Microsoft's edit · Managing Microsoft 365 endpoints

11 ---

2 −title: Managing Office 365 endpoints

2 +title: Managing Microsoft 365 endpoints

33 ms.author: kvice

44 author: kelleyvice-msft

55 manager: scotv

6 −ms.date: 05/18/2022

6 +ms.date:

77 audience: ITPro

88 ms.topic: conceptual

99 ms.service: microsoft-365-enterprise

1919 - seo-marvel-apr2020

2020 search.appverid: MOE150

2121 ms.assetid: 99cab9d4-ef59-4207-9f2b-3728eb46bf9a

22 −description: Learn how to manage Office 365 endpoints so that they work with your enterprise organization network architecture.

22 +description: Learn how to manage Microsoft 365 endpoints so that they work with your enterprise organization network architecture.

2323 ---

2424

25 −# Managing Office 365 endpoints

25 +# Managing Microsoft 365 endpoints

2626

27 −Most enterprise organizations that have multiple office locations and a connecting WAN will need configuration for Office 365 network connectivity. You can optimize your network by sending all trusted Office 365 network requests directly through your firewall, bypassing all extra packet level inspection or processing. This reduces latency and your perimeter capacity requirements. Identifying Office 365 network traffic is the first step in providing optimal performance for your users. For more information, see [Office 365 Network Connectivity Principles](microsoft-365-network-connectivity-principles.md).

27 +Most enterprise organizations that have multiple office locations and a connecting WAN will need configuration for Microsoft 365 network connectivity. You can optimize your network by sending all trusted Microsoft 365 network requests directly through your firewall, bypassing all extra packet level inspection or processing. This reduces latency and your perimeter capacity requirements. Identifying Microsoft 365 network traffic is the first step in providing optimal performance for your users. For more information, see [Microsoft 365 Network Connectivity Principles](microsoft-365-network-connectivity-principles.md).

2828

29 −Microsoft recommends you access the Office 365 network endpoints and ongoing changes to them using the [Office 365 IP Address and URL Web Service](microsoft-365-ip-web-service.md).

29 +Microsoft recommends you access the Microsoft 365 network endpoints and ongoing changes to them using the [Microsoft 365 IP Address and URL Web Service](microsoft-365-ip-web-service.md).

3030

31 −Regardless of how you manage vital Office 365 network traffic, Office 365 requires Internet connectivity. Other network endpoints where connectivity is required are listed at [Additional endpoints not included in the Office 365 IP Address and URL Web service](additional-office365-ip-addresses-and-urls.md).

31 +Regardless of how you manage vital Microsoft 365 network traffic, Microsoft 365 requires Internet connectivity. Other network endpoints where connectivity is required are listed at [Additional endpoints not included in the Microsoft 365 IP Address and URL Web service](additional-office365-ip-addresses-and-urls.md).

3232

33 −How you use the Office 365 network endpoints will depend on your enterprise organization network architecture. This article outlines several ways that enterprise network architectures can integrate with Office 365 IP addresses and URLs. The easiest way to choose which network requests to trust is to use SD-WAN devices that support automated Office 365 configuration at each of your office locations.

33 +How you use the Microsoft 365 network endpoints will depend on your enterprise organization network architecture. This article outlines several ways that enterprise network architectures can integrate with Microsoft 365 IP addresses and URLs. The easiest way to choose which network requests to trust is to use SD-WAN devices that support automated Microsoft 365 configuration at each of your office locations.

3434

35 −## SD-WAN for local branch egress of vital Office 365 network traffic

35 +## SD-WAN for local branch egress of vital Microsoft 365 network traffic

3636

37 −At each branch office location, you can provide an SD-WAN device that is configured to route traffic for Office 365 Optimize category of endpoints, or Optimize and Allow categories, directly to Microsoft's network. Other network traffic including on-premises datacenter traffic, general Internet web sites traffic, and traffic to Office 365 Default category endpoints is sent to another location where you have a more substantial network perimeter.

37 +At each branch office location, you can provide an SD-WAN device that is configured to route traffic for Microsoft 365 Optimize category of endpoints, or Optimize and Allow categories, directly to Microsoft's network. Other network traffic including on-premises datacenter traffic, general Internet web sites traffic, and traffic to Microsoft 365 Default category endpoints is sent to another location where you have a more substantial network perimeter.

