Office 365 URLs and IP address ranges

Summary   : The following endpoints (FQDNs, Ports, URLs, IPv4, and IPv6 prefixes) apply to Office 365 plans, including Government Community Cloud (GCC) and are designed to deliver productivity services to organizations using only these plans.

Office 365 endpoints: Worldwide (including GCC) | Office 365 operated by 21 Vianet | Office 365 Germany | Office 365 U.S. Government DoD | Office 365 U.S. Government GCC High |

Last updated: 8/31/2017 - RSS Change Log subscription

Download: the full list in XML format

Use: our pre-configured PAC files

Office 365 requires internet connectivity from every computer connecting to the service, this article serves as a reference for the specific Microsoft and third-party endpoints computers need to be able to reach. Start with our guide managing Office 365 endpoints to understand how best to use the information here. Except for emergency changes, endpoints are updated at the end of each month.

Important: Destination endpoints may be listed as an IP addresses only, FQDN/URI only, or a combination of the two. Some endpoints are shared within Office 365 and some are shared with consumer services. Pay attention to the introduction for each service, specific guidance that applies only to that service will be included there. Office 365 depends on internet based services such as Microsoft owned cloud services with dynamic addressing, Domain Name Services (DNS), Content Delivery Networks (CDN), Certificate Revocation Lists (CRL), and other third party services where no IP addresses are available. Where IP or FQDN information is not available, we've marked them as Not Available (N/A) in the tables below.

Every Office 365 service depends on the required endpoints in the Office 365 portal and shared and Office 365 authentication and identity sections to function. The other endpoints are grouped to make selective service decisions. Use the XML file for a complete list and the RSS feed for changes and notifications.

Supported with Internet and Azure ExpressRoute circuits

Supported with Internet circuits only

* The endpoints for these services are not included in this article's tables below or the xml and rss change log above. They're maintained separately at the links provided.

Office 365 endpoints are published at the end of each month with 30 days notice. Occasionally emergency changes will occur outside of the end of month publishing or with shorter notice periods. When an endpoint is added, the effective date listed in the RSS feed is the date after which network requests will be sent to the endpoint. If you're new to RSS, here is how to subscribe via Outlook or you can have the RSS feed updates emailed to you.

The endpoints listed as a Yes in the ExpressRoute for Office 365 column are available both over the internet and over ExpressRoute with Microsoft peering configured. Some services that Office 365 leverages are also available with Public peering configured and those are noted here; however, Public peering is not required to use ExpressRoute with Office 365 for the Office 365 applications supported over ExpressRoute.

There's a lot of information on this page, can we present it to you in a simpler way?

Please consider voicing your thoughts at the bottom of this page, under the heading Was this information helpful? Click yes or no and enter detailed feedback. The more feedback we get from you the easier it will be for us to improve the page.

Office 365 portal and shared

To use any Office 365 services, you must be able to connect to the endpoints marked required below. If your organization uses the Office 365 management pack, Cloud App Security, or the Security and Compliance export services, you'll find the associated endpoints below. All IP addresses entered directly in the Destination IP column are also listed in the IP tables and XML file for your convenience.

Office 365 shared services are requested from browsers, clients, and servers and requires the authenticated user to be passed.

Row

Purpose

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Office 365 Portal

*.office365.com

No

No2

Portal and shared IP ranges.

TCP 443

2

Required: Office 365 Portal (including Cloud App Security)

home.office.com

portal.office.com

agent.office.net

www.office.com

outlook.office365.com

signup.microsoft.com

No

Yes

Portal and shared IP ranges & Exchange Online IP ranges.

TCP 443

3

Required: Office 365 Portal (including Cloud App Security)

portal.microsoftonline.com

*.portal.cloudappsecurity.com

No

No

Portal and shared IP ranges.

TCP 443

4

Required: CDNs used for shared infrastructure

prod.msocdn.com

shellprod.msocdn.com

appsforoffice.microsoft.com

Contentstorage.osi.office.net

r1.res.office365.com

r4.res.office365.com

Yes

No

N/A

TCP 443

5

Required: Shared infrastructure

clientlog.portal.office.com

nexus.officeapps.live.com

nexusrules.officeapps.live.com

Yes

No

Portal and shared IP ranges.

