Managing Microsoft 365 endpoints

This page's changes and edits · All guidance changes

Microsoft's edit · 5 Dec 2022 21:29 UTC

Update managing-office-365-endpoints.md

Microsoft's commit message in MicrosoftDocs/microsoft-365-docs · commit 9c60bf7 · +8 −8 lines · also on GitHub

⋯ 37 unchanged lines

3838

3939 Microsoft is working with SD-WAN providers to enable automated configuration. For more information, see [Microsoft 365 Networking Partner Program](microsoft-365-networking-partner-program.md).

4040

41 −<a name="pacfiles"> </a>

4241 ## Use a PAC file for direct routing of vital Microsoft 365 traffic

42 +<a name="pacfiles"> </a>

4343

4444 Use PAC or WPAD files to manage network requests that are associated with Microsoft 365 but don't have an IP address. Typical network requests that are sent through a proxy or perimeter device increase latency. While SSL Break and Inspect creates the largest latency, other services such as proxy authentication and reputation lookup can cause poor performance and a bad user experience. Additionally, these perimeter network devices need enough capacity to process all of the network connection requests. We recommend bypassing your proxy or inspection devices for direct Microsoft 365 network requests.

4545

⋯ 46 unchanged lines

9292

9393 If you're doing this manually, you'll need to get the Optimize and Allow endpoint category data from the Microsoft 365 IP Address and URL Web Service and configure your proxy server to bypass processing for these. It is important to avoid SSL Break and Inspect and Proxy Authentication for the Optimize and Allow category endpoints.

9494

95 −<a name="bkmk_changes"> </a>

9695 ## Change management for Microsoft 365 IP addresses and URLs

96 +<a name="bkmk_changes"> </a>

9797

9898 In addition to selecting appropriate configuration for your network perimeter, it's critical that you adopt a change management process for Microsoft 365 endpoints. These endpoints change regularly and if you don't manage the changes, you can end up with users blocked or with poor performance after a new IP address or URL is added.

9999

⋯ 16 unchanged lines

116116 We understand that you might still require manual processing for network endpoint changes that come through each month. You can use Power Automate to create a flow that notifies you by email and optionally runs an approval process for changes when Microsoft 365 network endpoints have changes. Once review is completed, you can have the flow automatically email the changes to your firewall and proxy server management team.

117117

118118 For information about a Power Automate sample and template, see [Use Power Automate to receive an email for changes to Microsoft 365 IP addresses and URLs](https://techcommunity.microsoft.com/t5/Office-365-Networking/Use-Microsoft-Flow-to-receive-an-email-for-changes-to-Office-365/td-p/240651).

119 −

120 −<a name="FAQ"> </a>

119 +

121120 ## Microsoft 365 network endpoints FAQ

121 +<a name="FAQ"> </a>

122122

123123 See these frequently asked questions about Microsoft 365 network connectivity.

124124

⋯ 10 unchanged lines

135135 **Peering locations** are described in more detail in [peering with Microsoft](https://www.microsoft.com/peering).

136136

137137 With over 2500 ISP peering relationships globally and 70 points of presence, getting from your network to ours should be seamless. It can't hurt to spend a few minutes making sure your ISP's peering relationship is the most optimal, [here's a few examples](/archive/blogs/onthewire/__guidance) of good and not so good peering hand-offs to our network.

138 −

139 −<a name="bkmk_MissingIP"> </a>

138 +

140139 ### I see network requests to IP addresses not on the published list, do I need to provide access to them?

140 +<a name="bkmk_MissingIP"> </a>

141141

142142 We only provide IP addresses for the Microsoft 365 servers you should route directly to. This isn't a comprehensive list of all IP addresses you'll see network requests for. You'll see network requests to Microsoft and third-party owned, unpublished, IP addresses. These IP addresses are dynamically generated or managed in a way that prevents timely notice when they change. If your firewall can't allow access based on the FQDNs for these network requests, use a PAC or WPAD file to manage the requests.

143143

⋯ 4 unchanged lines

148148 3. The IP address may not be part of Microsoft 365 or a dependency. Microsoft 365 network endpoint publishing doesn't include all of Microsoft network endpoints.

149149 4. Check the certificate. With a browser, connect to the IP address using *HTTPS://\<IP_ADDRESS\>* and check the domains listed on the certificate to understand what domains are associated with the IP address. If it's a Microsoft-owned IP address and not on the list of Microsoft 365 IP addresses, it's likely the IP address is associated with a Microsoft CDN such as *MSOCDN.NET* or another Microsoft domain without published IP information. If you do find the domain on the certificate is one where we claim to list the IP address, please let us know.

150150

151 −<a name="bkmk_cname"> </a>

152151 ### Some Microsoft 365 URLs point to CNAME records instead of A records in the DNS. What do I have to do with the CNAME records?

152 +<a name="bkmk_cname"> </a>

153153

154154 Client computers need a DNS A or AAAA record that includes one or more IP address(es) to connect to a cloud service. Some URLs included in Microsoft 365 show CNAME records instead of A or AAAA records. These CNAME records are intermediary and there may be several in a chain. They will always eventually resolve to an A or AAAA record for an IP Address. For example, consider the following series of DNS records, which ultimately resolves to the IP address _IP_1_:

155155

⋯ 7 unchanged lines

163163

164164 Hard-coded configurations or using an allowlist based on indirect Microsoft 365 FQDNs aren't recommended, not supported by Microsoft, and are known to cause customer connectivity issues. DNS solutions that block on CNAME redirection, or that otherwise incorrectly resolve Microsoft 365 DNS entries, can be solved via DNS forwarders with DNS recursion enabled or by using DNS root hints. Many third-party network perimeter products natively integrate recommended Microsoft 365 endpoint to include an allowlist in their configuration using the [Microsoft 365 IP Address and URL Web service](microsoft-365-ip-web-service.md).

165165

166 −<a name="bkmk_akamai"> </a>

167166 ### Why do I see names such as nsatc.net or akadns.net in the Microsoft domain names?

167 +<a name="bkmk_akamai"> </a>

168168

169169 Microsoft 365 and other Microsoft services use several third-party services such as Akamai and MarkMonitor to improve your Microsoft 365 experience. To keep giving you the best experience possible, we may change these services in the future. Third-party domains may host content, such as a CDN, or they may host a service, such as a geographical traffic management service. Some of the services currently in use include:

170170

⋯ 60 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/microsoft-365-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:18 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.