Hey @ingmar.vis! Thank you for your question. I spoke to our Integrations team about this and I’ll do my best to summarize their response.
The reason the IQ Azure DevOps extension tries to access spdx.org is to validate that the license IDs present in the input file are valid SPDX licenses. The extension has a cache of valid license IDs internally, but it tries to keep it up to date by fetching the latest data from spdx.org. So if it cannot access spdx.org, it just logs that fact for information purposes and it should continue working based on the internal cache. In other words, if you do not whitelist spdx.org, the pipeline should not fail. When spdx.org is reachable, the extension pulls only license info data (in JSON format.)
If you experience pipeline failures, the recommendation is to open a ticket with our Support team so we can take a closer look and investigate further.
I hope this helps a bit but let me know if you have further questions/concerns.