TCP 80 & 443

6

Required: Shared infrastructure

suite.office.net

account.office.net

browser.pipe.aria.microsoft.com

No

Yes

Portal and shared IP ranges.

TCP 80 & 443

7

Required: Certificate revocation lists

See well known certificate root CRLs in the table below.

No

No

N/A

TCP 80 & 443

8

Required: Microsoft Groups.

groupsapi-prod.outlookgroups.ms

groupsapi2-prod.outlookgroups.ms

groupsapi3-prod.outlookgroups.ms

groupsapi4-prod.outlookgroups.ms

Yes

No

N/A

TCP 443

9

Required: Microsoft Groups.

rink.hockeyapp.net

sdk.hockeyapp.net

api.localytics.com

analytics.localytics.com

outlook.uservoice.com

Yes

No

N/A

TCP 443

10

Required: Delve

delve.office.com

apc.delve.office.com

aus.delve.office.com

can.delve.office.com

eur.delve.office.com

gbr.delve.office.com

ind.delve.office.com

jpn.delve.office.com

kor.delve.office.com

lam.delve.office.com

nam.delve.office.com

No

Yes

Portal and shared IP ranges.

TCP 80 & 443

11

Required: CDN for Delve

res.delve.office.com

Yes

No

N/A

TCP 80 & 443

12

Required: StaffHub

staffhub.ms

staffhub.office.com

*.staffhub.office.com

*.blob.core.windows.net

*.helpshift.com

*.hockeyapp.net

*.sharepointonline.com

No

No

N/A

TCP 443

13

Required: CDN for StaffHub

staffhubweb.azureedge.net

az826701.vo.msecnd.net

Yes

No

N/A

TCP 443

14

Optional: StaffHub analytics & feedback

staffhub.uservoice.com

*.aria.microsoft.com

*.localytics.com

No

No

N/A

TCP 443

15

Optional: 3rd party office integration.

firstpartyapps.oaspapps.com

prod.firstpartyapps.oaspapps.com.akadns.net

telemetryservice.firstpartyapps.oaspapps.com

wus-firstpartyapps.oaspapps.com

Yes

No

N/A

TCP 443

16

Optional: Some Office 365 features require endpoints within these domains.

Note: Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to wildcards.

*.onmicrosoft.com

*.office.com

*.office.net

No

No2

N/A

TCP 80 & 443

17

Optional: Some Office 365 features require endpoints within these domains.

Note: Many specific FQDNs within these wildcards have been published recently as we work to either remove or better explain our guidance relating to wildcards.

*.microsoft.com

*.msocdn.com

Yes

No

N/A

TCP 80 & 443

18

Optional: Shared help and support

support.office.com

products.office.com

templates.office.com

contentstorage.osi.office.net

technet.microsoft.com

amp.azure.net

assets.onestore.ms

auth.gfx.ms

c.microsoft.com

c1.microsoft.com

dgps.support.microsoft.com

mem.gfx.ms

platform.linkedin.com

support.content.office.net

video.osi.office.net

videocontent.osi.office.net

videoplayercdn.osi.office.net

Yes

No

N/A

TCP 80 & 443

19

Optional: Shared help and support

connect.facebook.net

Yes

No

N/A

TCP 80 & 443

20

Optional: Microsoft Azure RemoteApp

dc.services.visualstudio.com

liverdcxstorage.blob.core.windowsazure.com

telemetry.remoteapp.windowsazure.com

vortex.data.microsoft.com

www.remoteapp.windowsazure.com

No

No

N/A

TCP 443

21

Optional:

manage.office.com

graph.microsoft.com

graph.windows.net

api.office.com

office365servicehealthcommunications.cloudapp.net

securescore.office.com

enterpriseregistration.windows.net

No

No

N/A

TCP 443

22

Optional: Import Service for PST and file ingestion

Refer to the Import Service for additional requirements.

