Microsoft 365 endpoints
Microsoft's published endpoint sets, every observed change between complete versions, and lists your firewall can read.
Worldwide · version 2026103000
77 sets · checked today 14:12 UTC · next today 15:12 UTCObserved changes · to version 2026103000 · all retained versions
Most recent 1 observation dates · retained from 30 Oct 2026 to 30 Oct 2026. Choose any date in that range.
-
Hosts−2 host names
URLs as published−2
-
Removed
isrg.trustid.ocsp.identrust.comno longer covered -
Removed
ocsp.msocsp.comno longer covered
Microsoft gave no effective date for this change.
-
Removed
What a set is. Microsoft publishes Microsoft 365's network requirements as numbered sets. A set groups the URLs, IP ranges and ports that need the same handling, and its number stays the same across versions, so Microsoft's notes and the changes above refer to it. The category says how to route it:
- OptimizeMicrosoft advises routing directly, without proxies or inspection
- AllowMicrosoft advises routing directly where possible
- DefaultMicrosoft says it needs no special handling
- optionalNot required: the service works without it, with reduced features.
Current endpoint sets · 77 of 77 · list of these values
Common and identity
45 sets · 159 URLs · 40 IP ranges · Allow, Default
Set 46*.officeapps.live.com, *.online.office.com +1
Allow
TCP 443, 80
3515
—
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute
*.officeapps.live.com*.online.office.comoffice.live.com13.107.140.6/3213.107.18.15/3213.107.6.171/322603:1006:1400::/402603:1016:2400::/402603:1026:2400::/402603:1036:2400::/402603:1046:1400::/402603:1056:1400::/40
Set 47*.office.net
Default
TCP 443, 80 · UDP 443
100
—
Set 49*.onenote.com
Default
TCP 443
100
—
Set 50optional*.microsoft.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
OneNote notebooks (wildcards)
*.microsoft.com
Set 51*cdn.onenote.net
Default
TCP 443
100
—
Set 53ajax.aspnetcdn.com, apis.live.net +2
Default
TCP 443
400
—
Default · Microsoft says it needs no special handling
ajax.aspnetcdn.comapis.live.netofficeapps.live.comwww.onedrive.com
Set 56*.auth.microsoft.com, *.msftidentity.com +20
Allow
TCP 443, 80
22412
30 Oct
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute
*.auth.microsoft.com*.msftidentity.comaccount.activedirectory.windowsazure.comaccounts.accesscontrol.windows.netadminwebservice.microsoftonline.comapi.passwordreset.microsoftonline.comautologon.microsoftazuread-sso.comccs.login.microsoftonline.comclientconfig.microsoftonline-p.netcompanymanager.microsoftonline.comdevice.login.microsoftonline.comgraph.microsoft.com
Set 59*.hip.live.com, *.microsoftonline-p.com +8
Default
TCP 443, 80
1000
—
Default · Microsoft says it needs no special handling
*.hip.live.com*.microsoftonline-p.com*.microsoftonline.com*.msauth.net*.msauthimages.net*.msecnd.net*.msftauth.net*.msftauthimages.net*.phonefactor.netenterpriseregistration.windows.net
Set 64*.protection.office.com, *.security.microsoft.com +5
Allow
TCP 443
722
—
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute
*.protection.office.com*.security.microsoft.comcompliance.microsoft.comdefender.microsoft.comprotection.office.compurview.microsoft.comsecurity.microsoft.com13.107.6.192/3213.107.9.192/322620:1ec:4::192/1282620:1ec:a92::192/128
Set 66*.portal.cloudappsecurity.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling
*.portal.cloudappsecurity.com
Set 69*.aria.microsoft.com, *.events.data.microsoft.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling
*.aria.microsoft.com*.events.data.microsoft.com
Set 70*.o365weve.com, amp.azure.net +9
Default
TCP 443
1100
30 Oct
Default · Microsoft says it needs no special handling
*.o365weve.comamp.azure.netappsforoffice.microsoft.comauth.gfx.msc1.microsoft.comdgps.support.microsoft.comdocs.microsoft.commsdn.microsoft.complatform.linkedin.comshellprod.msocdn.comtechnet.microsoft.com
Set 71*.office365.com
Default
TCP 443, 80
100
—
Set 73*.aadrm.com, *.azurerms.com +3
Default
TCP 443
500
—
Default · Microsoft says it needs no special handling
*.aadrm.com*.azurerms.com*.informationprotection.azure.comecn.dev.virtualearth.netinformationprotection.hosting.portal.azure.net
Set 75optional*.sharepointonline.com, dc.services.visualstudio.com +1
Default
TCP 443
300
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Graph.windows.net, Office 365 Management Pack for Operations Manager, SecureScore, Azure AD Device Registration, Forms, StaffHub, Application Insights, captcha services
*.sharepointonline.comdc.services.visualstudio.commem.gfx.ms
Set 78optional*.microsoft.com, *.msocdn.com +1
Default
TCP 443, 80
300
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Some Office 365 features require endpoints within these domains (including CDNs). Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to these wildcards.
