Network requests in Office for Mac

Office for Mac applications provide a native app experience on the macOS platform. Each app is designed to work in a variety of scenarios, including states when no network access is available. When a machine is connected to a network, the applications automatically connect to a series of web-based services to provide enhanced functionality. The following information describes which endpoints and URLs the applications try to reach, and the services provided. This information is useful when troubleshooting network configuration issues and setting policies for network proxy servers. The details in this article are intended to complement the Office 365 URL and address ranges article, which includes endpoints for computers running Microsoft Windows. Unless noted, the information in this article also applies to Office 2019 for Mac and Office 2016 for Mac, which are available as a one-time purchase from a retail store or through a volume licensing agreement.

Most of this article is tables detailing network URLs, type, and description of service or feature provided by that endpoint. Each of the Office apps may differ in its service and endpoint usage. The following apps are defined in the tables below:

  • W: Word
  • P: PowerPoint
  • X: Excel
  • O: Outlook
  • N: OneNote

The URL type is defined as follows:

  • ST: Static - The URL is hard-coded into the client application.

  • SS: Semi-Static - The URL is encoded as part of a web page or redirector.

  • CS: Config Service - The URL is returned as part of the Office Configuration Service.

Office for Mac default configuration

Installation and updates

The following network endpoints are used to download the Office for Mac installation program from the Microsoft Content Delivery Network (CDN).

URL Type Description
https://go.microsoft.com/fwlink/
ST
Microsoft 365 Installation Portal forward link service to latest installation packages.
https://officecdn-microsoft-com.akamaized.net/
SS
Location of installation packages on the Content Delivery Network.
https://officecdn.microsoft.com/
SS
Location of installation packages on the Content Delivery Network.
https://officeci-mauservice.azurewebsites.net/
ST
Management Control endpoint for Microsoft AutoUpdate

First app launch

The following network endpoints are contacted on first launch of an Office app. These endpoints provide enhanced Office functionality for users, and the URLs are contacted regardless of license type (including Volume License installations).

URL Apps Type Description
https://config.edge.skype.com/
WXPON
ST
'Flighting' Configuration - allows for feature light-up and experimentation.
https://ocos-office365-s2s.msedge.net/
WXPON
ST
'Flighting' Network Configuration Test
https://client-office365-tas.msedge.net/
WXPON
ST
'Flighting' Network Configuration Test
https://officeclient.microsoft.com/
WXPON
ST
Office Configuration Service - Master list of service endpoints.
https://nexusrules.officeapps.live.com/
WXPON
ST
Office Rules Telemetry download - Informs the client about what data and events to upload to the telemetry service.
https://mobile.pipe.aria.microsoft.com/
N
CS
OneNote Telemetry Service
https://nexus.officeapps.live.com/
WXPON
ST
Office Telemetry Upload Reporting - "Heartbeart" and error events that occur on the client are uploaded to the telemetry service.
https://templateservice.office.com/
WXP
CS
Office Template Service - Provides users with online document templates.
https://omextemplates.content.office.net/
WXP
CS
Office Templates Downloads - Storage of PNG template images.
https://store.office.com/
WXP
CS
Store configuration for Office apps.
https://odc.officeapps.live.com/
WXPN
CS
Office Document Integration Services Catalog (list of services and endpoints) and Home Realm Discovery.
https://cdn.odc.officeapps.live.com/
WXPON
CS
Resources for Home Realm Discovery v2 (15.40 and later)
https://officecdn.microsoft.com/
WXPON
ST
Microsoft AutoUpdate Manifests - checks to see if there are updates available
https://ajax.aspnetcdn.com/
WXPO
SS
Microsoft Ajax JavaScript Library
https://wikipedia.firstpartyapps.oaspapps.com/
W
SS
Wikipedia app for Office configuration and resources.
https://excelbingmap.firstpartyapps.oaspapps.com/
X
SS
Bing Map app for Office configuration and resources.
https://peoplegraph.firstpartyapps.oaspapps.com/
X
SS
People Graph app for Office configuration and resources.
https://www.onenote.com/
N
ST
What's New content for OneNote.
https://site-cdn.onenote.net/
N
ST
New content for OneNote.
https://site-cdn.onenote.net/
N
SS
What's New images for OneNote.
https://acompli.helpshift.com/
O
ST
In-app Support Service.
https://prod-global-autodetect.acompli.net/
O
ST
Email Account Detection Service.
https://autodiscover-s.outlook.com/
WXPO
ST
Outlook AutoDiscovery
https://outlook.office365.com/
WXPO
ST
Outlook endpoint for Microsoft 365 service.
https://r1.res.office365.com/
O
ST
Icons for Outlook add-ins.