23

Optional: Security and Compliance export

protection.office.com

*.blob.core.windows.net

office365zoom.cloudapp.net

equivioprod*.cloudapp.net

zoom-cs-prod*.cloudapp.net

equivio.office.com

compliance.outlook.com

No

No

N/A

TCP 443

24

Optional: Remote Connectivity Analyzer - Initiate connectivity tests.

testconnectivity.microsoft.com

No

No

13.67.59.89/32
40.69.150.142/32
40.85.91.8/32
104.211.54.99/32
104.211.54.134/32

TCP 80 & 443

25

Optional: Remote Connectivity Analyzer - Captcha & support services

client.hip.live.com

wu.client.hip.live.com

support.microsoft.com

No

No

N/A

TCP 80 & 443

26

Optional: Remote Connectivity Analyzer - Execution of the tests selected by the customer.

Source of network requests:

  • testconnectivity.microsoft.com

On-premises systems for email and collaboration.

No

No

Customer IP ranges

80, 443, 25, POP3 on (110, 995, or Custom), IMAP4 on (143, 993, or Custom)

27

Optional: Microsoft Support and Recover Assistant for Office 365 - Validate single sign-on user credentials.

Source of network requests:

  • o365diagnosticsbasic-eus.cloudapp.net (104.211.54.99)

  • o365diagnosticworker-eus.cloudapp.net (104.211.54.134)

On-premises STS

No

No

Customer IP ranges

Customer configurable. Typically TCP 443

1Keep in mind that Machine accounts won’t work with proxies that require outbound authentication.

2 There are specific sub-FQDNs within this domain that are available on ExpressRoute, learn more by reading the section, Deciding which applications and features route over ExpressRoute.

Note: ExpressRoute for Office 365 currently does not support IPv6. Customers not using ExpressRoute will want to ensure both IP lists below are reachable over the internet.

Office 365 portal and shared IPv4 endpoints routable through the Internet and ExpressRoute

