Configuration Manager internet access

Internet endpoints a Configuration Manager site needs for updates and servicing, software updates, Microsoft 365 Apps and tenant attach.

Server or agent · checked against its pages today 02:28 UTC · Configuration Manager

Where these entries come from

51 from 1 publisher page

Internet access requirements 6 sections · 51 entries · read today 02:28 UTC

Changes in the last 90 days

http://windowsupdate.microsoft.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
http://*.windowsupdate.microsoft.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
https://*.windowsupdate.microsoft.comadded to Software updates · TCP 443 · required · 12 Oct 23:22 UTC
http://*.update.microsoft.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
https://*.update.microsoft.comadded to Software updates · TCP 443 · required · 12 Oct 23:22 UTC
http://*.windowsupdate.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
http://download.windowsupdate.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
http://download.microsoft.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
http://*.download.windowsupdate.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
http://ntservicepack.microsoft.comadded to Software updates · TCP 80 · required · 12 Oct 23:22 UTC
https://clients.config.office.netadded to Manage Microsoft 365 Apps · TCP 443 · required · 12 Oct 23:22 UTC
https://omex.cdn.office.net/mirrored/sccmreadiness/SOT_SCCM_AddinReadiness.CABadded to Manage Microsoft 365 Apps · TCP 443 · required · 12 Oct 23:22 UTC
https://contentstorage.osi.office.net/sccmreadinessppe/sot_sccm_addinreadiness.cabadded to Manage Microsoft 365 Apps · TCP 443 · required · 12 Oct 23:22 UTC
https://aka.ms/configmgrgatewayadded to Tenant attach · TCP 443 · required · 12 Oct 23:22 UTC
https://*.manage.microsoft.comadded to Tenant attach · TCP 443 · required · 12 Oct 23:22 UTC
https://*.manage.microsoft.usadded to Tenant attach · TCP 443 · required · 12 Oct 23:22 UTC
https://dc.services.visualstudio.comadded to Tenant attach · TCP 443 · required · 12 Oct 23:22 UTC
http://crl3.digicert.comadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://crl4.digicert.comadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://ocsp.digicert.comadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://www.d-trust.netadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://root-c3-ca2-2009.ocsp.d-trust.netadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://crl.microsoft.comadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://oneocsp.microsoft.comadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://ocsp.msocsp.comadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
http://www.microsoft.com/pkiopsadded to Tenant attach · TCP 80 · required · 12 Oct 23:22 UTC
https://graph.windows.netadded to Endpoints required for Configuration Manager-managed devices · TCP 443 · required · 12 Oct 23:22 UTC
https://*.manage.microsoft.comadded to Endpoints required for Configuration Manager-managed devices · TCP 443 · required · 12 Oct 23:22 UTC
windowsupdate.microsoft.comremoved from Software updates · required · 12 Oct 23:22 UTC
*.windowsupdate.microsoft.comremoved from Software updates · required · 12 Oct 23:22 UTC
*.update.microsoft.comremoved from Software updates · required · 12 Oct 23:22 UTC
*.windowsupdate.comremoved from Software updates · required · 12 Oct 23:22 UTC
download.windowsupdate.comremoved from Software updates · required · 12 Oct 23:22 UTC
download.microsoft.comremoved from Software updates · required · 12 Oct 23:22 UTC
*.download.windowsupdate.comremoved from Software updates · required · 12 Oct 23:22 UTC
ntservicepack.microsoft.comremoved from Software updates · required · 12 Oct 23:22 UTC
https://omex.cdn.office.net/mirrored/sccmreadiness/SOT_SCCM_AddinReadiness.CABremoved from Manage Microsoft 365 Apps · required · 12 Oct 23:22 UTC
https://contentstorage.osi.office.net/sccmreadinessppe/sot_sccm_addinreadiness.cabremoved from Manage Microsoft 365 Apps · required · 12 Oct 23:22 UTC
https://aka.ms/configmgrgatewayremoved from Tenant attach · required · 12 Oct 23:22 UTC
*.manage.microsoft.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
*.manage.microsoft.usremoved from Tenant attach · required · 12 Oct 23:22 UTC
dc.services.visualstudio.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
crl3.digicert.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
crl4.digicert.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
ocsp.digicert.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
www.d-trust.netremoved from Tenant attach · required · 12 Oct 23:22 UTC
root-c3-ca2-2009.ocsp.d-trust.netremoved from Tenant attach · required · 12 Oct 23:22 UTC
crl.microsoft.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
oneocsp.microsoft.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
ocsp.msocsp.comremoved from Tenant attach · required · 12 Oct 23:22 UTC
http://www.microsoft.com/pkiopsremoved from Tenant attach · required · 12 Oct 23:22 UTC
graph.windows.netremoved from Endpoints required for Configuration Manager-managed devices · required · 12 Oct 23:22 UTC
*.manage.microsoft.comremoved from Endpoints required for Configuration Manager-managed devices · required · 12 Oct 23:22 UTC

