Apple devices

What managed iPhone, iPad and Mac devices need from Apple's enterprise network list: device setup and activation, device management and push, software updates, apps, certificate validation and Apple Account sign-in.

Managed device · checked against its pages today 02:28 UTC · iOS and iPadOS · macOS

Where these entries come from

73 from 1 publisher page

Use Apple products on enterprise networks 7 sections · 73 entries · read today 02:28 UTC

Changes in the last 90 days

None of these pages added or removed a destination in the sections this bundle reads.

ChangeIntel reads each page once a day: the destinations in its tables, lists and code blocks, under the sections named above. Entries follow the page; nothing is added that it does not publish.

Downloads

Built from the pages and endpoint sets above, as last read

Format	Destinations	Download
Plain list, one per line	73	Open
GSA V1 domain list	73	Open
GSA V1 Graph request body	73	Download
GSA V2 rules (review JSON)	73	Download
GSA V2 rules (CSV)	73	Download

About these formats and checking them on a device

"Left out" counts entries a format cannot hold: IP ranges in web filtering, mid-name wildcards, URLs in a V1 domain list, and unfilled values. The V2 JSON is a review format; Microsoft publishes no Graph request shape for V2 rules yet. See how V1 and V2 evaluate.

The same entries are JSON at /api/v1/access-bundles/apple-devices. To check them from the workstation itself, run Test-ChangeIntelAccessBundle -Bundle apple-devices from the ChangeIntel PowerShell module there: it resolves DNS and tries TCP and TLS to each published host, and reports certificate issuers that suggest TLS inspection.

The profile each destination goes to is inferred from Microsoft's published material, not confirmed. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.

Expected to reach web filtering

65expected to go through the Internet Access profile, where a block-by-default web filtering policy would have to allow the ones your scenario needs