*.microsoft.com*.msocdn.com*.onmicrosoft.com
Set 79o15.officeredir.microsoft.com, officepreviewredir.microsoft.com +2
Default
TCP 443, 80
400
—
Default · Microsoft says it needs no special handling
o15.officeredir.microsoft.comofficepreviewredir.microsoft.comofficeredir.microsoft.comr.office.microsoft.com
Set 83activation.sls.microsoft.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling
activation.sls.microsoft.com
Set 84crl.microsoft.com
Default
TCP 443, 80
100
—
Set 86office15client.microsoft.com, officeclient.microsoft.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling
office15client.microsoft.comofficeclient.microsoft.com
Set 89go.microsoft.com
Default
TCP 443, 80
100
—
Set 91ajax.aspnetcdn.com, cdn.odc.officeapps.live.com
Default
TCP 443, 80
200
—
Default · Microsoft says it needs no special handling
ajax.aspnetcdn.comcdn.odc.officeapps.live.com
Set 92officecdn.microsoft.com, otelrules.azureedge.net
Default
TCP 443, 80
200
—
Default · Microsoft says it needs no special handling
officecdn.microsoft.comotelrules.azureedge.net
Set 93optional*.virtualearth.net, c.bing.net +3
Default
TCP 443, 80
500
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
ProPlus: auxiliary URLs
*.virtualearth.netc.bing.netocos-office365-s2s.msedge.nettse1.mm.bing.netwww.bing.com
Set 95optional*.acompli.net, *.outlookmobile.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Outlook for Android and iOS
*.acompli.net*.outlookmobile.com
Set 96optionallogin.windows-ppe.net
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Outlook for Android and iOS: Authentication
login.windows-ppe.net
Set 97optionalaccount.live.com, login.live.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Outlook for Android and iOS: Consumer Outlook.com and OneDrive integration
account.live.comlogin.live.com
Set 114optional*.appex-rf.msn.com, *.appex.bing.com +4
Default
TCP 443, 80
600
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Office Mobile URLs
*.appex-rf.msn.com*.appex.bing.comc.bing.comc.live.compartnerservices.getmicrosoftkey.comsignup.live.com
Set 116optionalaccount.live.com, auth.gfx.ms +1
Default
TCP 443, 80
300
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Office for iPad URLs
account.live.comauth.gfx.mslogin.live.com
Set 117optional*.yammer.com, *.yammerusercontent.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Viva Engage
*.yammer.com*.yammerusercontent.com
Set 118optional*.assets-yammer.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Viva Engage Assets CDN
*.assets-yammer.com
Set 121optionalwww.outlook.com
Default
TCP 443, 80
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Planner: auxiliary URLs
www.outlook.com
Set 122optionaleus-www.sway-cdn.com, eus-www.sway-extensions.com +2
Default
TCP 443
400
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Sway CDNs
eus-www.sway-cdn.comeus-www.sway-extensions.comwus-www.sway-cdn.comwus-www.sway-extensions.com
Set 124optionalsway.com, www.sway.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Sway
sway.comwww.sway.com
Set 125*.entrust.net, *.geotrust.com +22
Default
TCP 443, 80
2400
30 Oct
Default · Microsoft says it needs no special handling
*.entrust.net*.geotrust.com*.omniroot.com*.public-trust.com*.symcb.com*.symcd.com*.verisign.com*.verisign.netcacerts.digicert.comcert.int-x3.letsencrypt.orgcrl.globalsign.comcrl.globalsign.net
Set 126optionalofficespeech.platform.bing.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Connection to the speech service is required for Office Dictation features. If connectivity is not allowed, Dictation will be disabled.