Note

The Office Configuration Service acts as an auto-discovery service for all Microsoft Office clients, not just for Mac. The endpoints returned in the response are semi-static in that change is very infrequent, but still possible.

Sign-in

The following network endpoints are contacted when signing in to cloud-based storage. Depending on your account type, different services may be contacted. For example:

  • MSA: Microsoft Account - typically used for consumer and retail scenarios

  • OrgID: Organization Account - typically used for commercial scenarios

URL Apps Type Description
https://login.windows.net/
WXPON
ST
Windows Authorization Service
https://login.microsoftonline.com/
WXPON
ST
Microsoft 365 Login Service (OrgID)
https://login.live.com/
WXPON
ST
Microsoft Account Login Service (MSA)
https://auth.gfx.ms/
WXPON
CS
Microsoft Account Login Service Helper (MSA)
https://secure.aadcdn.microsoftonline-p.com/
WXPON
SS
Microsoft 365 Login Branding (OrgID)
https://ocws.officeapps.live.com/
WXPN
CS
Document and Places Storage Locator
https://roaming.officeapps.live.com/
WXPN
CS
Most Recently Used (MRU) document service

Note

For subscription-based and retail licenses, signing in both activates the product, and enables access to cloud resources such as OneDrive. For Volume License installations, users are still prompted to sign-in (by default), but that is only required for access to cloud resources, as the product is already activated.

Product activation

The following network endpoints apply to Microsoft 365 Subscription and Retail License activations. Specifically, this does NOT apply to Volume License installations.

URL Apps Type Description
https://ols.officeapps.live.com/
WXPON
CS
Office Licensing Service

What's New content

The following network endpoints apply to Microsoft 365 Subscription only.

URL Apps Type Description
https://contentstorage.osi.office.net/
WXPO
SS
What's New JSON page content.

Researcher

The following network endpoints apply to Microsoft 365 Subscription only.

URL Apps Type Description
https://entity.osi.office.net/
W
CS
Researcher Web Service
https://cdn.entity.osi.office.net/
W
CS
Researcher Static Content
https://www.bing.com/
W
CS
Researcher Content Provider

Smart Lookup

The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.

URL Apps Type Description
https://uci.officeapps.live.com/
WXPN
CS
Insights Web Service
https://ajax.googleapis.com/
WXPN
CS
JQuery Library
https://cdnjs.cloudflare.com/
WXPN
CS
Supporting JavaScript Library
https://www.bing.com/
WXPN
CS
Insights Content Provider
https://tse1.mm.bing.net/
WXPN
CS
Insights Content Provider

PowerPoint Designer

The following network endpoints apply to Microsoft 365 Subscription only.

URL Apps Type Description
https://pptsgs.officeapps.live.com/
P
CS
PowerPoint Designer web service

PowerPoint QuickStarter

The following network endpoints apply to Microsoft 365 Subscription only.

URL Apps Type Description
https://pptcts.officeapps.live.com/
P
CS
PowerPoint QuickStarter web service

Send a Smile/Frown

The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.

URL Apps Type Description
https://sas.office.microsoft.com/
WXPON
CS
Send a Smile Service

Contact Support

The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.