3838

39 −Microsoft is working with SD-WAN providers to enable automated configuration. For more information, see [Office 365 Networking Partner Program](microsoft-365-networking-partner-program.md).

39 +Microsoft is working with SD-WAN providers to enable automated configuration. For more information, see [Microsoft 365 Networking Partner Program](microsoft-365-networking-partner-program.md).

4040

4141 <a name="pacfiles"> </a>

42 −## Use a PAC file for direct routing of vital Office 365 traffic

42 +## Use a PAC file for direct routing of vital Microsoft 365 traffic

4343

44 −Use PAC or WPAD files to manage network requests that are associated with Office 365 but don't have an IP address. Typical network requests that are sent through a proxy or perimeter device increase latency. While SSL Break and Inspect creates the largest latency, other services such as proxy authentication and reputation lookup can cause poor performance and a bad user experience. Additionally, these perimeter network devices need enough capacity to process all of the network connection requests. We recommend bypassing your proxy or inspection devices for direct Office 365 network requests.

44 +Use PAC or WPAD files to manage network requests that are associated with Microsoft 365 but don't have an IP address. Typical network requests that are sent through a proxy or perimeter device increase latency. While SSL Break and Inspect creates the largest latency, other services such as proxy authentication and reputation lookup can cause poor performance and a bad user experience. Additionally, these perimeter network devices need enough capacity to process all of the network connection requests. We recommend bypassing your proxy or inspection devices for direct Microsoft 365 network requests.

4545

46 −[PowerShell Gallery Get-PacFile](https://www.powershellgallery.com/packages/Get-PacFile) is a PowerShell script that reads the latest network endpoints from the Office 365 IP Address and URL Web service and creates a sample PAC file. You can modify the script so that it integrates with your existing PAC file management.

46 +[PowerShell Gallery Get-PacFile](https://www.powershellgallery.com/packages/Get-PacFile) is a PowerShell script that reads the latest network endpoints from the Microsoft 365 IP Address and URL Web service and creates a sample PAC file. You can modify the script so that it integrates with your existing PAC file management.

4747

4848 > [!NOTE]

49 −> For more information about the security and performance considerations of direct connectivity to Office 365 endpoints, see [Office 365 Network Connectivity Principles](microsoft-365-network-connectivity-principles.md).

49 +> For more information about the security and performance considerations of direct connectivity to Microsoft 365 endpoints, see [Microsoft 365 Network Connectivity Principles](microsoft-365-network-connectivity-principles.md).

5050

51 −![Connecting to Office 365 through firewalls and proxies.](../media/34d402f3-f502-42a0-8156-24a7c4273fa5.png)

51 +![Connecting to Microsoft 365 through firewalls and proxies.](../media/34d402f3-f502-42a0-8156-24a7c4273fa5.png)

5252

5353 **Figure 1 - Simple enterprise network perimeter**

5454

55 −The PAC file is deployed to web browsers at point 1 in Figure 1. When using a PAC file for direct egress of vital Office 365 network traffic, you also need to allow connectivity to the IP addresses behind these URLs on your network perimeter firewall. This is done by fetching the IP addresses for the same Office 365 endpoint categories as specified in the PAC file and creating firewall ACLs based on those addresses. The firewall is point 3 in Figure 1.

55 +The PAC file is deployed to web browsers at point 1 in Figure 1. When using a PAC file for direct egress of vital Microsoft 365 network traffic, you also need to allow connectivity to the IP addresses behind these URLs on your network perimeter firewall. This is done by fetching the IP addresses for the same Microsoft 365 endpoint categories as specified in the PAC file and creating firewall ACLs based on those addresses. The firewall is point 3 in Figure 1.

5656

5757 Separately if you choose to only do direct routing for the Optimize category endpoints, any required Allow category endpoints that you send to the proxy server will need to be listed in the proxy server to bypass further processing. For example, SSL break and Inspect and Proxy Authentication are incompatible with both the Optimize and Allow category endpoints. The proxy server is point 2 in Figure 1.

5858

59 −The common configuration is to permit without processing all outbound traffic from the proxy server for the destination IP addresses for Office 365 network traffic that hits the proxy server. For information about issues with SSL Break and Inspect, see [Using third-party network devices or solutions on Office 365 traffic](https://support.microsoft.com/help/2690045/using-third-party-network-devices-or-solutions-with-office-365).

