Microsoft 365 endpoints

Optimize · Microsoft advises routing directly, without proxies or inspection · advertised over ExpressRoute

• outlook.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• 13.107.128.0/22
• 13.107.18.10/31
• 13.107.6.152/31
• 131.253.33.215/32
• 132.245.0.0/16
• 150.171.32.0/22
• 204.79.197.215/32
• 23.103.160.0/20
• 2603:1006::/40
• 2603:1016::/36
• 2603:1026::/36
• 2603:1036::/36
• 2603:1046::/36
• 2603:1056::/36
• 2620:1ec:4::152/128
• 2620:1ec:4::153/128
• 2620:1ec:8f0::/46
• 2620:1ec:900::/46
• 2620:1ec:a92::152/128
• 2620:1ec:a92::153/128
• 2620:1ec:c::10/128
• 2620:1ec:c::11/128
• 2620:1ec:d::10/128
• 2620:1ec:d::11/128
• 40.104.0.0/15
• 40.96.0.0/13
• 52.96.0.0/14

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute · optional: the service works without it, with reduced features

POP3, IMAP4, SMTP Client traffic

• outlook.office365.com
• smtp.office365.com
• 13.107.128.0/22
• 13.107.18.10/31
• 13.107.6.152/31
• 131.253.33.215/32
• 132.245.0.0/16
• 150.171.32.0/22
• 204.79.197.215/32
• 23.103.160.0/20
• 2603:1006::/40
• 2603:1016::/36
• 2603:1026::/36
• 2603:1036::/36
• 2603:1046::/36
• 2603:1056::/36
• 2620:1ec:4::152/128
• 2620:1ec:4::153/128
• 2620:1ec:8f0::/46
• 2620:1ec:900::/46
• 2620:1ec:a92::152/128
• 2620:1ec:a92::153/128
• 2620:1ec:c::10/128
• 2620:1ec:c::11/128
• 2620:1ec:d::10/128
• 2620:1ec:d::11/128
• 40.104.0.0/15
• 40.96.0.0/13
• 52.96.0.0/14

This set as a list

Default · Microsoft says it needs no special handling

• *.outlook.com
• autodiscover.*.onmicrosoft.com

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute

• *.protection.outlook.com
• 104.47.0.0/17
• 2a01:111:f400::/48
• 2a01:111:f403::/48
• 40.107.0.0/16
• 40.92.0.0/15
• 52.100.0.0/14
• 52.238.78.88/32

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute

• *.mail.protection.outlook.com
• *.mx.microsoft
• 104.47.0.0/17
• 2a01:111:f400::/48
• 2a01:111:f403::/48
• 40.107.0.0/16
• 40.92.0.0/15
• 52.100.0.0/14

This set as a list

Optimize · Microsoft advises routing directly, without proxies or inspection · advertised over ExpressRoute

• 2603:1063::/38
• 52.112.0.0/14
• 52.122.0.0/15

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute

• *.lync.com
• *.teams.cloud.microsoft
• *.teams.microsoft.com
• teams.cloud.microsoft
• teams.microsoft.com
• 2603:1027::/48
• 2603:1037::/48
• 2603:1047::/48
• 2603:1057::/48
• 2603:1063::/38
• 2620:1ec:40::/42
• 2620:1ec:6::/48
• 52.112.0.0/14
• 52.122.0.0/15

This set as a list

Default · Microsoft says it needs no special handling

• *.keydelivery.mediaservices.windows.net
• *.streaming.mediaservices.windows.net

This set as a list

Default · Microsoft says it needs no special handling

• aka.ms

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

For end user and customer owned device updates

• adl.windows.com

This set as a list

Default · Microsoft says it needs no special handling

• join.secure.skypeassets.com
• mlccdnprod.azureedge.net

This set as a list

Optimize · Microsoft advises routing directly, without proxies or inspection · advertised over ExpressRoute