URL Apps Type Description
https://powerlift-frontdesk.acompli.net/
O
CS
Contact Support Service
https://acompli.helpshift.com/
O
CS
In-app Support Service

Save As PDF

The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.

URL Apps Type Description
https://wordcs.officeapps.live.com/
W
CS
Word document conversion service (PDF)

Office Apps (aka add-ins)

The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations when Office App add-ins are trusted.

URL Apps Type Description
https://store.office.com/
WXPO
CS
Office app store configuration
https://wikipedia.firstpartyapps.oaspapps.com/
W
SS
Wikipedia app resources
https://excelbingmap.firstpartyapps.oaspapps.com/
X
SS
Bing Map app resources
https://peoplegraph.firstpartyapps.oaspapps.com
X
SS
People Graph app resources
https://o15.officeredir.microsoft.com/
WPX
SS
Office Redirection Service
https://appsforoffice.microsoft.com/
WXP
SS
Office JavaScript Libraries
https://telemetry.firstpartyapps.oaspapps.com/
WX
SS
Telemetry and Reporting Service for Office apps
https://ajax.microsoft.com/
W
SS
Microsoft Ajax JavaScript Library
https://ajax.aspnetcdn.com/
X
SS
Microsoft Ajax JavaScript Library
https://c.microsoft.com/
WPXO
SS
Office JavaScript Libraries
https://c1.microsoft.com/
WPXO
SS
Support resources
https://cs.microsoft.com/
WPXO
SS
Support resources
https://c.bing.com/
WPXO
SS
Support resources
https://*.cdn.optimizely.com/
WPXO
SS
JavaScript library
https://errors.client.optimizely.com/
WPX
SS
Error reporting
https://*-contentstorage.osi.office.net/
WPXO
SS
Font resources
https://nexus.ensighten.com/
WPXO
SS
Telemetry Service
https://browser.pipe.aria.microsoft.com/
WPXO
SS
Telemetry Reporting
https://*.vo.msecnd.net/
WPXO
SS
Microsoft Store Asset Library
https://*.wikipedia.org/
W
SS
Wikipedia page resources
https://upload.wikimedia.org/
W
SS
Wikipedia media resources
https://wikipedia.firstpartyappssandbox.oappseperate.com/
W
SS
Wikipedia sandbox frame
https://*.virtualearth.net/
X
SS
Map templates

Safe Links

The following network endpoint applies to all Office applications for Microsoft 365 Subscription only.

URL Type Description
https://*.oscs.protection.outlook.com/
CS
Microsoft Safe Link Service

Crash reporting

The following network endpoint applies to all Office applications for both Microsoft 365 Subscription and Retail/Volume License activations. When a process unexpectedly crashes, a report is generated and sent to the Watson service.

URL Type Description
https://watson.microsoft.com/
ST
Microsoft Error Reporting Service
https://officeci.azurewebsites.net/
ST
Office Collaborative Insights Service

Options for reducing network requests and traffic

The default configuration of Office for Mac provides the best user experience, both in terms of functionality and keeping the machine up to date. In some scenarios, you may wish to prevent applications from contacting network endpoints. This section discusses options for doing so.

Disabling Cloud Sign-In and Office Add-Ins

Volume License customers may have strict policies about saving documents to cloud-based storage. The following per-application preference can be set to disable MSA/OrgID Sign in, and access to Office Add-ins.

  • defaults write com.microsoft.Word UseOnlineContent -integer 0

  • defaults write com.microsoft.Excel UseOnlineContent -integer 0

  • defaults write com.microsoft.Powerpoint UseOnlineContent -integer 0

If users try to access the Sign-In function, they will see an error that a network connection is not present. Because this preference also blocks online product activation, it should only be used for Volume License installations. Specifically, using this preference will prevent Office applications from accessing the following endpoints:

  • https://odc.officeapps.live.com

  • https://*.firstpartyapps.oaspapps.com

  • All endpoints listed in the 'Sign In' section above.

