{
  "format": "changeintel.gsa-web-filtering-v2",
  "graphShapeDocumented": false,
  "note": "Neutral review format. Create the rule in the Microsoft Entra admin center: Global Secure Access \u003E Secure \u003E Web Filtering Policies (V2).",
  "rules": [
    {
      "name": "ChangeIntel Android Enterprise",
      "action": "Allow",
      "destinations": [
        {
          "type": "url",
          "value": "play.google.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "android.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "google-analytics.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "googleusercontent.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.gstatic.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of gstatic.com but not gstatic.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.gvt1.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of gvt1.com but not gvt1.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.ggpht.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of ggpht.com but not ggpht.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "dl.google.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "dl-ssl.google.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "android.apis.google.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.gvt2.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of gvt2.com but not gvt2.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.gvt3.com",
          "purpose": "Published ports: TCP/443 TCP, UDP/5228-5230. Google Play and updates gstatic.com, googleusercontent.com - contains User-Generated Content (for example,. app icons in the store) *gvt1.com, *.ggpht.com, dl.google.com, dl-ssl.google.com, andr\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of gvt3.com but not gvt3.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "*.googleapis.com",
          "purpose": "EMM/Google APIs/PlayStore APIs/Android Management APIs",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "A *. wildcard matches subdomains of googleapis.com but not googleapis.com itself; list the apex separately only if a source publishes it.",
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "m.google.com",
          "purpose": "EMM/Google APIs/PlayStore APIs/Android Management APIs",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "accounts.google.com",
          "purpose": "Authentication For accounts.google.[country], use your local top-level domain for [country]. For example, for Australia use accounts.google.com.au, and for United Kingdom use accounts.google.co.uk.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gcm-http.googleapis.com",
          "purpose": "Published ports: TCP/443,5228-5230. Google Cloud Messaging (e.g. EMM Console \u003C-\u003E DPC communication, like pushing configs)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "gcm-xmpp.googleapis.com",
          "purpose": "Published ports: TCP/443,5228-5230. Google Cloud Messaging (e.g. EMM Console \u003C-\u003E DPC communication, like pushing configs); When using persistent bidirectional XMPP connection to FCM and GCM servers",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 5235, 5236 traffic needs a firewall rule instead."
          ]
        },
        {
          "type": "url",
          "value": "android.googleapis.com",
          "purpose": "Published ports: TCP/443,5228-5230. Google Cloud Messaging (e.g. EMM Console \u003C-\u003E DPC communication, like pushing configs)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "fcm.googleapis.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Firebase Cloud Messaging (for example, Find Hub, EMM Console \u003C-\u003E DPC communication, like pushing configs). For the most up to date info on FCM, click here.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "fcm-xmpp.googleapis.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Firebase Cloud Messaging (for example, Find Hub, EMM Console \u003C-\u003E DPC communication, like pushing configs). For the most up to date info on FCM, click here.; When using persistent bidirectional XMPP connection to FCM and GCM servers",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 5235, 5236 traffic needs a firewall rule instead."
          ]
        },
        {
          "type": "url",
          "value": "firebaseinstallations.googleapis.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Firebase Cloud Messaging (for example, Find Hub, EMM Console \u003C-\u003E DPC communication, like pushing configs). For the most up to date info on FCM, click here.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "firebaselogging.googleapis.com",
          "purpose": "AMAPI SDK logging and metrics support",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "pki.google.com",
          "purpose": "Certificate Revocation list checks for Google-issued certificates",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Looks like a certificate validation host and isn\u0027t in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile."