• *.sharepoint.com
• 104.146.128.0/17
• 13.107.136.0/22
• 150.171.40.0/22
• 2603:1061:1300::/40
• 2603:1063:6000::/35
• 2620:1ec:8f8::/46
• 2620:1ec:908::/46
• 2a01:111:f402::/48
• 40.108.128.0/17
• 52.104.0.0/14

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

OneDrive for Business: supportability, telemetry, APIs, and embedded email links

• storage.live.com

This set as a list

Default · Microsoft says it needs no special handling

• *.wns.windows.com
• admin.onedrive.com
• officeclient.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• g.live.com
• oneclient.sfx.ms

This set as a list

Default · Microsoft says it needs no special handling

• *.sharepointonline.com
• spoprod-a.akamaihd.net

This set as a list

Default · Microsoft says it needs no special handling

• *.svc.ms

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute

• *.officeapps.live.com
• *.online.office.com
• office.live.com
• 13.107.140.6/32
• 13.107.18.15/32
• 13.107.6.171/32
• 2603:1006:1400::/40
• 2603:1016:2400::/40
• 2603:1026:2400::/40
• 2603:1036:2400::/40
• 2603:1046:1400::/40
• 2603:1056:1400::/40
• 2603:1063:2000::/38
• 2620:1ec:8fc::6/128
• 2620:1ec:a92::171/128
• 2620:1ec:c::15/128
• 2a01:111:f100:2000::a83e:3019/128
• 2a01:111:f100:2002::8975:2d79/128
• 2a01:111:f100:2002::8975:2da8/128
• 2a01:111:f100:7000::6fdd:6cd5/128
• 2a01:111:f100:a004::bfeb:88cf/128
• 52.108.0.0/14
• 52.244.37.168/32

This set as a list

Default · Microsoft says it needs no special handling

• *.office.net

This set as a list

Default · Microsoft says it needs no special handling

• *.onenote.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

OneNote notebooks (wildcards)

• *.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• *cdn.onenote.net

This set as a list

Default · Microsoft says it needs no special handling

• ajax.aspnetcdn.com
• apis.live.net
• officeapps.live.com
• www.onedrive.com

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute

• *.auth.microsoft.com
• *.msftidentity.com
• *.msidentity.com
• account.activedirectory.windowsazure.com
• accounts.accesscontrol.windows.net
• adminwebservice.microsoftonline.com
• api.passwordreset.microsoftonline.com
• autologon.microsoftazuread-sso.com
• becws.microsoftonline.com
• ccs.login.microsoftonline.com
• clientconfig.microsoftonline-p.net
• companymanager.microsoftonline.com
• device.login.microsoftonline.com
• graph.microsoft.com
• graph.windows.net
• login-us.microsoftonline.com
• login.microsoft.com
• login.microsoftonline-p.com
• login.microsoftonline.com
• login.windows.net
• logincert.microsoftonline.com
• loginex.microsoftonline.com
• nexus.microsoftonline-p.com
• passwordreset.microsoftonline.com
• provisioningapi.microsoftonline.com
• 20.190.128.0/18
• 20.20.32.0/19
• 20.231.128.0/19
• 2603:1006:2000::/48
• 2603:1007:200::/48
• 2603:1016:1400::/48
• 2603:1017::/48
• 2603:1026:3000::/48
• 2603:1027:1::/48
• 2603:1036:3000::/48
• 2603:1037:1::/48
• 2603:1046:2000::/48
• 2603:1047:1::/48
• 2603:1056:2000::/48
• 2603:1057:2::/48
• 40.126.0.0/18

This set as a list

Default · Microsoft says it needs no special handling

• *.hip.live.com
• *.microsoftonline-p.com
• *.microsoftonline.com
• *.msauth.net
• *.msauthimages.net
• *.msecnd.net
• *.msftauth.net
• *.msftauthimages.net
• *.phonefactor.net
• enterpriseregistration.windows.net

