Network requests in Office 365 ProPlus and Mobile

Office 365 ProPlus applications provide a native app experience. Each app is designed to work in a variety of scenarios, including states when no network access is available. When a machine is connected to a network, the applications automatically connect to a series of web-based services to provide enhanced functionality. This paper describes which endpoints and URLs the applications attempt to reach, and the services provided. This information is useful when troubleshooting network configuration issues, and setting a policy for network proxy servers. The details in this paper are intended to compliment the Office 365 URL and address range article.

Refer to the Office 365 URL and address range article for information about the timing of changes and for more information about how to use these endpoints in your firewall or proxy allow list configuration. The RSS feed and XML file in the main Office 365 URL and address range article are inclusive of these endpoints. You can review the RSS feed to see the change history.

Office client endpoints: Windows | Mac

Last updated: 9/29/2017

Using Office with or without Office 365?

When using Office with or without Office 365, the following endpoints are used.

To use this application, you must be able to connect to the endpoints described below. To see the IP addresses, expand the IP address section below the table describing the traffic flow.

If you’re interested in bypassing the CDN for your deployment, you can build an internal installation point.

Row

Purpose

Source | Credentials

Destination

CDN

CIDR Address

Port

1

Required: Authentication and identity

See Office 365 authentication and identity

2

Required: This url is needed to renew the product key approximately every 30 days

Office client only | Local system

activation.sls.microsoft.com

No

N/A

TCP 443

3

Required: This URL is required to validate certificates during activation

Office client only | Local system

crl.microsoft.com

No

N/A

TCP 80 & 443

4

Required: Required for identity and configuration services

Office client only | Local system

odc.officeapps.live.com

cdn.odc.officeapps.live.com

ajax.aspnetcdn.com

Yes

N/A

TCP 80 & 443

5

Required: This URL is the Office Licensing Service, which is used during activation and subscription maintenance

Office client only | Local system

ols.officeapps.live.com

Yes

13.107.12.51/32
23.96.219.115/32
23.97.178.173/32
23.99.56.164/32
23.99.112.148/32
40.76.62.115/32
40.86.88.12/32
40.83.182.229/32
40.84.192.103/32
40.113.17.180/32
40.113.22.47/32
40.124.14.212/32
104.40.208.40/32
104.40.234.17/32
104.210.220.25/32
137.116.74.190/32
168.63.234.40/32
191.236.108.93/32
191.236.157.212/32
207.46.237.84/32

+CDN IP addresses not provided.

TCP 443

6

Required: Runtime client configuration.

Office client only | Local system

office15client.microsoft.com

officeclient.microsoft.com

Yes

TCP 443

7

Required: These FQDNs are required to support in-app redirection.

Office client only | Local system

ocsredir.officeapps.live.com

r.office.microsoft.com

officeredir.microsoft.com

o15.officeredir.microsoft.com

officepreviewredir.microsoft.com

No

13.67.56.73/32
13.75.47.241/32
104.40.218.31/32
40.83.178.25/32
104.209.179.144/32
40.84.188.180/32

TCP 80 & 443

8

Required: This FQDN is required to support the recent documents function.

Office client only | Local system

ocws.officeapps.live.com

ea-000.ocws.officeapps.live.com

neu-000.ocws.officeapps.live.com

weu-000.ocws.officeapps.live.com

wus-000.ocws.officeapps.live.com

scus-000.ocws.officeapps.live.com

ncus-000.ocws.officeapps.live.com

Eus2-000.ocws.officeapps.live.com

No

13.75.47.33/32
40.113.19.21/32
23.97.218.250/32
40.78.68.109/32
40.84.147.173/32
23.96.208.185/32
104.209.212.110/32

TCP 443

9

Required: Contains Office 365 ProPlus source media used for installation and/or updates. If automatic updates are configured in the default settings, the local system account is used when downloading updates.

Office client only | Logged on user

officecdn.microsoft.com

officecdn.microsoft.com.edgesuite.net

officecdn.microsoft.com.edgekey.net

Yes

N/A

TCP 80 & 443

10

Required: In-app help.

Office client only | Anonymous

ocsa.officeapps.live.com

Yes

N/A

TCP 80 & 443

11

Required: Bing image search.

Office client only | Anonymous

insertmedia.bing.office.net

No

N/A

TCP 80 & 443

12

Required: This URL is used to redirect to web content such as online help and error code information.

Office client only | Logged on user

go.microsoft.com

Support.office.com

Yes

N/A

TCP 80 & 443

13

Required: Discovery and EmailHRD services.