  • All endpoints listed in the 'Smart Lookup' section above.

  • All endpoints listed in the 'Product Activation' section above.

  • All endpoints listed in the 'Office Apps (aka add-ins)' section above.

To re-establish full functionality for the user, either set the preference to '2' or remove it.

Note

This preference requires Office for Mac build 15.25 [160726] or later.

Telemetry

Office for Mac sends telemetry information back to Microsoft at regular intervals. Data is uploaded to the 'Nexus' endpoint. The telemetry data helps the engineering team assess the health and any unexpected behaviors of each Office app. There are two categories of telemetry:

  • Heartbeat contains version and license information. This data is sent immediately upon app launch.

  • Usage contains information about how apps are being used and non-fatal errors. This data is sent every 60 minutes.

Microsoft takes your privacy very seriously. You can read about Microsoft's data collection policy at https://privacy.microsoft.com. To prevent applications from sending 'Usage' telemetry, the SendAllTelemetryEnabled preference can be adjusted. The preference is per-application, and can be set via macOS Configuration Profiles, or manually from Terminal:

defaults write com.microsoft.Word SendAllTelemetryEnabled -bool FALSE

defaults write com.microsoft.Excel SendAllTelemetryEnabled -bool FALSE

defaults write com.microsoft.Powerpoint SendAllTelemetryEnabled -bool FALSE

defaults write com.microsoft.Outlook SendAllTelemetryEnabled -bool FALSE

defaults write com.microsoft.onenote.mac SendAllTelemetryEnabled -bool FALSE

defaults write com.microsoft.autoupdate2 SendAllTelemetryEnabled -bool FALSE

defaults write com.microsoft.Office365ServiceV2 SendAllTelemetryEnabled -bool FALSE

Heartbeat telemetry is always sent and cannot be disabled.

Crash reporting

When a fatal application error occurs, the application will unexpectedly terminate and upload a crash report to the 'Watson' service. The crash report consists of a call-stack, which is the list of steps the application was processing leading up to the crash. These steps help the engineering team identify the exact function that failed and why.

In some cases, the contents of a document will cause the application to crash. If the app identifies the document as the cause, it will ask the user if it's okay to also send the document along with the call-stack. Users can make an informed choice to this question. IT administrators may have strict requirements about the transmission of documents and make the decision on behalf of the user to never send documents. The following preference can be set to prevent documents from being sent, and to suppress the prompt to the user:

defaults write com.microsoft.errorreporting IsAttachFilesEnabled -bool FALSE

Note

If SendAllTelemetryEnabled is set to FALSE, all crash reporting for that process is disabled. To enable crash reporting without sending usage telemetry, the following preference can be set: defaults write com.microsoft.errorreporting IsMerpEnabled -bool TRUE

Updates

Microsoft releases Office for Mac updates at regular intervals (typically once a month). We strongly encourage users and IT administrators to keep machines up to date to ensure the latest security fixes are installed. In cases where IT administrators want to closely control and manage machine updates, the following preference can be set to prevent the AutoUpdate process from automatically detecting and offering product updates:

defaults write com.microsoft.autoupdate2 HowToCheck -string 'Manual'

Blocking Requests with a Firewall/Proxy

If your organization blocks requests to URLs via a firewall or proxy server be sure to configure the URLs listed in this document as either allowed, or block listed with a 40X response (e.g. 403 or 404). A 40X response will allow the Office applications to gracefully accept the inability to access the resource, and will provide a faster user experience, than simply dropping the connection, which in turn will cause the client to retry.

If your proxy server requires authentication, a 407 response will be returned to the client. For the best experience, ensure that you're using Office for Mac builds 15.27 or later, as they include specific fixes for working with NTLM and Kerberos servers.

See also

Office 365 URLs and IP address ranges