officespeech.platform.bing.com
Set 147*.office.com, www.microsoft365.com
Default
TCP 443, 80
200
—
Default · Microsoft says it needs no special handling
*.office.comwww.microsoft365.com
Set 152optional*.microsoftusercontent.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
These endpoints enable the Office Scripts functionality in Office clients available through the Automate tab and the Python in Excel functionality available through the Formulas tab. The Office Scripts feature can also be disabled through the Office 365 Admin portal. For admin controls related to Python in Excel, see [Data security and Python in Excel](https://support.microsoft.com/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327).
*.microsoftusercontent.com
Set 153*.azure-apim.net, *.flow.microsoft.com +2
Default
TCP 443
400
—
Default · Microsoft says it needs no special handling
*.azure-apim.net*.flow.microsoft.com*.powerapps.com*.powerautomate.com
Set 156*.activity.windows.com, activity.windows.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling
*.activity.windows.comactivity.windows.com
Set 158*.cortana.ai
Default
TCP 443
100
—
Set 159admin.microsoft.com
Default
TCP 443, 80
100
—
Set 160cdn.odc.officeapps.live.com, cdn.uci.officeapps.live.com
Default
TCP 443, 80
200
—
Default · Microsoft says it needs no special handling
cdn.odc.officeapps.live.comcdn.uci.officeapps.live.com
Set 184*.cloud.microsoft
Default
TCP 443 · UDP 443
100
—
Set 193*.static.microsoft, *.usercontent.microsoft
Default
TCP 443 · UDP 443
200
—
Default · Microsoft says it needs no special handling
*.static.microsoft*.usercontent.microsoft
Exchange
5 sets · 10 URLs · 67 IP ranges · Optimize, Allow, Default
Set 1outlook.cloud.microsoft, outlook.office.com +1
Optimize
TCP 443, 80 · UDP 443
31116
—
Optimize · Microsoft advises routing directly, without proxies or inspection · advertised over ExpressRoute
outlook.cloud.microsoftoutlook.office.comoutlook.office365.com13.107.128.0/2213.107.18.10/3113.107.6.152/31131.253.33.215/32132.245.0.0/16150.171.32.0/22204.79.197.215/3223.103.160.0/202603:1006::/40
Set 2optionaloutlook.office365.com, smtp.office365.com
Allow
TCP 143, 587, 993, 995
21116
—
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute · optional: the service works without it, with reduced features
POP3, IMAP4, SMTP Client traffic
outlook.office365.comsmtp.office365.com13.107.128.0/2213.107.18.10/3113.107.6.152/31131.253.33.215/32132.245.0.0/16150.171.32.0/22204.79.197.215/3223.103.160.0/202603:1006::/402603:1016::/36
Set 8*.outlook.com, autodiscover.*.onmicrosoft.com
Default
TCP 443, 80
200
—
Default · Microsoft says it needs no special handling
*.outlook.comautodiscover.*.onmicrosoft.com
Set 9*.protection.outlook.com
Allow
TCP 443
152
—
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute
*.protection.outlook.com104.47.0.0/172a01:111:f400::/482a01:111:f403::/4840.107.0.0/1640.92.0.0/1552.100.0.0/1452.238.78.88/32
Set 10*.mail.protection.outlook.com, *.mx.microsoft
Allow
TCP 25
242
—
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute
*.mail.protection.outlook.com*.mx.microsoft104.47.0.0/172a01:111:f400::/482a01:111:f403::/4840.107.0.0/1640.92.0.0/1552.100.0.0/14
