Network access and proxies
Allow the services your pilot needs so users can sign in, download data, and check for updates. Local SQL, imported data, and offline sample work do not require a general internet connection, but activation, remote maps, portal operations, and hosted models have separate network needs.
Verify a managed network
Section titled “Verify a managed network”- List the approved portal and federated server hosts, model provider, basemap sources, licensing host, and update source for the installation.
- Configure outbound access and any required proxy, PAC, DNS, or certificate infrastructure. Preserve local loopback access for sign-in callbacks.
- Restart Northing after policy or network changes. Run the self-test with network checks enabled if you need anonymous reachability results.
- Test an actual sign-in and a small authorized import. Then test the chosen model and a map with the intended basemap.
- Verify update checks separately. The updater and some data-download transports do not use Northing’s proxy override.
Destinations by task
Section titled “Destinations by task”| Task | Destinations to review |
|---|---|
| ArcGIS sign-in and content | Organization portal, identity provider, www.arcgis.com where applicable, and federated ArcGIS Server hosts. |
| ArcGIS feature and tile services | The actual services, tiles, basemap, and content hosts referenced by the organization’s layers and maps. |
| Default basemap | tiles.openfreemap.org for styles, tiles, and fonts. |
| Hosted assistant | The selected Anthropic, OpenAI, Azure OpenAI, or Bedrock endpoint and its authentication destinations. Use the configured commercial or government region. |
| Local assistant | The approved OpenAI-compatible server on a loopback address. |
| Outside sources and MCP | Only the enabled source and tool-server hosts; local server launchers may need their package registries. |
| Licensing | api.keygen.sh by default, or the license-service host embedded in the supplied build. |
| License portal | licenses.northing.tech in the browser for sign-up and management, or the Northing team-configured portal. |
| Updates | The configured update endpoint and its artifact storage host. For Keygen, obtain the actual redirect host during deployment verification. |
Use HTTPS port 443 unless a configured service specifies another approved port. Do not assume portal access alone covers its feature, tile, identity-provider, and federated-server hosts.
Licensing and update checks send licensing identity, not workspace rows or SQL. Assistant requests are different: they can include permitted data context. Review sensitivity and model policy before enabling a hosted provider.
Proxy behavior
Section titled “Proxy behavior”Native ArcGIS, assistant, MCP, licensing, and supported catalog requests use system routing unless overridden. On macOS this reads the system proxy configuration; Windows uses the current user’s Internet settings and WinHTTP support, including PAC.
networkProxy in policy can select system, direct, or manual routing. Supported environment overrides include HTTPS_PROXY, HTTP_PROXY, ALL_PROXY, and NO_PROXY; explicit managed proxy or PAC settings take precedence. Policy proxy URLs cannot contain credentials.
Bypass patterns support exact hosts, wildcard or suffix domains, local host names, and IP ranges. Invalid PAC or policy settings block affected requests until you fix the configuration. Only the first PAC route is used; automatic failover through alternative PAC routes is not implemented. WPAD discovery occurs only when enabled or forced by policy.
The web view uses its own OS network configuration. DuckDB’s Overture GeoParquet downloads and the updater’s internal client are separate transports and do not use networkProxy. Test these separately on your network.
TLS and authentication
Section titled “TLS and authentication”Native HTTPS requests trust operating-system certificate roots as well as bundled Mozilla roots. Deploy inspection roots through your approved OS management process. Do not disable certificate verification to work around a failed connection.
Portal OAuth redirects to http://127.0.0.1:47321/callback. ChatGPT-plan and MCP sign-in use random loopback ports. Loopback destinations bypass proxies, including forced policy; endpoint software must permit the local callback.
Built-in ArcGIS account tokens can be bound to the outgoing IP. A VPN or proxy-exit change can require signing in again. Integrated Windows authentication needs the organization’s Kerberos or NTLM environment, while PKI uses provisioned OS identities. Native identities are selected again each app run.
Interpret checks correctly
Section titled “Interpret checks correctly”Self-test network checks are opt-in. They use anonymous HEAD requests without redirects and report routing and trust information. Use the results to check host reachability, then test sign-in, publishing, and map rendering with the intended account.
If a request fails, capture the app version, host category, time, and exact redacted error for IT. Avoid logging license authorization headers, signed download URLs, tokens, or raw request bodies. Diagnostics provides a reviewable local bundle.