Android Enterprise

The hosts Google lists for Android Enterprise devices: Google Play and updates, device policy, push and the management services.

Managed device · checked against its pages today 02:28 UTC · Android

Where these entries come from

63 from 1 publisher page

Android Enterprise Network Requirements the whole page · 63 entries · read today 02:28 UTC

Changes in the last 90 days

android.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
google-analytics.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
googleusercontent.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
*.gvt1.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
*.ggpht.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
dl.google.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
dl-ssl.google.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
*.gvt2.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
*.gvt3.comadded to Firewall rules · TCP 443 · required · 12 Oct 23:22 UTC
play.google.comadded to Firewall rules · required · 12 Oct 23:22 UTC
android.comadded to Firewall rules · required · 12 Oct 23:22 UTC
google-analytics.comadded to Firewall rules · required · 12 Oct 23:22 UTC
googleusercontent.comadded to Firewall rules · required · 12 Oct 23:22 UTC
*.gstatic.comadded to Firewall rules · required · 12 Oct 23:22 UTC
*.gvt1.comadded to Firewall rules · required · 12 Oct 23:22 UTC
*.ggpht.comadded to Firewall rules · required · 12 Oct 23:22 UTC
dl.google.comadded to Firewall rules · required · 12 Oct 23:22 UTC
dl-ssl.google.comadded to Firewall rules · required · 12 Oct 23:22 UTC
android.apis.google.comadded to Firewall rules · required · 12 Oct 23:22 UTC
*.gvt2.comadded to Firewall rules · required · 12 Oct 23:22 UTC
*.gvt3.comadded to Firewall rules · required · 12 Oct 23:22 UTC
play.google.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
android.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
google-analytics.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
googleusercontent.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
*.gstatic.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
*.gvt1.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
*.ggpht.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
dl.google.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
dl-ssl.google.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
android.apis.google.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
*.gvt2.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC
*.gvt3.comremoved from Firewall rules · TCP/UDP 443 · required · 12 Oct 23:22 UTC

ChangeIntel reads each page once a day: the destinations in its tables, lists and code blocks, under the sections named above. Entries follow the page; nothing is added that it does not publish.

Downloads

Built from the pages and endpoint sets above, as last read

Format	Destinations	Left out	Download
Plain list, one per line	63	0	Open
GSA V1 domain list	62	1	Open
GSA V1 Graph request body	63	0	Download
GSA V2 rules (review JSON)	63	0	Download
GSA V2 rules (CSV)	63	0	Download

About these formats and checking them on a device

"Left out" counts entries a format cannot hold: IP ranges in web filtering, mid-name wildcards, URLs in a V1 domain list, and unfilled values. The V2 JSON is a review format; Microsoft publishes no Graph request shape for V2 rules yet. See how V1 and V2 evaluate.

The same entries are JSON at /api/v1/access-bundles/android-enterprise. To check them from the workstation itself, run Test-ChangeIntelAccessBundle -Bundle android-enterprise from the ChangeIntel PowerShell module there: it resolves DNS and tries TCP and TLS to each published host, and reports certificate issuers that suggest TLS inspection.

The profile each destination goes to is inferred from Microsoft's published material, not confirmed. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.

Expected to reach web filtering

62expected to go through the Internet Access profile, where a block-by-default web filtering policy would have to allow the ones your scenario needs