Office client only | Logged on user

Office client only | Anonymous

odc.officeapps.live.com

sea-odc.officeapps.live.com

neu-odc.officeapps.live.com

weu-odc.officeapps.live.com

wus-odc.officeapps.live.com

eus-odc.officeapps.live.com

scus-odc.officeapps.live.com

ncus-odc.officeapps.live.com

cus-odc.officeapps.live.com

No

168.63.234.40/32
40.113.17.180/32
104.40.208.40/32
23.99.56.164/32
40.76.62.115/32
40.84.192.103/32
23.96.219.115/32
40.86.88.12/32

TCP 80 & 443

14

Required: Roaming Services.

Office client only | Logged on user

ea-roaming.officeapps.live.com

sea-roaming.officeapps.live.com

neu-roaming.officeapps.live.com

weu-roaming.officeapps.live.com

wus-roaming.officeapps.live.com

eus2-roaming.officeapps.live.com

scus-roaming.officeapps.live.com

ncus-roaming.officeapps.live.com

cus-roaming.officeapps.live.com

No

13.75.42.223/32
13.67.53.38/32
13.69.159.30/32
40.74.50.25/32
104.40.28.30/32
137.116.77.120/32
40.84.149.239/32
65.52.210.135/32
40.122.129.128/32

TCP 80 & 443

15

Required: Supports install and update discovery for Office installations

Office client only | Logged on user

mrodevicemgr.officeapps.live.com

No

N/A

TCP 443

The below IP addresses must be accessible to clients.

Office 365 proplus IPv4 endpoints rroutable through the Internet only

Office 365 Certificate Revocation List (Root URLs)

13.67.53.38/32
13.67.56.73/32
13.69.159.30/32
13.75.42.223/32
13.75.47.33/32
13.75.47.241/32
13.107.12.51/32
23.96.208.185/32
23.96.219.115/32
23.96.219.115/32
23.97.178.173/32
23.97.218.250/32
23.99.56.164/32
23.99.56.164/32
23.99.112.148/32
40.74.50.25/32
40.76.62.115/32
40.76.62.115/32
40.78.68.109/32
40.83.178.25/32
40.83.182.229/32
40.84.147.173/32
40.84.149.239/32
40.84.188.180/32
40.84.192.103/32
40.84.192.103/32
40.86.88.12/32
40.86.88.12/32
40.113.17.180/32
40.113.17.180/32
40.113.19.21/32
40.113.22.47/32
40.122.129.128/32
40.124.14.212/32
65.52.210.135/32
104.40.28.30/32
104.40.208.40/32
104.40.208.40/32
104.40.218.31/32
104.40.234.17/32
104.209.179.144/32
104.209.212.110/32
104.210.220.25/32
137.116.74.190/32
137.116.77.120/32
168.63.234.40/32
168.63.234.40/32
191.236.108.93/32
191.236.157.212/32
207.46.237.84/32
*.entrust.net
*.geotrust.com
*.omniroot.com
*.public-trust.com
*.symcb.com
*.symcd.com
*.verisign.com
*.verisign.net
aia.entrust.net
apps.identrust.com
cacert.a.omniroot.com
cacert.omniroot.com
cacerts.digicert.com
cdp1.public-trust.com
cert.int-x3.letsencrypt.org
crl.entrust.net
crl.globalsign.com
crl.globalsign.net
crl.identrust.com
crl.microsoft.com
crl3.digicert.com
crl4.digicert.com
EVIntl-aia.verisign.com
EVIntl-crl.verisign.com
EVIntl-ocsp.verisign.com
evsecure-aia.verisign.com
EVSecure-crl.verisign.com
EVSecure-ocsp.verisign.com
isrg.trustid.ocsp.identrust.com
mscrl.microsoft.com
ocsp.digicert.com
ocsp.entrust.net
ocsp.globalsign.com
ocsp.int-x3.letsencrypt.org
ocsp.msocsp.com
ocsp.omniroot.com
ocsp2.globalsign.com
ocspx.digicert.com
s1.symcb.com
s2.symcb.com
sa.symcb.com
sd.symcb.com
secure.globalsign.com
sr.symcb.com
sr.symcd.com
su.symcb.com
su.symcd.com
vassg142.crl.omniroot.com
vassg142.ocsp.omniroot.com
www.digicert.com
www.microsoft.com

Row

Purpose

Destination

CIDR Address

Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

3

Required: SharePoint Online

See SharePoint Online

4

Required: OneNote notebooks

www.onenote.com

OneNote Online IP Addresses.