59 +The common configuration is to permit without processing all outbound traffic from the proxy server for the destination IP addresses for Microsoft 365 network traffic that hits the proxy server. For information about issues with SSL Break and Inspect, see [Using third-party network devices or solutions on Microsoft 365 traffic](https://support.microsoft.com/help/2690045/using-third-party-network-devices-or-solutions-with-office-365).

6060

6161 There are two types of PAC files that the Get-PacFile script will generate.

6262

6363 | Type | Description |

6464 |:-----|:-----|

6565 |**1** |Send Optimize endpoint traffic direct and everything else to the proxy server. |

66 −|**2** |Send Optimize and Allow endpoint traffic direct and everything else to the proxy server. This type can also be used to send all supported ExpressRoute for Office 365 traffic to ExpressRoute network segments and everything else to the proxy server. |

66 +|**2** |Send Optimize and Allow endpoint traffic direct and everything else to the proxy server. This type can also be used to send all supported ExpressRoute for Microsoft 365 traffic to ExpressRoute network segments and everything else to the proxy server. |

6767

6868 Here's a simple example of calling the PowerShell script:

6969

7676 | Parameter | Description |

7777 |:-----|:-----|

7878 |**ClientRequestId** |This is required and is a GUID passed to the web service that represents the client machine making the call. |

79 −|**Instance** |The Office 365 service instance, which defaults to Worldwide. This is also passed to the web service. |

80 −|**TenantName** |Your Office 365 tenant name. Passed to the web service and used as a replaceable parameter in some Office 365 URLs. |

79 +|**Instance** |The Microsoft 365 service instance, which defaults to Worldwide. This is also passed to the web service. |

80 +|**TenantName** |Your Microsoft 365 tenant name. Passed to the web service and used as a replaceable parameter in some Microsoft 365 URLs. |

8181 |**Type** |The type of the proxy PAC file that you want to generate. |

8282

8383 Here's another example of calling the PowerShell script with additional parameters:

8686 Get-PacFile -Type 2 -Instance Worldwide -TenantName Contoso -ClientRequestId b10c5ed1-bad1-445f-b386-b919946339a7

8787 ```

8888

89 −## Proxy server bypass processing of Office 365 network traffic

89 +## Proxy server bypass processing of Microsoft 365 network traffic

9090

91 −Where PAC files aren't used for direct outbound traffic, you still want to bypass processing on your network perimeter by configuring your proxy server. Some proxy server vendors have enabled automated configuration of this as described in the [Office 365 Networking Partner Program](microsoft-365-networking-partner-program.md).

91 +Where PAC files aren't used for direct outbound traffic, you still want to bypass processing on your network perimeter by configuring your proxy server. Some proxy server vendors have enabled automated configuration of this as described in the [Microsoft 365 Networking Partner Program](microsoft-365-networking-partner-program.md).

9292

93 −If you're doing this manually, you'll need to get the Optimize and Allow endpoint category data from the Office 365 IP Address and URL Web Service and configure your proxy server to bypass processing for these. It is important to avoid SSL Break and Inspect and Proxy Authentication for the Optimize and Allow category endpoints.

93 +If you're doing this manually, you'll need to get the Optimize and Allow endpoint category data from the Microsoft 365 IP Address and URL Web Service and configure your proxy server to bypass processing for these. It is important to avoid SSL Break and Inspect and Proxy Authentication for the Optimize and Allow category endpoints.

9494

9595 <a name="bkmk_changes"> </a>

96 −## Change management for Office 365 IP addresses and URLs

96 +## Change management for Microsoft 365 IP addresses and URLs

9797

98 −In addition to selecting appropriate configuration for your network perimeter, it's critical that you adopt a change management process for Office 365 endpoints. These endpoints change regularly and if you don't manage the changes, you can end up with users blocked or with poor performance after a new IP address or URL is added.

98 +In addition to selecting appropriate configuration for your network perimeter, it's critical that you adopt a change management process for Microsoft 365 endpoints. These endpoints change regularly and if you don't manage the changes, you can end up with users blocked or with poor performance after a new IP address or URL is added.