Office 365 portal and shared IPv4 endpoints routable through the Internet only

Office 365 portal and shared IPv6 endpoints routable through the Internet only

13.65.240.22/32
13.66.58.59/32
13.70.156.206/32
13.71.145.114/32
13.71.145.122/32
13.75.149.223/32
13.71.151.88/32
13.78.120.69/32
13.78.120.70/32
13.78.120.99/32
13.78.122.54/32
13.84.216.209/32
13.84.219.100/32
13.84.222.249/32
13.87.36.128/32
13.88.17.54/32
13.92.181.66/32
13.92.236.241/32
13.93.164.45/32
13.107.6.156/31
13.107.7.190/31
13.107.9.156/31
23.96.32.105/32
23.96.251.50/32
23.96.253.65/32
23.97.66.55/32
23.97.78.94/32
23.99.121.16/32
23.99.125.4/32
40.71.88.196/32
40.83.120.174/32
40.83.185.155/32
40.83.185.230/32
40.84.145.72/32
40.112.187.89/32
40.117.96.104/32
40.117.100.187/32
40.117.229.133/32
40.117.229.194/32
51.140.45.81/32
51.140.226.217/32
51.142.213.184/32
52.163.58.153/32
52.163.93.38/32
52.172.49.206/32
52.175.154.183/32
52.175.158.8/32
52.178.27.129/32
52.178.144.25/32
52.178.146.3/32
52.178.146.67/32
52.178.150.186/32
52.185.154.106/32
52.187.42.197/32
52.187.78.144/32
52.228.36.141/32
52.230.24.83/32
52.231.24.115/32
52.231.204.153/32
52.232.112.133/32
52.232.118.68/32
52.232.129.232/32
65.52.144.46/32
65.52.176.186/32
65.52.192.203/32
65.52.240.200/32
65.55.239.168/32
70.37.96.155/32
94.245.88.28/32
94.245.117.53/32
104.40.178.127/32
104.40.179.160/32
104.42.225.143/32
104.42.230.91/32
104.45.225.7/32
104.47.156.62/32
104.211.160.244/32
104.214.144.62/32
104.214.144.252/32
104.214.145.126/32
104.214.145.173/32
104.214.146.199/32
111.221.96.149/32
111.221.104.43/32
137.116.156.3/32
137.116.248.150/32
137.117.17.124/32
138.91.61.107/32
157.55.139.177/32
157.55.145.0/25
157.55.155.0/25
157.55.212.37/32
157.55.227.192/26
168.62.104.83/32
168.62.106.224/32
168.63.92.133/32
191.235.95.142/32
191.238.160.173/32
207.46.73.250/32
207.46.141.38/32
207.46.156.124/32
207.46.216.54/32
213.199.128.119/32
13.64.196.27/32
13.64.198.19/32
13.64.198.97/32
13.64.199.41/32
13.76.218.117/32
13.76.219.191/32
13.76.219.210/32
13.91.61.249/32
13.91.98.185/32
13.93.216.68/32
13.93.233.42/32
23.97.61.137/32
23.97.150.21/32
23.97.152.190/32
23.97.209.97/32
23.99.109.44/32
23.99.109.64/32
23.99.116.116/32
23.99.121.207/32
23.100.86.91/32
23.101.14.229/32
23.101.30.126/32
23.102.4.253/32
40.76.1.176/32
40.76.8.142/32
40.76.12.4/32
40.76.12.162/32
40.113.8.255/32
40.113.10.78/32
40.113.11.93/32
40.113.14.159/32
40.117.144.240/32
40.117.151.29/32
40.118.211.172/32
40.121.144.182/32
40.122.168.103/32
65.52.148.27/32
65.52.160.218/32
65.52.184.75/32
65.52.196.64/32
70.37.97.234/32
94.245.108.85/32
104.41.207.73/32
104.42.231.28/32
104.43.140.223/32
104.45.11.195/32
104.46.38.64/32
104.46.50.125/32
104.209.35.177/32
104.215.146.200/32
104.215.198.144/32
111.221.111.196/32
137.116.66.126/32
137.116.81.187/32
157.55.177.39/32
157.55.184.223/32
157.55.80.94/32
168.61.146.25/32
168.61.149.17/32
168.61.170.80/32
168.61.172.71/32
168.62.204.209/32
168.62.29.225/32
168.62.43.8/32
168.63.18.79/32
168.63.29.74/32
168.63.100.61/32
168.63.138.56/32
168.63.172.54/32
168.63.213.238/32
191.237.218.239/32
207.46.134.255/32
207.46.153.155/32
2603:1020:200::682f:a1d8/128
2603:1020:201::3c4/128
2603:1030:603::6a/128
2603:1030:603::72/128
2603:1030:a02::118/128
2603:1040:200::111/128
2603:1040:400::5d/128
2603:1040:400::5e/128
2603:1040:400::7b/128
2603:1040:401::c/128
2603:1040:601::2f/128
2603:1040:601::1e7/128
2801:80:1d0:1c00::/64
2a01:111:2003::/48
2a01:111:200a:a::/64
2a01:111:202c::/48
2a01:111:202e::/48
2a01:111:202e::190/128
2a01:111:202e::191/128
2a01:111:202e::156/128
2a01:111:202d::/48
2a01:111:2035:8::/64
2a01:111:f100:8000::4134:902e/128
2a01:111:f100:6000::4134:b0ba/128
2a01:111:f100:1002::4134:c0cb/128
2a01:111:f100:1002::4134:c440/128
2a01:111:f100:1002::4134:d9ee/128
2a01:111:f100:1004::4134:f0c8/128
2a01:111:f100:2002::8975:2c33/128
2a01:111:f100:2002::8975:2d11/128
2a01:111:f100:2002::8975:2d43/128
2a01:111:f100:2002::8975:2d98/128
2a01:111:f100:3002::8987:320c/128
2a01:111:f100:3002::8987:342a/128
2a01:111:f100:3002::8987:3552/128
2a01:111:f100:4001::4625:609b/128
2a01:111:f100:4001::4625:61ea/128
2a01:111:f100:4001::4625:a1e3/128
2a01:111:f100:4001::4625:a1e8/128
2a01:111:f100:4001::4625:a248/128
2a01:111:f100:6000::4134:b84b/128
2a01:111:f100:7000::6fdd:682b/128
2a01:111:f100:7000::6fdd:6b20/128
2a01:111:f100:7000::6fdd:6b76/128
2a01:111:f100:7000::6fdd:6fc4/128
2a01:111:f100:8000::4134:941b/128
2a01:111:f100:8001::d5c7:8077/128
2a01:111:f100:a000::5ef5:581c/128
2a01:111:f100:a000::5ef5:6c55/128
2a01:111:f100:7000::6fdd:6095/128
2a01:111:f100:a001::a83f:5c85/128
2a01:111:f100:a004::bfeb:8c89/128
2a01:111:f100:a004::bfeb:8deb/128
2a01:111:f102:8001::1761:4237/128
2a01:111:f102:8001::1761:4daf/128
2a01:111:f406:1::/64
2a01:111:f406:1000::/64
2a01:111:f406:1004::/64
2a01:111:f406:1801::/64
2a01:111:f406:1805::/64
2a01:111:f406:3404::/64
2A01:111:F406:8000::/64
2a01:111:f406:8801::/64
2a01:111:f406:a003::/64
2a01:111:f406:c00::/64
2a01:111:f100:1002::4134:d93c/128
2a01:111:f100:4001::4625:a4b4/128
2a01:111:f100:a004::bfeb:8cb8/128
2603:1020:201::5f2/128
2a01:111:f100:7000::6fdd:6bc2/128
2a01:111:f100:7000::6fdd:699d/128
2a01:111:f102:8001::1761:4f8a/128
2a01:111:f100:3002::8987:358e/128
2a01:111:f100:2002::8975:2cbc/128
2603:1030:603::5e0/128
2603:1040:200::4a9/128
2603:1040:601::4e/128
2603:1040:401::57/128
2603:1030:603::4ed/128
2a01:111:f100:a004::bfeb:8a37/128
2a01:111:f100:a004::bfeb:8872/128
2a01:111:f100:4001::4625:a3b3/128
2a01:111:f100:7000::6fdd:6a4e/128
2a01:111:f100:2002::8975:2db9/128
2603:1030:a02::5f9/128
2603:1040:200::419/128
2603:1020:201::142/128
2603:1020:201::265/128
2603:1020:300::33/128
2603:1020:400::26/128
2603:1040:400::715/128
2603:1040:601::281/128