TCP 443

5

Required: OneNote notebooks (wildcards)

*.onenote.com

OneNote Online IP Addresses.

TCP 443

*.msecnd.net

*.microsoft.com

*.office.net

N/A

TCP 443

6

Required: OneNote notebook CDNs

cdn.onenote.net

site-cdn.onenote.net

N/A

TCP 443

7

Required: OneNote supporting services and CDNs

cdn.optimizely.com

Ajax.aspnetcdn.com

apis.live.net

www.onedrive.com

N/A

TCP 443

8

Optional: OneNote 3rd party supporting services and CDNs

www.youtube.com

ad.atdmt.com

s.ytimg.com

N/A

TCP 443

OneNote IPv4 endpoints routable through the Internet only

13.73.106.160/32
13.75.158.234/32
13.78.58.132/32
13.79.161.29/32
13.82.54.72/32
13.93.219.105/32
40.74.129.10/32
40.118.97.54/32
51.140.50.132/32
51.141.14.78/32
52.172.158.178/32
52.228.32.190/32
52.231.36.193/32
52.231.202.175/32
52.229.125.229/32
104.41.35.170/32
104.211.163.139/32

This is the current list of the FQDNs required for the Outlook App on Android and iOS.

Row

Purpose

Destination

Port

1

Required: Outlook for Android and iOS

*.acompli.net

TCP 443

2

Required: Authentication

outlook.office365.com

sdfpilot.outlook.com

graph.windows.net

api.office.com

secure.aadcdn.microsoftonline-p.com

login.windows.net

login.windows-ppe.net

com.microsoft.office.outlook.dev

go.microsoft.com

mam.manage.microsoft.com

vortex.data.microsoft.com

TCP 443

3

Required: Outlook rest

login.microsoftonline.com

outlook.office.com

TCP 443

4

Required: OneDrive For Business

login.windows.net

TCP 443

5

Required: Consumer Outlook.com and OneDrive integration

login.live.com

auth.gfx.ms

account.live.com

graph.microsoft.com

apis.live.net

TCP 443

6

Required: Google integration

accounts.google.com

mail.google.com

www.googleapis.com

TCP 443

7

Required: Yahoo integration

api.login.yahoo.com

social.yahooapis.com

TCP 443

8

Required: DropBox integration

www.dropbox.com

api.dropboxapi.com

TCP 443

9

Required: Box integration

app.box.com

TCP 443

10

Required: Facebook integration

m.facebook.com

graph.facebook.com

TCP 443

11

Required: Evernote integration

www.evernote.com

TCP 443

12

Required: WunderList integration

www.wunderlist.com

a.wunderlist.com

TCP 443

13

Optional: Outlook Privacy

https://bit.ly/outlookprivacy

https://www.acompli.com/privacy-policy/

TCP 443

14

Optional: User voice integration

by.uservoice.com

outlook.uservoice.com

TCP 443

15

Optional: Log upload integration

api.diagnostics.office.com

TCP 443

16

Optional: Support log upload integration

acompli-android-logs.s3.amazonaws.com

s3-us-west-2.amazonaws.com

TCP 443

17

Optional: Aria log integration

mobile.pipe.aria.microsoft.com

TCP 443

18

Optional: Flurry log integration

data.flurry.com

TCP 443

19

Optional: Adjust integration

app.adjust.com

TCP 443

20

Optional: Hockey log integration

rink.hockeyapp.net

sdk.hockeyapp.net

TCP 443

21

Optional: Helpshift integration

acompli.helpshift.com

TCP 443

22

Optional: Play Store integration (Android only)

play.google.com

TCP 443

This is the current list of Office for iPad URLs. If you’re using allow lists to filter iPad connectivity differently than other computers on your network, you can use just this list of URLs to create those allow lists.

Office for iPad URLs

directory.services.live.com
odc.officeapps.live.com
docs.live.net
roaming.officeapps.live.com
nexus.officeapps.live.com
sqm.microsoft.com
watson.telemetry.microsoft.com
login.live.com
wer.microsoft.com         
*-my.sharepoint.com
login.microsoftonline.com
ms.tific.com
p100-sandbox.itunes.apple.com
signup.live.com
auth.gfx.ms
view.atdmt.com
client.hip.live.com
dc2.client.hip.live.com
c.live.com
go.microsoft.com
office.microsoft.com
officeimg.vo.msecnd.net
m.webtrends.com
account.live.com
c.bing.com
partnerservices.getmicrosoftkey.com
client.hip.live.com
clientconfig.microsoftonline-p.net
cl2.apple.com
sas.office.microsoft.com
foodanddrink.services.appex.bing.com
en-US.appex-rf.msn.com
weather.tile.appex.bing.com

This is the current list of Office Mobile URLs. Office Mobile runs on Android devices, Windows Phones, and iPhones. If you’re filtering your mobile connectivity differently than other computers on your network, you can use just this list of URLs to create those allow lists.