9999

100 −Changes to the Office 365 IP addresses and URLs are usually published near the last day of each month. Sometimes a change will be published outside of that schedule due to operational, support, or security requirements.

100 +Changes to the Microsoft 365 IP addresses and URLs are usually published near the last day of each month. Sometimes a change will be published outside of that schedule due to operational, support, or security requirements.

101101

102 −When a change is published that requires you to act because an IP address or URL was added, you should expect to receive 30 days notice from the time we publish the change until there's an Office 365 service on that endpoint. This is reflected as the Effective Date. Although we aim for this notification period, it may not always be possible due to operational, support, or security requirements. Changes that don't require immediate action to maintain connectivity, such as removed IP addresses or URLs or less significant changes, don't include advance notification. In these instances, no Effective Date will be provided. Regardless of what notification is provided, we list the expected service active date for each change.

102 +When a change is published that requires you to act because an IP address or URL was added, you should expect to receive 30 days notice from the time we publish the change until there's an Microsoft 365 service on that endpoint. This is reflected as the Effective Date. Although we aim for this notification period, it may not always be possible due to operational, support, or security requirements. Changes that don't require immediate action to maintain connectivity, such as removed IP addresses or URLs or less significant changes, don't include advance notification. In these instances, no Effective Date will be provided. Regardless of what notification is provided, we list the expected service active date for each change.

103103

104104 ### Change notification using the Web Service

105105

106 −You can use the Office 365 IP Address and URL Web Service to get change notification. We recommend you call the **/version** web method once an hour to check the version of the endpoints that you're using to connect to Office 365. If this version changes when compared to the version that you have in use, then you should get the latest endpoint data from the **/endpoints** web method and optionally get the differences from the **/changes** web method. It isn't necessary to call the **/endpoints** or **/changes** web methods if there hasn't been any change to the version you found.

106 +You can use the Microsoft 365 IP Address and URL Web Service to get change notification. We recommend you call the **/version** web method once an hour to check the version of the endpoints that you're using to connect to Microsoft 365. If this version changes when compared to the version that you have in use, then you should get the latest endpoint data from the **/endpoints** web method and optionally get the differences from the **/changes** web method. It isn't necessary to call the **/endpoints** or **/changes** web methods if there hasn't been any change to the version you found.

107107

108 −For more information, see [Office 365 IP Address and URL Web Service](microsoft-365-ip-web-service.md).

108 +For more information, see [Microsoft 365 IP Address and URL Web Service](microsoft-365-ip-web-service.md).

109109

110110 ### Change notification using RSS feeds

111111

112 −The Office 365 IP Address and URL Web Service provides an RSS feed that you can subscribe to in Outlook. There are links to the RSS URLs on each of the Office 365 service instance-specific pages for the IP addresses and URLs. For more information, see [Office 365 IP Address and URL Web Service](microsoft-365-ip-web-service.md).

112 +The Microsoft 365 IP Address and URL Web Service provides an RSS feed that you can subscribe to in Outlook. There are links to the RSS URLs on each of the Microsoft 365 service instance-specific pages for the IP addresses and URLs. For more information, see [Microsoft 365 IP Address and URL Web Service](microsoft-365-ip-web-service.md).

113113

114114 ### Change notification and approval review using Power Automate

115115

116 −We understand that you might still require manual processing for network endpoint changes that come through each month. You can use Power Automate to create a flow that notifies you by email and optionally runs an approval process for changes when Office 365 network endpoints have changes. Once review is completed, you can have the flow automatically email the changes to your firewall and proxy server management team.

116 +We understand that you might still require manual processing for network endpoint changes that come through each month. You can use Power Automate to create a flow that notifies you by email and optionally runs an approval process for changes when Microsoft 365 network endpoints have changes. Once review is completed, you can have the flow automatically email the changes to your firewall and proxy server management team.

117117

118 −For information about a Power Automate sample and template, see [Use Power Automate to receive an email for changes to Office 365 IP addresses and URLs](https://techcommunity.microsoft.com/t5/Office-365-Networking/Use-Microsoft-Flow-to-receive-an-email-for-changes-to-Office-365/td-p/240651).