Expected to reach web filtering
Destination	Why it's needed	Source
`account.apple.com`TCP 443	Apple Account authentication in Settings and System Preferences	Use Apple products on enterprise networks · Apple Account Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`albert.apple.com`TCP 443	Device activation	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`api.apple-cloudkit.com`TCP 443	App notarization	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.appattest.apple.com`TCP 443	Managed device attestation; App validation, Touch ID and Face ID authentication for websites	Use Apple products on enterprise networks · Device management Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`appldnld.apple.com`TCP 80	iOS, iPadOS, and watchOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`appleid.cdn-apple.com`TCP 443	Apple Account authentication in Settings and System Preferences	Use Apple products on enterprise networks · Apple Account Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.apps-marketplace.apple.com`TCP 443	Installing apps from websites and alternative marketplaces	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.apps.apple.com`TCP 443	Store content such as apps, books, and music	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`audiocontentdownload.apple.com`TCP 80, 443	GarageBand downloadable content	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`axm-adm-enroll.apple.com`TCP 443	DEP enrollment server	Use Apple products on enterprise networks · Apple Business device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`axm-adm-mdm.apple.com`TCP 443	Device management service	Use Apple products on enterprise networks · Apple Business device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`axm-adm-scep.apple.com`TCP 443	SCEP server	Use Apple products on enterprise networks · Apple Business device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`axm-app.apple.com`TCP 443	View and manage apps and devices	Use Apple products on enterprise networks · Apple Business device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`axm-servicediscovery.apple.com`TCP 443	Service discovery for account-driven enrollments	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`captive.apple.com`TCP 80, 443	Internet connectivity validation for networks that use captive portals	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`certs.apple.com`TCP 80, 443	Certificate validation	Use Apple products on enterprise networks · Certificate validation Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`configuration.apple.com`TCP 443	Rosetta 2 updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`deviceenrollment.apple.com`TCP 443	DEP provisional enrollment	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`deviceservices-external.apple.com`TCP 443	Used by an device management service to disable Activation Lock on managed devices	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`devimages-cdn.apple.com`TCP 80, 443	Xcode downloadable components	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`download.developer.apple.com`TCP 80, 443	Xcode downloadable components	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`fcs-keys-pub-prod.cdn-apple.com`TCP 443	Installing iOS, iPadOS, or macOS on an attached device	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gateway.icloud.com`TCP/UDP 443	CloudKit content including XProtect updates and Voice Control assets	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gdmf-ados.apple.com`TCP 443	Software update catalog for additional components	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gdmf.apple.com`TCP 443	Used by an device management service to identify which software updates are available to devices that use managed software updates; Software update catalog	Use Apple products on enterprise networks · Device management Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gg.apple.com`TCP 80, 443	iOS, iPadOS, tvOS, watchOS, and macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gs.apple.com`TCP 443TCP 80, 443	iOS, iPadOS, tvOS, macOS, and visionOS; iOS, iPadOS, tvOS, watchOS, and macOS updates	Use Apple products on enterprise networks · Device setup Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gsa.apple.com`TCP 443	Apple Account authentication	Use Apple products on enterprise networks · Apple Account Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`gsra.apple.com`TCP 443	OS updates for additional components	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`humb.apple.com`TCP 443	iOS, iPadOS, tvOS, macOS, and visionOS	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`icons.axm-usercontent-apple.com`TCP 443	Custom Package icons	Use Apple products on enterprise networks · Apple Business device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`identity.apple.com`TCP 443	APNs certificate request portal	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`idmsa.apple.com`TCP 443	Apple Account authentication	Use Apple products on enterprise networks · Apple Account Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ig.apple.com`TCP 443	macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`iprofiles.apple.com`TCP 443	Hosts enrollment profiles used when devices enroll in Apple School Manager or Apple Business through Device Enrollment	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.itunes.apple.com`TCP 80, 443	Store content such as apps, books, and music	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`itunes.apple.com`TCP 80, 443	iOS, iPadOS, tvOS, macOS, and visionOS	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mdmenrollment.apple.com`TCP 443	Device management services to upload enrollment profiles used by clients enrolling through Device Enrollment in Apple School Manager or Apple Business, and to look up devices and accounts	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`mesu.apple.com`TCP 80, 443	Hosts software update catalogs	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.mzstatic.com`TCP 443	Store content such as apps, books, and music, and apps from websites and alternative marketplaces	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`oscdn.apple.com`TCP 80, 443	macOS Recovery	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`osrecovery.apple.com`TCP 80, 443	macOS Recovery	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`playground-assets-cdn.apple.com`TCP 443	Swift Playground	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`playground-cdn.apple.com`TCP 443	Swift Playground	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ppq.apple.com`TCP 443	Enterprise App validation	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.push.apple.com`TCP 80, 443, 2197, 5223	Push notifications	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`setup.icloud.com`TCP 443	Required to log in to a Managed Apple Account on Shared iPad	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`skl.apple.com`TCP 443	macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`sq-device.apple.com`TCP 443	eSIM activation	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`static.ips.apple.com`TCP 80, 443	iOS, iPadOS, tvOS, macOS, and visionOS	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`swcdn.apple.com`TCP 80, 443	macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`swdist.apple.com`TCP 443	macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`swdownload.apple.com`TCP 80, 443	macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`swscan.apple.com`TCP 443	macOS updates	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`sylvan.apple.com`TCP 80, 443	Aerial screen savers and wallpaper	Use Apple products on enterprise networks · Apps and additional content Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`tbsc.apple.com`TCP 443	iOS, iPadOS, tvOS, macOS, and visionOS	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`time-ios.apple.com`UDP 123	Used by devices to set their date and time	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`time-macos.apple.com`UDP 123	Used by devices to set their date and time	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`time.apple.com`UDP 123	Used by devices to set their date and time	Use Apple products on enterprise networks · Device setup Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`updates-http.cdn-apple.com`TCP 80	Software update downloads	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`updates.cdn-apple.com`TCP 443	Software update downloads	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`valid.apple.com`TCP 443	Certificate validation	Use Apple products on enterprise networks · Certificate validation Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`vpp.itunes.apple.com`TCP 443	Device management services to perform operations related to Apps and Books, like assigning or revoking licenses on a device	Use Apple products on enterprise networks · Device management Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`wkms-public.apple.com`TCP 443	Installing iOS, iPadOS, or macOS on an attached device	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`xp.apple.com`TCP 443	iOS, iPadOS, tvOS, macOS, and visionOS	Use Apple products on enterprise networks · Software updates Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.

Not determined

8public material doesn't settle it; check the client's forwarding profile

Not determined
Destination	Why it's needed	Source
`*.apple-mapkit.com`TCP 443	View the location of devices in Managed Lost Mode	Use Apple products on enterprise networks · Apple Business device management Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.
`crl.apple.com`TCP 80	Certificate validation	Use Apple products on enterprise networks · Certificate validation Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.
`crl3.digicert.com`TCP 80	Certificate validation	Use Apple products on enterprise networks · Certificate validation Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`crl4.digicert.com`TCP 80	Certificate validation	Use Apple products on enterprise networks · Certificate validation Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`ocsp.apple.com`TCP 80	Certificate validation	Use Apple products on enterprise networks · Certificate validation Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.
`ocsp.digicert.cn`TCP 80	Certificate validation in China	Use Apple products on enterprise networks · Certificate validation Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.
`ocsp.digicert.com`TCP 80	Certificate validation	Use Apple products on enterprise networks · Certificate validation Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`ocsp2.apple.com`TCP 443	Certificate validation	Use Apple products on enterprise networks · Certificate validation Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.