix F. Optional · diagnostics stack example ports

Component	Default port	Note
Elasticsearch	9200 (HTTP), 9300 (node communication)	Microsoft's test example (third party)
Logstash (Beats input)	5044	Winlogbeat → Logstash
Kibana	5601	Query interface for users

• This is the Elastic Stack setup Microsoft tested in its diagnostics article. Its default traffic isn't HTTPS, so weigh the risks first, and in production install it on separate machines, not on the orchestrators.

Source: Microsoft Learn · Supported software · Microsoft Learn · Service update availability · Microsoft Learn · On-premises lifecycle policy · Microsoft Learn · Plan on-premises deployments · Microsoft GitHub · Service Fabric process list · Microsoft Learn · Troubleshoot on-premises deployments · Microsoft Learn · Firewall for AD domains and trusts · Microsoft Learn · On-premises diagnostics

Source documents · Microsoft Learn

• Set up and deploy on-premises environments (Application 10.0.32 and later)
• Configure the infrastructure scripts for your Finance + Operations (on-premises) deployment
• On-premises deployment overview
• Plan and prepare for on-premises deployments
• System requirements for on-premises deployments
• Hardware sizing requirements for on-premises environments
• Microsoft Dynamics 365 Finance + Operations (on-premises) … supported software
• Buy Finance + Operations (on-premises)
• Comparison of cloud and on-premises features
• Set up on-premises projects in Lifecycle Services
• Configure Lifecycle Services connectivity for Finance + Operations (on-premises) deployments
• Deployment configurations for the local agent
• Configure your environment with a dedicated Data Management Framework service
• Configure high availability for SQL Server Reporting Services (SSRS) nodes
• Configure batch-only and interactive-only AOS nodes in on-premises deployments
• Obtain the infrastructure scripts …
• Configure proxies for on-premises environments
• Client internet connectivity
• Apply updates to on-premises deployments
• Develop and deploy custom models to on-premises environments
• Update the local agent
• Update Service Fabric clusters for … (on-premises) environments
• Local agent pre-deployment and post-deployment scripts
• Troubleshoot on-premises deployments
• Certificate rotation
• On-premises diagnostics
• Software lifecycle policy and on-premises releases
• Service update availability
• On-premises deployment home page
• AD FS Microsoft 365 compatibility
• Reuse the same AD FS instance for multiple environments
• Plan and prepare your Service Fabric Standalone cluster deployment
• Configuration settings for a standalone Windows cluster
• Contents of Service Fabric Standalone package for Windows Server
• Learn Azure Service Fabric terminology
• Service Fabric architecture
• Visualize your cluster with Service Fabric Explorer
• Customize Service Fabric cluster settings
• Service Fabric supported versions
• Create a standalone Azure Service Fabric cluster
• Microsoft 공식 샘플 · X.509 다중 머신 클러스터 템플릿
• Service Fabric process list with Security Context info
• Client EKU Removal Notice
• Configure the Windows Firewall to Allow SQL Server Access
• Configure Windows Service Accounts and Permissions
• Installation and configuration for Windows Remote Management
• AD FS Requirements
• Configure a firewall for report server access
• How to configure a firewall for Active Directory domains and trusts
• Credential Security Support Provider
• Dynamics 365 for Finance and Operations (on-premises) · Microsoft Lifecycle

Next episode · Installation order and infrastructure scripts

We'll follow Microsoft's setup order from planning domains, certificates, and accounts to creating the Service Fabric cluster, installing the local agent, and deploying from LCS.

Coming up next · All 24 setup steps on one route, in six stretches

The JGS Consulting team has been part of the journey from Dynamics AX 2009 and AX 2012 to Dynamics 365 Finance & Operations. Our team includes finance, costing, and tax specialists, the foundation of any ERP. We also handle logistics, manufacturing, and distribution systems as one team, from process design to development and operations, with expertise in system and development architecture. We continue our on-premises series on the Microsoft ERP system.

JGS Consulting

A development guide series from JGS Consulting. Using Microsoft documentation, the series explains environment setup, development tools, and validation for Microsoft Dynamics 365 Finance & Operations.

jgs.ai.kr

Contact JGS about on-premises deployments

JGS English blog · JGS Korean blog · JGS YouTube

#Dynamics365 #D365 #D365FO #MSERP #MicrosoftERP #JGS #OnPremises #SystemArchitecture #ServiceFabric #LBD

한국어 글은 네이버 블로그에서 보실 수 있습니다: https://blog.naver.com/jgsconsulting