118 +For information about a Power Automate sample and template, see [Use Power Automate to receive an email for changes to Microsoft 365 IP addresses and URLs](https://techcommunity.microsoft.com/t5/Office-365-Networking/Use-Microsoft-Flow-to-receive-an-email-for-changes-to-Office-365/td-p/240651).

119119

120120 <a name="FAQ"> </a>

121 −## Office 365 network endpoints FAQ

121 +## Microsoft 365 network endpoints FAQ

122122

123 −See these frequently asked questions about Office 365 network connectivity.

123 +See these frequently asked questions about Microsoft 365 network connectivity.

124124

125125 ### How do I submit a question?

126126

139139 <a name="bkmk_MissingIP"> </a>

140140 ### I see network requests to IP addresses not on the published list, do I need to provide access to them?

141141

142 −We only provide IP addresses for the Office 365 servers you should route directly to. This isn't a comprehensive list of all IP addresses you'll see network requests for. You'll see network requests to Microsoft and third-party owned, unpublished, IP addresses. These IP addresses are dynamically generated or managed in a way that prevents timely notice when they change. If your firewall can't allow access based on the FQDNs for these network requests, use a PAC or WPAD file to manage the requests.

142 +We only provide IP addresses for the Microsoft 365 servers you should route directly to. This isn't a comprehensive list of all IP addresses you'll see network requests for. You'll see network requests to Microsoft and third-party owned, unpublished, IP addresses. These IP addresses are dynamically generated or managed in a way that prevents timely notice when they change. If your firewall can't allow access based on the FQDNs for these network requests, use a PAC or WPAD file to manage the requests.

143143

144 −See an IP associated with Office 365 that you want more information on?

144 +See an IP associated with Microsoft 365 that you want more information on?

145145

146146 1. Check if the IP address is included in a larger published range using a CIDR calculator, such as these for [IPv4](https://www.ipaddressguide.com/cidr) or [IPv6](https://www.ipaddressguide.com/ipv6-cidr). For example, 40.96.0.0/13 includes the IP Address 40.103.0.1 despite 40.96 not matching 40.103.

147147 2. See if a partner owns the IP with a [whois query](https://dnsquery.org/). If it's Microsoft owned, it may be an internal partner. Many partner network endpoints are listed as belonging to the _default_ category, for which IP addresses aren't published.

148 −3. The IP address may not be part of Office 365 or a dependency. Office 365 network endpoint publishing doesn't include all of Microsoft network endpoints.

149 −4. Check the certificate. With a browser, connect to the IP address using *HTTPS://\<IP_ADDRESS\>* and check the domains listed on the certificate to understand what domains are associated with the IP address. If it's a Microsoft-owned IP address and not on the list of Office 365 IP addresses, it's likely the IP address is associated with a Microsoft CDN such as *MSOCDN.NET* or another Microsoft domain without published IP information. If you do find the domain on the certificate is one where we claim to list the IP address, please let us know.

148 +3. The IP address may not be part of Microsoft 365 or a dependency. Microsoft 365 network endpoint publishing doesn't include all of Microsoft network endpoints.

149 +4. Check the certificate. With a browser, connect to the IP address using *HTTPS://\<IP_ADDRESS\>* and check the domains listed on the certificate to understand what domains are associated with the IP address. If it's a Microsoft-owned IP address and not on the list of Microsoft 365 IP addresses, it's likely the IP address is associated with a Microsoft CDN such as *MSOCDN.NET* or another Microsoft domain without published IP information. If you do find the domain on the certificate is one where we claim to list the IP address, please let us know.

150150

151151 <a name="bkmk_cname"> </a>

152 −### Some Office 365 URLs point to CNAME records instead of A records in the DNS. What do I have to do with the CNAME records?

152 +### Some Microsoft 365 URLs point to CNAME records instead of A records in the DNS. What do I have to do with the CNAME records?