SharePoint
6 sets · 10 URLs · 10 IP ranges · Optimize, Default
Set 31*.sharepoint.com
Optimize
TCP 443, 80 · UDP 443
155
—
Optimize · Microsoft advises routing directly, without proxies or inspection · advertised over ExpressRoute
*.sharepoint.com104.146.128.0/1713.107.136.0/22150.171.40.0/222603:1061:1300::/402603:1063:6000::/352620:1ec:8f8::/462620:1ec:908::/462a01:111:f402::/4840.108.128.0/1752.104.0.0/14
Set 32optionalstorage.live.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
OneDrive for Business: supportability, telemetry, APIs, and embedded email links
storage.live.com
Set 35*.wns.windows.com, admin.onedrive.com +1
Default
TCP 443, 80
300
—
Default · Microsoft says it needs no special handling
*.wns.windows.comadmin.onedrive.comofficeclient.microsoft.com
Set 36g.live.com, oneclient.sfx.ms
Default
TCP 443, 80
200
—
Set 37*.sharepointonline.com, spoprod-a.akamaihd.net
Default
TCP 443, 80
200
—
Default · Microsoft says it needs no special handling
*.sharepointonline.comspoprod-a.akamaihd.net
Set 39*.svc.ms
Default
TCP 443, 80
100
—
Teams / Skype
6 sets · 10 URLs · 12 IP ranges · Optimize, Allow, Default
Set 112603:1063::/38, 52.112.0.0/14 +1
Optimize
UDP 3478, 3479, 3480, 3481
021
—
Optimize · Microsoft advises routing directly, without proxies or inspection · advertised over ExpressRoute
2603:1063::/3852.112.0.0/1452.122.0.0/15
Set 12*.lync.com, *.teams.cloud.microsoft +3
Allow
TCP 443, 80 · UDP 443
527
—
Allow · Microsoft advises routing directly where possible · advertised over ExpressRoute
*.lync.com*.teams.cloud.microsoft*.teams.microsoft.comteams.cloud.microsoftteams.microsoft.com2603:1027::/482603:1037::/482603:1047::/482603:1057::/482603:1063::/382620:1ec:40::/422620:1ec:6::/48
Set 16*.keydelivery.mediaservices.windows.net, *.streaming.mediaservices.windows.net
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling
*.keydelivery.mediaservices.windows.net*.streaming.mediaservices.windows.net
Set 17aka.ms
Default
TCP 443
100
—
Set 19optionaladl.windows.com
Default
TCP 443, 80
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
For end user and customer owned device updates
adl.windows.com
Set 127*.skype.com
Default
TCP 443, 80
100
—
Intune (MEM)
15 sets · 73 URLs · 81 IP ranges · Allow, Default
Set 163*.manage.microsoft.com, manage.microsoft.com
Allow
TCP 443, 80
2810
—
Allow · Microsoft advises routing directly where possible
*.manage.microsoft.commanage.microsoft.com104.208.197.64/27104.46.162.96/2713.67.13.176/2813.67.15.128/2713.69.231.128/2813.69.67.224/2813.70.78.128/2813.70.79.128/2713.74.111.192/2713.77.53.176/28
Set 164*.dl.delivery.mp.microsoft.com, *.do.dsp.mp.microsoft.com +5
Default
TCP 443, 80
700
—
Default · Microsoft says it needs no special handling
*.dl.delivery.mp.microsoft.com*.do.dsp.mp.microsoft.com*.update.microsoft.com*.windowsupdate.comadl.windows.comdl.delivery.mp.microsoft.comtsfe.trafficshaping.dsp.mp.microsoft.com
Set 165time.windows.com
Default
UDP 123
100
—
Set 169*.s-microsoft.com, clientconfig.passport.net +1
Default
TCP 443
300
—
Default · Microsoft says it needs no special handling
*.s-microsoft.comclientconfig.passport.netwindowsphone.com