This set as a list

Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute

• *.protection.office.com
• *.security.microsoft.com
• compliance.microsoft.com
• defender.microsoft.com
• protection.office.com
• purview.microsoft.com
• security.microsoft.com
• 13.107.6.192/32
• 13.107.9.192/32
• 2620:1ec:4::192/128
• 2620:1ec:a92::192/128

This set as a list

Default · Microsoft says it needs no special handling

• *.portal.cloudappsecurity.com

This set as a list

Default · Microsoft says it needs no special handling

• *.aria.microsoft.com
• *.events.data.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• *.o365weve.com
• amp.azure.net
• appsforoffice.microsoft.com
• assets.onestore.ms
• auth.gfx.ms
• c1.microsoft.com
• dgps.support.microsoft.com
• docs.microsoft.com
• msdn.microsoft.com
• platform.linkedin.com
• prod.msocdn.com
• shellprod.msocdn.com
• support.microsoft.com
• technet.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• *.office365.com

This set as a list

Default · Microsoft says it needs no special handling

• *.aadrm.com
• *.azurerms.com
• *.informationprotection.azure.com
• ecn.dev.virtualearth.net
• informationprotection.hosting.portal.azure.net

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Graph.windows.net, Office 365 Management Pack for Operations Manager, SecureScore, Azure AD Device Registration, Forms, StaffHub, Application Insights, captcha services

• *.sharepointonline.com
• dc.services.visualstudio.com
• mem.gfx.ms

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Some Office 365 features require endpoints within these domains (including CDNs). Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to these wildcards.

• *.microsoft.com
• *.msocdn.com
• *.onmicrosoft.com

This set as a list

Default · Microsoft says it needs no special handling

• o15.officeredir.microsoft.com
• officepreviewredir.microsoft.com
• officeredir.microsoft.com
• r.office.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• activation.sls.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• crl.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• office15client.microsoft.com
• officeclient.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• go.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• ajax.aspnetcdn.com
• cdn.odc.officeapps.live.com

This set as a list

Default · Microsoft says it needs no special handling

• officecdn.microsoft.com
• otelrules.azureedge.net

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

ProPlus: auxiliary URLs

• *.virtualearth.net
• c.bing.net
• ocos-office365-s2s.msedge.net
• tse1.mm.bing.net
• www.bing.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Outlook for Android and iOS

• *.acompli.net
• *.outlookmobile.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Outlook for Android and iOS: Authentication

• login.windows-ppe.net

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Outlook for Android and iOS: Consumer Outlook.com and OneDrive integration

• account.live.com
• login.live.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Office Mobile URLs

• *.appex-rf.msn.com
• *.appex.bing.com
• c.bing.com
• c.live.com
• partnerservices.getmicrosoftkey.com
• signup.live.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Office for iPad URLs

• account.live.com
• auth.gfx.ms
• login.live.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Viva Engage

• *.yammer.com
• *.yammerusercontent.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Viva Engage Assets CDN

• *.assets-yammer.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Planner: auxiliary URLs

• www.outlook.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Sway CDNs

• eus-www.sway-cdn.com
• eus-www.sway-extensions.com
• wus-www.sway-cdn.com
• wus-www.sway-extensions.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Sway

• sway.com
• www.sway.com

This set as a list

Default · Microsoft says it needs no special handling

• *.entrust.net
• *.geotrust.com
• *.omniroot.com
• *.public-trust.com
• *.symcb.com
• *.symcd.com
• *.verisign.com
• *.verisign.net
• cacerts.digicert.com
• cert.int-x3.letsencrypt.org
• crl.globalsign.com
• crl.globalsign.net
• crl.identrust.com
• crl3.digicert.com
• crl4.digicert.com
• isrg.trustid.ocsp.identrust.com
• mscrl.microsoft.com
• ocsp.digicert.com
• ocsp.globalsign.com
• ocsp.msocsp.com
• ocsp2.globalsign.com
• ocspx.digicert.com
• oneocsp.microsoft.com
• secure.globalsign.com
• www.digicert.com
• www.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Connection to the speech service is required for Office Dictation features. If connectivity is not allowed, Dictation will be disabled.