153153

154 −Client computers need a DNS A or AAAA record that includes one or more IP address(es) to connect to a cloud service. Some URLs included in Office 365 show CNAME records instead of A or AAAA records. These CNAME records are intermediary and there may be several in a chain. They will always eventually resolve to an A or AAAA record for an IP Address. For example, consider the following series of DNS records, which ultimately resolves to the IP address _IP_1_:

154 +Client computers need a DNS A or AAAA record that includes one or more IP address(es) to connect to a cloud service. Some URLs included in Microsoft 365 show CNAME records instead of A or AAAA records. These CNAME records are intermediary and there may be several in a chain. They will always eventually resolve to an A or AAAA record for an IP Address. For example, consider the following series of DNS records, which ultimately resolves to the IP address _IP_1_:

155155

156156 ```console

157157 serviceA.office.com -> CNAME: serviceA.domainA.com -> CNAME: serviceA.domainB.com -> A: IP_1

159159

160160 These CNAME redirects are a normal part of the DNS and are transparent to the client computer and transparent to proxy servers. They are used for load balancing, content delivery networks, high availability, and service incident mitigation. Microsoft doesn't publish the intermediary CNAME records, they are subject to change at any time, and you shouldn't need to configure them as allowed in your proxy server.

161161

162 −A proxy server validates the initial URL, which in the above example is serviceA.office.com, and this URL would be included in Office 365 publishing. The proxy server requests DNS resolution of that URL to an IP Address and will receive back IP_1. It doesn't validate the intermediary CNAME redirection records.

162 +A proxy server validates the initial URL, which in the above example is serviceA.office.com, and this URL would be included in Microsoft 365 publishing. The proxy server requests DNS resolution of that URL to an IP Address and will receive back IP_1. It doesn't validate the intermediary CNAME redirection records.

163163

164 −Hard-coded configurations or using an allowlist based on indirect Office 365 FQDNs aren't recommended, not supported by Microsoft, and are known to cause customer connectivity issues. DNS solutions that block on CNAME redirection, or that otherwise incorrectly resolve Office 365 DNS entries, can be solved via DNS forwarders with DNS recursion enabled or by using DNS root hints. Many third-party network perimeter products natively integrate recommended Office 365 endpoint to include an allowlist in their configuration using the [Office 365 IP Address and URL Web service](microsoft-365-ip-web-service.md).

164 +Hard-coded configurations or using an allowlist based on indirect Microsoft 365 FQDNs aren't recommended, not supported by Microsoft, and are known to cause customer connectivity issues. DNS solutions that block on CNAME redirection, or that otherwise incorrectly resolve Microsoft 365 DNS entries, can be solved via DNS forwarders with DNS recursion enabled or by using DNS root hints. Many third-party network perimeter products natively integrate recommended Microsoft 365 endpoint to include an allowlist in their configuration using the [Microsoft 365 IP Address and URL Web service](microsoft-365-ip-web-service.md).

165165

166166 <a name="bkmk_akamai"> </a>

167167 ### Why do I see names such as nsatc.net or akadns.net in the Microsoft domain names?

168168

169 −Office 365 and other Microsoft services use several third-party services such as Akamai and MarkMonitor to improve your Office 365 experience. To keep giving you the best experience possible, we may change these services in the future. Third-party domains may host content, such as a CDN, or they may host a service, such as a geographical traffic management service. Some of the services currently in use include:

169 +Microsoft 365 and other Microsoft services use several third-party services such as Akamai and MarkMonitor to improve your Microsoft 365 experience. To keep giving you the best experience possible, we may change these services in the future. Third-party domains may host content, such as a CDN, or they may host a service, such as a geographical traffic management service. Some of the services currently in use include:

170170

171171 [MarkMonitor](https://www.markmonitor.com/) is in use when you see requests that include *\*.nsatc.net*. This service provides domain name protection and monitoring to protect against malicious behavior.

172172

187187 ```

188188

189189 <a name="bkmk_thirdparty"> </a>

190 −### I have to have the minimum connectivity possible for Office 365

190 +### I have to have the minimum connectivity possible for Microsoft 365

191191

192 −As Office 365 is a suite of services built to function over the internet, the reliability and availability promises are based on many standard internet services being available. For example, standard internet services such as DNS, CRL, and CDNs must be reachable to use Office 365 just as they must be reachable to use most modern internet services.

192 +As Microsoft 365 is a suite of services built to function over the internet, the reliability and availability promises are based on many standard internet services being available. For example, standard internet services such as DNS, CRL, and CDNs must be reachable to use Microsoft 365 just as they must be reachable to use most modern internet services.

193193

194 −The Office 365 suite is broken down into major service areas. These can be selectively enabled for connectivity and there's a Common area, which is a dependency for all and is always required.