The endpoints listed in this section are required if you're using Azure Rights Management. Requests originate from browsers, clients, and servers and requires the authenticated user to be passed.

Row

Purpose

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Azure Rights Management (RMS)

*.aadrm.com

*.azurerms.com

ecn.dev.virtualearth.net

No

No

N/A

TCP 443

3

Required: Azure Rights Management (RMS)

*.cloudapp.net1

No

No

N/A

TCP 443

4

Optional: Rights Management connector

Source of network requests:

  • On-premises server

*.aadrm.com

No

No

N/A

TCP 443

1Azure Rights Management Office 2010 Clients Only.

See our article on the Office 365 certificate chains for a more detailed view of the certificate chains including downloadable p7b.

Office 365 Certificate Revocation List (Root URLs)

*.entrust.net
*.geotrust.com
*.omniroot.com
*.public-trust.com
*.symcb.com
*.symcd.com
*.verisign.com
*.verisign.net
aia.entrust.net
apps.identrust.com
cacert.a.omniroot.com
cacert.omniroot.com
cacerts.digicert.com
cdp1.public-trust.com
cert.int-x3.letsencrypt.org
crl.entrust.net
crl.globalsign.com
crl.globalsign.net
crl.identrust.com
crl.microsoft.com
crl3.digicert.com
crl4.digicert.com
EVIntl-aia.verisign.com
EVIntl-crl.verisign.com
EVIntl-ocsp.verisign.com
evsecure-aia.verisign.com
EVSecure-crl.verisign.com
EVSecure-ocsp.verisign.com
isrg.trustid.ocsp.identrust.com
mscrl.microsoft.com
ocsp.digicert.com
ocsp.entrust.net
ocsp.globalsign.com
ocsp.int-x3.letsencrypt.org
ocsp.msocsp.com
ocsp.omniroot.com
ocsp2.globalsign.com
ocspx.digicert.com
s1.symcb.com
s2.symcb.com
sa.symcb.com
sd.symcb.com
secure.globalsign.com
sr.symcb.com
sr.symcd.com
su.symcb.com
su.symcd.com
vassg142.crl.omniroot.com
vassg142.ocsp.omniroot.com
www.digicert.com
www.microsoft.com

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Office 365 authentication and identity

To use any Office 365 services, you must be able to connect to the endpoints marked required below. If your organization uses Azure AD Connect AAD Connect, AD FS, or Multi-factor authentication, you'll find the associated endpoints below. All IP addresses entered directly in the Destination IP column are also listed in the IP tables and XML file for your convenience.