• officespeech.platform.bing.com

This set as a list

Default · Microsoft says it needs no special handling

• *.skype.com

This set as a list

Default · Microsoft says it needs no special handling

• *.office.com
• www.microsoft365.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

These endpoints enable the Office Scripts functionality in Office clients available through the Automate tab and the Python in Excel functionality available through the Formulas tab. The Office Scripts feature can also be disabled through the Office 365 Admin portal. For admin controls related to Python in Excel, see [Data security and Python in Excel](https://support.microsoft.com/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327).

• *.microsoftusercontent.com

This set as a list

Default · Microsoft says it needs no special handling

• *.azure-apim.net
• *.flow.microsoft.com
• *.powerapps.com
• *.powerautomate.com

This set as a list

Default · Microsoft says it needs no special handling

• *.activity.windows.com
• activity.windows.com

This set as a list

Default · Microsoft says it needs no special handling

• *.cortana.ai

This set as a list

Default · Microsoft says it needs no special handling

• admin.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• cdn.odc.officeapps.live.com
• cdn.uci.officeapps.live.com

This set as a list

Allow · Microsoft advises routing directly where possible

• *.manage.microsoft.com
• manage.microsoft.com
• 104.208.197.64/27
• 104.46.162.96/27
• 13.67.13.176/28
• 13.67.15.128/27
• 13.69.231.128/28
• 13.69.67.224/28
• 13.70.78.128/28
• 13.70.79.128/27
• 13.74.111.192/27
• 13.77.53.176/28
• 13.86.221.176/28
• 13.89.174.240/28
• 13.89.175.192/28
• 172.160.217.160/27
• 172.201.237.160/27
• 172.202.86.192/27
• 172.205.63.0/25
• 172.212.214.0/25
• 172.215.131.0/27
• 20.168.189.128/27
• 20.189.172.160/27
• 20.189.229.0/25
• 20.191.167.0/25
• 20.192.159.40/29
• 20.192.174.216/29
• 20.199.207.192/28
• 20.204.193.10/31
• 20.204.193.12/30
• 20.204.194.128/31
• 20.208.149.192/27
• 20.208.157.128/27
• 20.214.131.176/29
• 20.37.153.0/24
• 20.37.192.128/25
• 20.38.81.0/24
• 20.41.1.0/24
• 20.42.1.0/24
• 20.42.130.0/24
• 20.42.224.128/25
• 20.43.129.0/24
• 20.44.19.224/27
• 20.91.147.72/29
• 4.145.74.224/27
• 4.150.254.64/27
• 4.154.145.224/27
• 4.200.254.32/27
• 4.207.244.0/27
• 4.213.25.64/27
• 4.213.86.128/25
• 4.216.205.32/27
• 4.237.143.128/25
• 40.119.8.128/25
• 40.67.121.224/27
• 40.70.151.32/28
• 40.71.14.96/28
• 40.74.25.0/24
• 40.78.245.240/28
• 40.78.247.128/27
• 40.79.197.64/27
• 40.79.197.96/28
• 40.80.180.208/28
• 40.80.180.224/27
• 40.80.184.128/25
• 40.82.248.224/28
• 40.82.249.128/25
• 40.84.70.128/25
• 48.218.252.128/25
• 52.150.137.0/25
• 52.162.111.96/28
• 52.168.116.128/27
• 52.182.141.192/27
• 52.236.189.96/27
• 52.240.244.160/27
• 57.151.0.192/27
• 57.153.235.0/25
• 57.154.140.128/25
• 57.154.195.0/25
• 57.155.45.128/25
• 68.218.134.96/27
• 74.224.214.64/27
• 74.242.35.0/25

