Microsoft 365 network connectivity principles

This page's changes and edits · All guidance changes

Microsoft's edit · 26 Feb 20:04 UTC

m365-networking-edits-11220414

Microsoft's commit message in MicrosoftDocs/microsoft-365-docs · commit 19f3960 · +17 ~~−28~~ lines · also on GitHub

⋯ 153 unchanged lines

154154 - Exclusive use of cloud.microsoft root domain for security isolation and specific functions. This enables customer network and security teams to trust Microsoft 365 domains, while improving connectivity to those endpoints and avoiding unnecessary network security processing.

155155 - Certain endpoint definitions specify unique IP prefixes corresponding to their domains. This feature supports customers with intricate network structures, enabling them to apply precise network optimizations by utilizing IP prefix details.

156156

157 −The following network configurations are recommended for all **“Required”** Microsoft 365 network endpoints (domains) and categories:

157 +The following network configurations are recommended for all **Required** Microsoft 365 network endpoints (domains) and categories:

158158

159159 - Explicitly permitting Microsoft 365 network endpoints in the network devices and services that user connections go through (e.g., network perimeter security devices like proxies, firewalls, DNS, cloud-based network security solutions, etc.)

160160 - Bypass Microsoft 365 domains from TLS decryption, traffic interception, deep packet inspection, and network packet and content filtering. Note that many outcomes that customers are using these network technologies for in the context of untrusted/unmanaged applications can be achieved by Microsoft 365 security features natively.

⋯ 2 unchanged lines

163163 - Prioritize Microsoft 365 connections along the network path, ensuring capacity and quality of service for Microsoft 365 experiences.

164164 - Bypass traffic intermediation devices such as proxies and VPN services.

165165

166 −Customers with complex network topologies, implementing network optimizations like custom routing, IP based proxy bypass, and split tunnel VPN may require IP prefix information in addition to domains. To facilitate these customer scenarios Microsoft 365 network endpoints are grouped into categories to prioritize and ease the configuration of these additional network optimizations. Network endpoints classified under the **“Optimize”** and **“Allow”** categories carry high traffic volumes and are sensitive to network latency and performance, and customers may want to optimize connectivity to those first. Network endpoints under the **“Optimize”** and **“Allow”** categories have IP addresses listed along with domains. Network endpoints classified under the **“Default”** category do not have IP addresses associated with them as they are more dynamic in nature and IP addresses change over time.

166 +Customers with complex network topologies, implementing network optimizations like custom routing, IP based proxy bypass, and split tunnel VPN may require IP prefix information in addition to domains. To facilitate these customer scenarios Microsoft 365 network endpoints are grouped into categories to prioritize and ease the configuration of these additional network optimizations. Network endpoints classified under the **Optimize** and **Allow** categories carry high traffic volumes and are sensitive to network latency and performance, and customers may want to optimize connectivity to those first. Network endpoints under the **Optimize** and **Allow** categories have IP addresses listed along with domains. Network endpoints classified under the **Default** category do not have IP addresses associated with them as they are more dynamic in nature and IP addresses change over time.

167167

168168 ### Additional network considerations

169169

170170 When optimizing connectivity to Microsoft 365, certain network configurations may have a negative impact on Microsoft 365 availability, interoperability, performance, and user experience. Microsoft has not tested the following network scenarios with our services, and they are known to cause connectivity issues.

171171

172172 - TLS termination or deep packet inspection of any Microsoft 365 domains with customer proxies or other types of network devices or services.

173 −- Blocking specific protocols or protocol versions such as QUIC, WebSocket’s, etc. by intermediate network infrastructure or service.

173 +- Blocking specific protocols or protocol versions such as QUIC, WebSocket's, etc. by intermediate network infrastructure or service.

174174 - Forcing downgrade or failover of protocols (such as UDP --> TCP, TLS1.3 --> TLS1.2 --> TLS1.1) used between client applications and Microsoft 365 services.

175175 - Routing connections through network infrastructure applying its own authentication such as proxy authentication.

176176

177177 We recommend that customers avoid using these network techniques to traffic destined to Microsoft 365 domains and bypass these for Microsoft 365 connections.