ChangeIntel reads each page once a day: the destinations in its tables, lists and code blocks, under the sections named above. Entries follow the page; nothing is added that it does not publish.

Downloads

Built from the pages and endpoint sets above, as last read

Format	Destinations	Left out	Download
Plain list, one per line	51	0	Open
GSA V1 domain list	23	28	Open
GSA V1 Graph request body	50	1	Download
GSA V2 rules (review JSON)	50	1	Download
GSA V2 rules (CSV)	50	1	Download

About these formats and checking them on a device

"Left out" counts entries a format cannot hold: IP ranges in web filtering, mid-name wildcards, URLs in a V1 domain list, and unfilled values. The V2 JSON is a review format; Microsoft publishes no Graph request shape for V2 rules yet. See how V1 and V2 evaluate.

The same entries are JSON at /api/v1/access-bundles/configmgr-internet. To check them from the workstation itself, run Test-ChangeIntelAccessBundle -Bundle configmgr-internet from the ChangeIntel PowerShell module there: it resolves DNS and tries TCP and TLS to each published host, and reports certificate issuers that suggest TLS inspection.

The profile each destination goes to is inferred from Microsoft's published material, not confirmed. Confirm in the Global Secure Access client: Advanced diagnostics, Forwarding profile.

Expected to reach web filtering

12expected to go through the Internet Access profile, where a block-by-default web filtering policy would have to allow the ones your scenario needs

Expected to reach web filtering
Destination	Why it's needed	Source
`*.akamaiedge.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`*.akamaitechnologies.com`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ceuswatcab01.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`ceuswatcab02.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`cmbitsstore.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`configmgrbits.azureedge.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`eaus2watcab01.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`eaus2watcab02.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`http://www.d-trust.net`TCP 80	Tenant attach	Internet access requirements · Tenant attach Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`https://*.manage.microsoft.us`TCP 443	for US Government cloud customers on version 2107 or later	Internet access requirements · Tenant attach Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`weus2watcab01.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.
`weus2watcab02.blob.core.windows.net`	Updates and servicing	Internet access requirements · Updates and servicing Internet Access profile · indicated, not confirmed Not in the Microsoft 365 endpoint list the Microsoft traffic profile is built from, so it is expected to go through the Internet Access profile when that profile is on. Not confirmed: the Entra system profile's hosts aren't published.