This set as a list

Default · Microsoft says it needs no special handling

• *.dl.delivery.mp.microsoft.com
• *.do.dsp.mp.microsoft.com
• *.update.microsoft.com
• *.windowsupdate.com
• adl.windows.com
• dl.delivery.mp.microsoft.com
• tsfe.trafficshaping.dsp.mp.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• time.windows.com

This set as a list

Default · Microsoft says it needs no special handling

• *.s-microsoft.com
• clientconfig.passport.net
• windowsphone.com

This set as a list

Default · Microsoft says it needs no special handling

• approdimedatahotfix.azureedge.net
• approdimedatapri.azureedge.net
• approdimedatasec.azureedge.net
• euprodimedatahotfix.azureedge.net
• euprodimedatapri.azureedge.net
• euprodimedatasec.azureedge.net
• naprodimedatahotfix.azureedge.net
• naprodimedatapri.azureedge.net
• naprodimedatasec.azureedge.net
• swda01-mscdn.azureedge.net
• swda02-mscdn.azureedge.net
• swdb01-mscdn.azureedge.net
• swdb02-mscdn.azureedge.net
• swdc01-mscdn.azureedge.net
• swdc02-mscdn.azureedge.net
• swdd01-mscdn.azureedge.net
• swdd02-mscdn.azureedge.net
• swdin01-mscdn.azureedge.net
• swdin02-mscdn.azureedge.net

This set as a list

Default · Microsoft says it needs no special handling

• *.notify.windows.com
• *.wns.windows.com

This set as a list

Default · Microsoft says it needs no special handling

• ekcert.spserv.microsoft.com
• ekop.intel.com
• ftpm.amd.com

This set as a list

Default · Microsoft says it needs no special handling

• intunecdnpeasd.azureedge.net

This set as a list

Default · Microsoft says it needs no special handling

• *.monitor.azure.com
• *.support.services.microsoft.com
• *.trouter.communication.microsoft.com
• *.trouter.skype.com
• *.trouter.teams.microsoft.com
• api.flightproxy.skype.com
• ecs.communication.microsoft.com
• edge.microsoft.com
• edge.skype.com
• remoteassistanceprodacs.communication.azure.com
• remoteassistanceprodacseu.communication.azure.com
• remotehelp.microsoft.com
• wcpstatic.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• lgmsapeweu.blob.core.windows.net

This set as a list

Default · Microsoft says it needs no special handling

• *.cloud.microsoft

This set as a list

Default · Microsoft says it needs no special handling

• intunemaape1.eus.attest.azure.net
• intunemaape10.weu.attest.azure.net
• intunemaape11.weu.attest.azure.net
• intunemaape12.weu.attest.azure.net
• intunemaape13.jpe.attest.azure.net
• intunemaape17.jpe.attest.azure.net
• intunemaape18.jpe.attest.azure.net
• intunemaape19.jpe.attest.azure.net
• intunemaape2.eus2.attest.azure.net
• intunemaape3.cus.attest.azure.net
• intunemaape4.wus.attest.azure.net
• intunemaape5.scus.attest.azure.net
• intunemaape7.neu.attest.azure.net
• intunemaape8.neu.attest.azure.net
• intunemaape9.neu.attest.azure.net

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Android Remote Help requires this endpoint.

• *.webpubsub.azure.com

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Remote Help Dependancy for GCC customers

• *.gov.teams.microsoft.us
• remoteassistanceweb.usgov.communication.azure.us

This set as a list

Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features

Feature flighting (opt in/out) may not function if this is not included

• config.edge.skype.com

This set as a list

Default · Microsoft says it needs no special handling

• fd.api.orgmsg.microsoft.com
• ris.prod.api.personalization.ideas.microsoft.com

This set as a list

Default · Microsoft says it needs no special handling

• *.static.microsoft
• *.usercontent.microsoft

This set as a list