Expected to reach web filtering
Destination	Why it's needed	Source
`accounts.google.com`TCP 443	Authentication For accounts.google.[country], use your local top-level domain for [country]. For example, for Australia use accounts.google.com.au, and for United Kingdom use accounts.google.co.uk.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`accounts.youtube.com`TCP 443	Account Authentication Country-specific account auth domains	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ajax.googleapis.com`TCP 443	GCM, other Google web services, and iFrame JS	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt1-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt2-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt3-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt4-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt5-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt6-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt7-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`alt8-mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`android-safebrowsing.google.com`TCP 443	Safebrowsing endpoints are used for Google Play Protect.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`android.apis.google.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`android.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`android.googleapis.com`TCP 443	Published ports: TCP/443,5228-5230. Google Cloud Messaging (e.g. EMM Console <-> DPC communication, like pushing configs)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`androidmanagement.googleapis.com`TCP 443	Play EMM API (if applicable - ask your EMM) Android Management API (if applicable - ask your EMM)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`apis.google.com`TCP 443	GCM, other Google web services, and iFrame JS	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`chromiumdash.appspot.com`TCP 443	Chrome updates	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`clients1.google.com`TCP 443	Certificate Revocation list checks for Google-issued certificates	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`clients2.google.com`TCP 443	Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`clients3.google.com`TCP 443	Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`clients4.google.com`TCP 443	Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`clients5.google.com`TCP 443	Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`clients6.google.com`TCP 443	Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`connectivitycheck.android.com`TCP 443	Used by Android OS for connectivity check whenever the device connects to any WiFi / Mobile network. Android connectivity check, starting with N MR1, requires https://www.google.com/generate_204 to be reachable, or for the given Wi-Fi netw…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`connectivitycheck.gstatic.com`TCP 443	Used by Android OS for connectivity check whenever the device connects to any WiFi / Mobile network. Android connectivity check, starting with N MR1, requires https://www.google.com/generate_204 to be reachable, or for the given Wi-Fi netw…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`device-provisioning.googleapis.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`dl-ssl.google.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`dl.google.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`enterprise.google.com/android/*`TCP 443	Zero Touch console	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`fcm-xmpp.googleapis.com`TCP 443TCP 5235, 5236	Published ports: TCP/443,5228–5230. Firebase Cloud Messaging (for example, Find Hub, EMM Console <-> DPC communication, like pushing configs). For the most up to date info on FCM, click here.; When using persistent bidirectional XMPP connection to FCM and GCM servers	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`fcm.googleapis.com`TCP 443	Published ports: TCP/443,5228–5230. Firebase Cloud Messaging (for example, Find Hub, EMM Console <-> DPC communication, like pushing configs). For the most up to date info on FCM, click here.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`firebaseinstallations.googleapis.com`TCP 443	Published ports: TCP/443,5228–5230. Firebase Cloud Messaging (for example, Find Hub, EMM Console <-> DPC communication, like pushing configs). For the most up to date info on FCM, click here.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`firebaselogging.googleapis.com`TCP 443	AMAPI SDK logging and metrics support	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`fonts.googleapis.com`TCP 443	iFrame JS Google fonts User Generated Content (e.g. app icons in the store)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gcm-http.googleapis.com`TCP 443	Published ports: TCP/443,5228-5230. Google Cloud Messaging (e.g. EMM Console <-> DPC communication, like pushing configs)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gcm-xmpp.googleapis.com`TCP 443TCP 5235, 5236	Published ports: TCP/443,5228-5230. Google Cloud Messaging (e.g. EMM Console <-> DPC communication, like pushing configs); When using persistent bidirectional XMPP connection to FCM and GCM servers	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.ggpht.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`google-analytics.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`google.com`TCP 443	App approval	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.googleapis.com`TCP 443	EMM/Google APIs/PlayStore APIs/Android Management APIs	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`googleusercontent.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.gstatic.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.gvt1.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.gvt2.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.gvt3.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`m.google.com`TCP 443	EMM/Google APIs/PlayStore APIs/Android Management APIs	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mtalk-dev.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mtalk-staging.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mtalk.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mtalk4.google.com`TCP 443	Published ports: TCP/443,5228–5230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`notifications.google.com`TCP 443	Desktop/Mobile Notifications	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ogs.google.com`TCP 443	iFrame UI elements	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ota-cache1.googlezip.net`TCP 443	Used by OEMs that utilize Google Over-The-Air (GOTA) updates to distribute OTA updates. Please validate with your OEM if these are required.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ota-cache3.googlezip.net`TCP 443	Used by OEMs that utilize Google Over-The-Air (GOTA) updates to distribute OTA updates. Please validate with your OEM if these are required.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ota.googlezip.net`TCP 443	Used by OEMs that utilize Google Over-The-Air (GOTA) updates to distribute OTA updates. Please validate with your OEM if these are required.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`payments.google.com`TCP 443	App approval	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`play.google.com`TCP 443	Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) gvt1.com, .ggpht.com, dl.google.com, dl-ssl.google.com, andr…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`safebrowsing.google.com`TCP 443	Safebrowsing endpoints are used for Google Play Protect.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`time.google.com`UDP 123	During provisioning, Android devices require access to an NTP server, which is typically accessed via port UDP/123. This can be changed by an OEM.	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`www.google.com`TCP 443	Used by Android OS for connectivity check whenever the device connects to any WiFi / Mobile network. Android connectivity check, starting with N MR1, requires https://www.google.com/generate_204 to be reachable, or for the given Wi-Fi netw…	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`www.googleapis.com`TCP 443	Play EMM API (if applicable - ask your EMM) Android Management API (if applicable - ask your EMM)	Android Enterprise Network Requirements · Firewall rules Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.

Not determined

1public material doesn't settle it; check the client's forwarding profile

Not determined
Destination	Why it's needed	Source
`pki.google.com`TCP 443	Certificate Revocation list checks for Google-issued certificates	Android Enterprise Network Requirements · Firewall rules Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.