Not determined

35public material doesn't settle it; check the client's forwarding profile

Not determined
Destination	Why it's needed	Source
`*-umwatsonc.events.data.microsoft.com`	Updates and servicing	Internet access requirements · Updates and servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`clients.config.office.net`	to retrieve the names of the files needed for a particular Microsoft 365 Apps update. For more information, see Using the Microsoft 365 Apps file list API	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`config.office.com`	to create custom configurations for Microsoft 365 Apps for enterprise deployments	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 147 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`contentstorage.osi.office.net`	to support the evaluation of Office add-in readiness	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`definitionupdates.microsoft.com`	Updates and servicing	Internet access requirements · Updates and servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`dl.delivery.mp.microsoft.com`	Windows servicing	Internet access requirements · Windows servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`download.microsoft.com`	Updates and servicing; Windows servicing	Internet access requirements · Updates and servicing Internet access requirements · Windows servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`download.visualstudio.microsoft.com`	Updates and servicing	Internet access requirements · Updates and servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`download.windowsupdate.com`	Updates and servicing	Internet access requirements · Updates and servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`go.microsoft.com`	Updates and servicing	Internet access requirements · Updates and servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://*.download.windowsupdate.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://*.update.microsoft.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://*.windowsupdate.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://*.windowsupdate.microsoft.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://crl.microsoft.com`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://crl3.digicert.com`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://crl4.digicert.com`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://download.microsoft.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://download.windowsupdate.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Intune (MEM) endpoint set 164 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://ntservicepack.microsoft.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://ocsp.digicert.com`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://ocsp.msocsp.com`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 125 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://oneocsp.microsoft.com`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://root-c3-ca2-2009.ocsp.d-trust.net`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined Looks like a certificate validation host and isn't in the Microsoft 365 list. Microsoft documents that the Entra system profile covers certificate validation but lists no hosts, so this can go either way.
`http://windowsupdate.microsoft.com`TCP 80	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`http://www.microsoft.com/pkiops`TCP 80	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://*.update.microsoft.com`TCP 443	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://*.windowsupdate.microsoft.com`TCP 443	Software updates	Internet access requirements · Software updates Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://aka.ms/configmgrgateway`TCP 443	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Teams / Skype endpoint set 17 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://clients.config.office.net`TCP 443	and https://go.microsoft.com/fwlink/?linkid=2190568 to support deploying updates for Microsoft 365 Apps for enterprise	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://contentstorage.osi.office.net/sccmreadinessppe/sot_sccm_addinreadiness.cab`TCP 443	Location before March 2, 2021	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://dc.services.visualstudio.com`TCP 443	Tenant attach	Internet access requirements · Tenant attach Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 75 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://omex.cdn.office.net/mirrored/sccmreadiness/SOT_SCCM_AddinReadiness.CAB`TCP 443	Starting March 2, 2021	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 47 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`officecdn.microsoft.com`	to synchronize the software update point for Microsoft 365 Apps for enterprise client updates	Internet access requirements · Manage Microsoft 365 Apps Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`umwatsonc.events.data.microsoft.com`	Updates and servicing	Internet access requirements · Updates and servicing Profile not determined · possibly the Microsoft traffic profile In Microsoft 365 Common endpoint set 50 (Default category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.

Probably taken before Internet Access

4public material indicates the Microsoft Entra system profile or the Microsoft traffic profile takes them first, so web filtering wouldn't evaluate them; not confirmed

Probably taken before Internet Access
Destination	Why it's needed	Source
`configmgrbits.cdn.manage.microsoft.com`	Important This Azure endpoint only supports TLS 1.2 with specific cipher suites. Make sure your environment supports these Azure configurations. For more information, see Azure Front Door: TLS configuration FAQ	Internet access requirements · Updates and servicing Microsoft traffic profile · indicated, not confirmed In Microsoft 365 Intune (MEM) endpoint set 163 (Allow category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://*.manage.microsoft.com`TCP 443	for Azure public cloud customers; Used to synch device collection and devices with Endpoint analytics on Configuration Manager server role only. For more information, see Configure the proxy for a site system server.	Internet access requirements · Tenant attach Internet access requirements · Endpoints required for Configuration Manager-managed devices Microsoft traffic profile · indicated, not confirmed In Microsoft 365 Intune (MEM) endpoint set 163 (Allow category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.
`https://graph.windows.net`TCP 443	Used to automatically retrieve settings when attaching your hierarchy to Endpoint analytics on Configuration Manager server role. For more information, see Configure the proxy for a site system server.	Internet access requirements · Endpoints required for Configuration Manager-managed devices Microsoft Entra system profile · indicated, not confirmed In Microsoft 365 endpoint set 56, one of the Entra identity sets. Microsoft documents that the always-on Entra system profile covers sign-in and Graph, and that the Microsoft traffic profile is built from this list, so it is expected to be taken before Internet Access. Microsoft publishes neither profile's host list.
`*.manage.microsoft.com`	Updates and servicing	Internet access requirements · Updates and servicing Microsoft traffic profile · indicated, not confirmed In Microsoft 365 Intune (MEM) endpoint set 163 (Allow category). Microsoft documents that the Microsoft traffic profile is built from this list, combined by traffic category, but not which categories it includes.