194 +The Microsoft 365 suite is broken down into major service areas. These can be selectively enabled for connectivity and there's a Common area, which is a dependency for all and is always required.

195195

196196 | Service Area | Description |

197197 |:-----|:-----|

198198 |**Exchange** |Exchange Online and Exchange Online Protection |

199199 |**SharePoint** |SharePoint Online and OneDrive for Business |

200200 |**Skype for Business Online and Microsoft Teams** |Skype for Business and Microsoft Teams |

201 −|**Common** |Office 365 Pro Plus, Office in a browser, Azure AD, and other common network endpoints |

201 +|**Common** |Microsoft 365 Pro Plus, Office in a browser, Azure AD, and other common network endpoints |

202202

203 −In addition to basic internet services, there are third-party services that are only used to integrate functionality. While these are needed for integration, they're marked as optional in the Office 365 endpoints article, which means core functionality of the service will continue to function if the endpoint isn't accessible. Any network endpoint that is required will have the required attribute set to true. Any network endpoint that is optional will have the required attribute set to false and the notes attribute will detail the missing functionality you should expect if connectivity is blocked.

203 +In addition to basic internet services, there are third-party services that are only used to integrate functionality. While these are needed for integration, they're marked as optional in the Microsoft 365 endpoints article, which means core functionality of the service will continue to function if the endpoint isn't accessible. Any network endpoint that is required will have the required attribute set to true. Any network endpoint that is optional will have the required attribute set to false and the notes attribute will detail the missing functionality you should expect if connectivity is blocked.

204204

205 −If you're trying to use Office 365 and are finding third-party services aren't accessible, you'll want to [ensure all FQDNs marked required or optional in this article are allowed through the proxy and firewall](urls-and-ip-address-ranges.md).

205 +If you're trying to use Microsoft 365 and are finding third-party services aren't accessible, you'll want to [ensure all FQDNs marked required or optional in this article are allowed through the proxy and firewall](urls-and-ip-address-ranges.md).

206206

207207 <a name="bkmk_consumer"> </a>

208208 ### How do I block access to Microsoft's consumer services?

211211

212212 <a name="bkmk_IPOnlyFirewall"> </a>

213213

214 −### My firewall requires IP Addresses and cannot process URLs. How do I configure it for Office 365?

214 +### My firewall requires IP Addresses and cannot process URLs. How do I configure it for Microsoft 365?

215215

216 −Office 365 doesn't provide IP addresses of all required network endpoints. Some are provided as URLs only and are categorized as default. URLs in the default category that are required should be allowed through a proxy server. If you don't have a proxy server, look at how you have configured web requests for URLs that users type into the address bar of a web browser; the user doesn't provide an IP address either. The Office 365 default category URLs that do not provide IP addresses should be configured in the same way.

216 +Microsoft 365 doesn't provide IP addresses of all required network endpoints. Some are provided as URLs only and are categorized as default. URLs in the default category that are required should be allowed through a proxy server. If you don't have a proxy server, look at how you have configured web requests for URLs that users type into the address bar of a web browser; the user doesn't provide an IP address either. The Microsoft 365 default category URLs that do not provide IP addresses should be configured in the same way.

217217

218218 ## Related topics

219219

220 −[Office 365 IP Address and URL Web service](microsoft-365-ip-web-service.md)

220 +[Microsoft 365 IP Address and URL Web service](microsoft-365-ip-web-service.md)

221221

222222 [Microsoft Azure Datacenter IP Ranges](https://www.microsoft.com/download/details.aspx?id=41653)

223223

225225

226226 [Network infrastructure requirements for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints)

227227

228 −[ExpressRoute and Power BI](https://powerbi.microsoft.com/documentation/powerbi-admin-power-bi-expressroute/)

229 −

230 −[Office 365 URLs and IP address ranges](urls-and-ip-address-ranges.md)

231 −

232 −[Managing ExpressRoute for Office 365 connectivity](managing-expressroute-for-connectivity.md)

228 +[Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md)

233229

234 −[Office 365 Network Connectivity Principles](microsoft-365-network-connectivity-principles.md)

230 +[Microsoft 365 Network Connectivity Principles](microsoft-365-network-connectivity-principles.md)

Managing Microsoft 365 endpoints

Microsoft's edit · 5 Dec 2022 19:40 UTC