          ]
        },
        {
          "type": "url",
          "value": "clients1.google.com",
          "purpose": "Certificate Revocation list checks for Google-issued certificates",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "clients2.google.com",
          "purpose": "Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "clients3.google.com",
          "purpose": "Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "clients4.google.com",
          "purpose": "Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "clients5.google.com",
          "purpose": "Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "clients6.google.com",
          "purpose": "Domains shared by various Google backend services such as crash reporting, Chrome Bookmark Sync, time sync (tlsdate), and many others.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "chromiumdash.appspot.com",
          "purpose": "Chrome updates",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "connectivitycheck.android.com",
          "purpose": "Used by Android OS for connectivity check whenever the device connects to any WiFi / Mobile network. Android connectivity check, starting with N MR1, requires https://www.google.com/generate_204 to be reachable, or for the given Wi-Fi netw\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "connectivitycheck.gstatic.com",
          "purpose": "Used by Android OS for connectivity check whenever the device connects to any WiFi / Mobile network. Android connectivity check, starting with N MR1, requires https://www.google.com/generate_204 to be reachable, or for the given Wi-Fi netw\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "www.google.com",
          "purpose": "Used by Android OS for connectivity check whenever the device connects to any WiFi / Mobile network. Android connectivity check, starting with N MR1, requires https://www.google.com/generate_204 to be reachable, or for the given Wi-Fi netw\u2026",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ota.googlezip.net",
          "purpose": "Used by OEMs that utilize Google Over-The-Air (GOTA) updates to distribute OTA updates. Please validate with your OEM if these are required.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ota-cache1.googlezip.net",
          "purpose": "Used by OEMs that utilize Google Over-The-Air (GOTA) updates to distribute OTA updates. Please validate with your OEM if these are required.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ota-cache3.googlezip.net",
          "purpose": "Used by OEMs that utilize Google Over-The-Air (GOTA) updates to distribute OTA updates. Please validate with your OEM if these are required.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "mtalk4.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "mtalk-staging.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "mtalk-dev.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt1-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt2-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt3-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt4-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt5-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt6-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt7-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "alt8-mtalk.google.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "device-provisioning.googleapis.com",
          "purpose": "Published ports: TCP/443,5228\u20135230. Allows mobile devices to connect to FCM when an organization firewall is present on the network. (see details here)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "time.google.com",
          "purpose": "During provisioning, Android devices require access to an NTP server, which is typically accessed via port UDP/123. This can be changed by an OEM.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did.",
            "Web filtering assumes ports 80 and 443; port 123 traffic needs a firewall rule instead.",
            "UDP isn\u0027t supported by Internet Access; only the TCP part is filtered."
          ]
        },
        {
          "type": "url",
          "value": "android-safebrowsing.google.com",
          "purpose": "Safebrowsing endpoints are used for Google Play Protect.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "safebrowsing.google.com",
          "purpose": "Safebrowsing endpoints are used for Google Play Protect.",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "www.googleapis.com",
          "purpose": "Play EMM API (if applicable - ask your EMM) Android Management API (if applicable - ask your EMM)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "androidmanagement.googleapis.com",
          "purpose": "Play EMM API (if applicable - ask your EMM) Android Management API (if applicable - ask your EMM)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "fonts.googleapis.com",
          "purpose": "iFrame JS Google fonts User Generated Content (e.g. app icons in the store)",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "accounts.youtube.com",
          "purpose": "Account Authentication Country-specific account auth domains",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "apis.google.com",
          "purpose": "GCM, other Google web services, and iFrame JS",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ajax.googleapis.com",
          "purpose": "GCM, other Google web services, and iFrame JS",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "payments.google.com",
          "purpose": "App approval",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "google.com",
          "purpose": "App approval",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "ogs.google.com",
          "purpose": "iFrame UI elements",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "notifications.google.com",
          "purpose": "Desktop/Mobile Notifications",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "V2 matching broadens: this FQDN becomes a URL destination that matches the address and its sub-paths, not only the exact host as a V1 FQDN rule did."
          ]
        },
        {
          "type": "url",
          "value": "enterprise.google.com/android/*",
          "purpose": "Zero Touch console",
          "required": true,
          "sources": [
            "https://support.google.com/work/android/answer/10513641?hl=en"
          ],
          "caveats": [
            "Wildcards in URL paths aren\u0027t documented for web filtering; a URL destination already matches its sub-paths, so drop the trailing * if the portal rejects it."
          ]
        }
      ]
    }
  ],
  "notes": [
    "In V2 a security profile contains exactly one web filtering policy. Each rule carries its own Allow or Block action and the policy has a default action (Allow, Block, or the preview Continue Evaluation).",
    "V2 has no standalone FQDN type: FQDNs are expressed as URL destinations, and a URL destination matches the address and its sub-paths.",
    "A former exact-host FQDN evaluated with URL logic can match sub-paths of the address rather than only the exact host; review destinations to confirm they match the intended traffic.",
    "V2 runs before V1. A V2 Block is terminal; a V2 Allow isn\u0027t, so a V1 policy can still block the same traffic.",
    "Without TLS inspection, HTTPS traffic is evaluated by Server Name Indication (SNI); only unencrypted HTTP exposes the full URL."
  ]
}