178178

179 −Microsoft recommends setting up an automated system to download and apply the Microsoft 365 network endpoint list regularly. Refer to [Change management for Microsoft 365 IP addresses and URLs](managing-office-365-endpoints.md#change-management-for-microsoft-365-ip-addresses-and-urls) for more information.

179 +Microsoft recommends setting up an automated system to download and apply the Microsoft 365 network endpoint list regularly. Refer to [Change management for Microsoft 365 IP addresses and URLs](managing-office-365-endpoints.md#change-management-for-microsoft-365-ip-addresses-and-urls) for more information.

180180

181181 ## Comparing network perimeter security with endpoint security

182182 <a name="BKMK_SecurityComparison"> </a>

⋯ 55 unchanged lines

238238 |Enable direct connection for VPN users |For VPN users, enable Microsoft 365 connections to connect directly from the user's network rather than over the VPN tunnel by implementing split tunneling. | Minimize latency <br/> Improve reliable connectivity to the closest Microsoft 365 entry point |

239239 |Migrate from traditional WAN to SD-WAN |SD-WANs (Software Defined Wide Area Networks) simplify WAN management and improve performance by replacing traditional WAN routers with virtual appliances, similar to the virtualization of compute resources using virtual machines (VMs). | Improve performance and manageability of WAN traffic <br/> Reduce load on network devices |

240240

241 −## Related articles

242 −

243 −[Microsoft 365 Network Connectivity Overview](microsoft-365-networking-overview.md)

244 −

245 −[Managing Microsoft 365 endpoints](managing-office-365-endpoints.md)

246 −

247 −[Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md)

248 −

249 −[Microsoft 365 IP Address and URL Web service](microsoft-365-ip-web-service.md)

250 −

251 −[Assessing Microsoft 365 network connectivity](assessing-network-connectivity.md)

252 −

253 −[Network planning and performance tuning for Microsoft 365](network-planning-and-performance.md)

254 −

255 −[Microsoft 365 performance tuning using baselines and performance history](performance-tuning-using-baselines-and-history.md)

256 −

257 −[Performance troubleshooting plan for Microsoft 365](performance-troubleshooting-plan.md)

258 −

259 −[Content Delivery Networks](content-delivery-networks.md)

260 −

261 −[Microsoft 365 connectivity test](https://aka.ms/netonboard)

262 −

263 −[How Microsoft builds its fast and reliable global network](https://azure.microsoft.com/blog/how-microsoft-builds-its-fast-and-reliable-global-network/)

241 +## Related content

264242

265 −[Microsoft 365 Networking blog](https://techcommunity.microsoft.com/category/microsoft365/discussions/deploymentnetworking)

243 +- [Microsoft 365 Network Connectivity Overview](microsoft-365-networking-overview.md)

244 +- [Managing Microsoft 365 endpoints](managing-office-365-endpoints.md)

245 +- [Microsoft 365 URLs and IP address ranges](urls-and-ip-address-ranges.md)

246 +- [Microsoft 365 IP Address and URL Web service](microsoft-365-ip-web-service.md)

247 +- [Assessing Microsoft 365 network connectivity](assessing-network-connectivity.md)

248 +- [Network planning and performance tuning for Microsoft 365](network-planning-and-performance.md)

249 +- [Microsoft 365 performance tuning using baselines and performance history](performance-tuning-using-baselines-and-history.md)

250 +- [Performance troubleshooting plan for Microsoft 365](performance-troubleshooting-plan.md)

251 +- [Content Delivery Networks](content-delivery-networks.md)

252 +- [Microsoft 365 connectivity test](https://aka.ms/netonboard)

253 +- [How Microsoft builds its fast and reliable global network](https://azure.microsoft.com/blog/how-microsoft-builds-its-fast-and-reliable-global-network/)

254 +- [Microsoft 365 Networking blog](https://techcommunity.microsoft.com/category/microsoft365/discussions/deploymentnetworking)

Microsoft's Markdown source from MicrosoftDocs/microsoft-365-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 05:34 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.