Office Mobile URLs

*.acompli.net
*.appex.bing.com
*.appex-rf.msn.com
*-my.sharepoint.com
a.wunderlist.com
account.live.com
accounts.google.com
acompli.helpshift.com
acompli-android-logs.s3.amazonaws.com
api.diagnostics.office.com
api.dropboxapi.com
api.login.yahoo.com
api.office.com
apis.live.net
app.adjust.com
app.box.com
appexsin.stb.s-msn.com
auth.gfx.ms
auth.gfx.ms
by.uservoice.com
c.bing.com
c.live.com
cl2.apple.com
client.hip.live.com
client.hip.live.com
clientconfig.microsoftonline-p.net
com.microsoft.office.outlook.dev
d.docs.live.net
data.flurry.com
dc2.client.hip.live.com
directory.services.live.com
docs.live.net
en-US.appex-rf.msn.com
foodanddrink.services.appex.bing.com
go.microsoft.com
graph.facebook.com
graph.microsoft.com
graph.windows.net
login.live.com
login.microsoftonline.com
login.windows.net
login.windows-ppe.net
m.facebook.com
m.webtrends.com
mail.google.com
mam.manage.microsoft.com
mobile.pipe.aria.microsoft.com
ms.tific.com
nexus.officeapps.live.com
o15.officeredir.microsoft.com
odc.officeapps.live.com
odcsm.officeapps.live.com
office.microsoft.com
office15client.microsoft.com
officeimg.vo.msecnd.net
outlook.office.com
outlook.office365.com
outlook.uservoice.com
*.itunes.apple.com
partnerservices.getmicrosoftkey.com
play.google.com
rink.hockeyapp.net
roaming.officeapps.live.com
s3-us-west-2.amazonaws.com
sas.office.microsoft.com
sdfpilot.outlook.com
sdk.hockeyapp.net
secure.aadcdn.microsoftonline-p.com
signup.live.com
social.yahooapis.com
sqm.microsoft.com
view.atdmt.com
vortex.data.microsoft.com
watson.telemetry.microsoft.com
weather.tile.appex.bing.com
wer.microsoft.com
www.acompli.com
www.dropbox.com
www.evernote.com
www.googleapis.com
www.wunderlist.com

Using Office 365 ProPlus with Office 365 operated by 21 Vianet?

Office 365 operated by 21 Vianet uses different endpoints, if you're using Office 365 ProPlus in conjunction with one of these subscriptions you'll want to use the endpoints below.

The following URLs and IP addresses are used by Office 365 ProPlus with Office 365 operated by 21 Vianet, all ports are TCP 80 & 443.

IP address ranges

URLs

42.159.4.50/32

42.159.132.75/32

70.37.81.47/32

42.159.4.225/32

65.52.98.231/32:443

168.63.252.62/32

42.159.4.50/32

42.159.4.45/32

42.159.7.13/32

42.159.132.73/32

42.159.4.225/32

42.159.132.73/32

42.159.4.45/32

42.159.132.74/32

65.55.227.140/32

65.55.69.140/32

bjb-ols.officeapps.partner.office365.cn

sha-ols.officeapps.partner.office365.cn

osiprod-scus01-odcsm.cloudapp.net

osi-prod-bjb01-odcsm.chinacloudapp.cn

activation.sls.microsoft.com

odc.officeapps.live.com

ols.officeapps.partner.office365.cn

roaming.officeapps.partner.office365.cn

dnsmop.chinacloudapp.cn

osi-prod-sha01-odcsm.chinacloudapp.cn

bjb-odcsm.officeapps.partner.office365.cn

sha-odcsm.officeapps.partner.office365.cn

bjb-roaming.officeapps.partner.office365.cn

sha-roaming.officeapps.partner.office365.cn

office15client.microsoft.com

crl.microsoft.com

officecdn.microsoft.com

Here’s a short link you can use to come back: https://aka.ms/office365proplusendpoints

See Also

Network requests in Office 365 ProPlus

Office 365 URLs and IP address ranges

Expand your skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×