What are the required firewall domain exceptions to access ArcGIS Online?

To provide high-performance and availability for ArcGIS Online basemap services, Esri uses the web acceleration and traffic management services of Akamai. This web acceleration service results in dynamic IP addresses being returned when connecting to ArcGIS Online, because basemaps are accessed via services.arcgisonline.com, to most efficiently route requests to the servers. For reference, see the Domain Requirements for ArcGIS Online.

Note:
Only ArcGIS Online basemaps have static IP addresses. When static IP addresses are required, it is no longer possible to use Akamai services. Therefore, it is more likely to experience reduced performance. 

The required firewall domain exceptions to access ArcGIS Online as listed below.

• To provide access to the main ArcGIS Online site and capabilities:

   https://*.arcgis.com 

• To provide access to basemap tiles:

   https://*.arcgisonline.com 

• Used when items are downloaded from ArcGIS Online:

   https://ago-item-storage.s3.amazonaws.com 

• To provide access to Esri pages linked through help documentation and to access the My Esri support page:

   https://*.esri.com 

• To provide access only if Bing basemaps are used:

   https://*.virtualearth.net