Set 170approdimedatahotfix.azureedge.net, approdimedatapri.azureedge.net +17
Default
TCP 443
1900
—
Default · Microsoft says it needs no special handling
approdimedatahotfix.azureedge.netapprodimedatapri.azureedge.netapprodimedatasec.azureedge.neteuprodimedatahotfix.azureedge.neteuprodimedatapri.azureedge.neteuprodimedatasec.azureedge.netnaprodimedatahotfix.azureedge.netnaprodimedatapri.azureedge.netnaprodimedatasec.azureedge.netswda01-mscdn.azureedge.netswda02-mscdn.azureedge.netswdb01-mscdn.azureedge.net
Set 171*.notify.windows.com, *.wns.windows.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling
*.notify.windows.com*.wns.windows.com
Set 173ekcert.spserv.microsoft.com, ekop.intel.com +1
Default
TCP 443
300
—
Default · Microsoft says it needs no special handling
ekcert.spserv.microsoft.comekop.intel.comftpm.amd.com
Set 179intunecdnpeasd.azureedge.net
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling
intunecdnpeasd.azureedge.net
Set 181*.monitor.azure.com, *.support.services.microsoft.com +11
Default
TCP 443
1300
—
Default · Microsoft says it needs no special handling
*.monitor.azure.com*.support.services.microsoft.com*.trouter.communication.microsoft.com*.trouter.skype.com*.trouter.teams.microsoft.comapi.flightproxy.skype.comecs.communication.microsoft.comedge.microsoft.comedge.skype.comremoteassistanceprodacs.communication.azure.comremoteassistanceprodacseu.communication.azure.comremotehelp.microsoft.com
Set 182lgmsapeweu.blob.core.windows.net
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling
lgmsapeweu.blob.core.windows.net
Set 186intunemaape1.eus.attest.azure.net, intunemaape10.weu.attest.azure.net +13
Default
TCP 443
1500
—
Default · Microsoft says it needs no special handling
intunemaape1.eus.attest.azure.netintunemaape10.weu.attest.azure.netintunemaape11.weu.attest.azure.netintunemaape12.weu.attest.azure.netintunemaape13.jpe.attest.azure.netintunemaape17.jpe.attest.azure.netintunemaape18.jpe.attest.azure.netintunemaape19.jpe.attest.azure.netintunemaape2.eus2.attest.azure.netintunemaape3.cus.attest.azure.netintunemaape4.wus.attest.azure.netintunemaape5.scus.attest.azure.net
Set 187optional*.webpubsub.azure.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Android Remote Help requires this endpoint.
*.webpubsub.azure.com
Set 188optional*.gov.teams.microsoft.us, remoteassistanceweb.usgov.communication.azure.us
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Remote Help Dependancy for GCC customers
*.gov.teams.microsoft.usremoteassistanceweb.usgov.communication.azure.us
Set 189optionalconfig.edge.skype.com
Default
TCP 443
100
—
Default · Microsoft says it needs no special handling · optional: the service works without it, with reduced features
Feature flighting (opt in/out) may not function if this is not included
config.edge.skype.com
Set 192fd.api.orgmsg.microsoft.com, ris.prod.api.personalization.ideas.microsoft.com
Default
TCP 443
200
—
Default · Microsoft says it needs no special handling
fd.api.orgmsg.microsoft.comris.prod.api.personalization.ideas.microsoft.com
Microsoft's endpoint web service · JSON with change history · Followed sets in My radar