What are the required firewall domain exceptions to access ArcGIS Online?

Answer

To provide high-performance and availability for ArcGIS Online basemap services, Esri utilizes the web acceleration and traffic management services of Akamai. This web acceleration service results in dynamic IP addresses being returned when connecting to ArcGIS Online, because basemaps are accessed via services.arcgisonline.com, to most efficiently route requests to the servers.

Note:
Only ArcGIS Online basemaps have static IP addresses. When static IP addresses are required, it is no longer possible to utilize Akamai services. Therefore, it is likelier to experience poorer performance. 

The required firewall domain exceptions to access ArcGIS Online as listed below.

• To provide access to the main ArcGIS Online site and capabilities:

   http://*.arcgis.com 

   https://*.arcgis.com 

• To provide access to basemap tiles:

   http://*.arcgisonline.com 

   https://*.arcgisonline.com 

• Used when items are downloaded from ArcGIS Online:

   https://ago-item-storage.s3.amazonaws.com 

• To provide access to Esri pages linked through help documentation and to access the My Esri support page:

   http://*.esri.com 

   https://*.esri.com 

• To provide access only if Bing basemaps are used:

   http://*.virtualearth.net