If you’re using Active Directory Federation Services (AD FS) with your deployment, you can also use AD FS client access policies with Windows Server 2012 R2 or client access policies with AD FS 2.0 to further restrict and control access to Office 365.

Row

Purpose

Source | Credentials

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Certificate revocation lists

See the well known certificate root CRLs.

2

Required: Authentication and identity

Client or Server / logged on user

api.login.microsoftonline.com

clientconfig.microsoftonline-p.net

device.login.microsoftonline.com

hip.microsoftonline-p.net

hipservice.microsoftonline.com

login.microsoft.com

login.microsoftonline.com

logincert.microsoftonline.com

loginex.microsoftonline.com

login-us.microsoftonline.com

login.microsoftonline-p.com

nexus.microsoftonline-p.com

stamp2.login.microsoftonline.com

login.windows.net

No

Yes

Authentication and Identity IP ranges

TCP 80 & 443

3

Required: Authentication and identity

Client or Server / logged on user

accesscontrol.windows.net

secure.aadcdn.microsoftonline-p.com2

No

No

N/A

TCP 443

4

Optional: Legacy/temporary FQDNs

Client or Server / logged on user

*.msecnd.net

*.microsoft.com

*.microsoftonline-p.com

*.microsoftonline-p.net

Yes

No

N/A

TCP 443

5

Optional: Legacy/temporary FQDNs

Client or Server / logged on user

*.windows.net

No

No3

N/A

TCP 443

6

Optional: Legacy/temporary FQDNs

Client or Server / logged on user

*.microsoftonline.com

Yes

No3

N/A

TCP 443

7

Optional: Multi-factor authentication (MFA)

Client or Server / logged on user

account.activedirectory.windowsazure.com

secure.aadcdn.microsoftonline-p.com2

No

No

Microsoft Azure Active Directory (MFA) IP and FQDNs

TCP 443

8

Optional: Azure AD Connect and DirSync

Azure AD Connect Server | Service Account

login.windows.net

provisioningapi.microsoftonline.com

adminwebservice.microsoftonline.com

No

Yes

Authentication and Identity IP ranges

TCP 443

9

Optional: Azure AD Connect and DirSync

Azure AD Connect Server | Service Account

*.microsoftonline.com

mscrl.microsoft.com

secure.aadcdn.microsoftonline-p.com2

No

No

N/A

TCP 80 & 443

10

Optional: Azure AD Connect (w/SSO option) – WinRM & remote powershell

Client or Server / logged on user

Customer STS environment (AD FS Server and AD FS Proxy) | Ports TCP 80 & 443

No

No

Customer environment

TCP 80 & 443

11

Optional: STS such as AD FS Proxy server(s) (for federated customers only)

Client or Server / N/A

Customer STS (such as AD FS Proxy) | Ports TCP 443 or TCP 49443 w/ClientTLS

No

No

Customer environment

TCP 443 or TCP 49443 w/ClientTLS

12

Optional: AD FS Proxy server(s) (for federated customers only)

Customer AD FS Proxy (WAP) | N/A

Customer AD FS Server (FS) | Port TCP 443

No

No

Customer environment

TCP 443

13

Optional: Azure AD Connect Health

Azure AD Connect Health Server | Service Account

management.azure.com

*.blob.core.windows.net

*.queue.core.windows.net

*.servicebus.windows.net - Port: 5671 (If 5671 is blocked, agent falls back to 443, but using 5671 is recommended.)

*.adhybridhealth.azure.com

*.table.core.windows.net

policykeyservice.dc.ad.msft.net

secure.aadcdn.microsoftonline-p.com

Yes

No

N/A

TCP 443

14

Optional: Azure AD Connect Health

Azure AD Connect Health Server | Service Account

login.windows.net

login.microsoftonline.com

No

Yes

Authentication and Identity IP ranges

TCP 443

1Keep in mind that Machine accounts won’t work with proxies that require outbound authentication.

2 This FQDN needs to be in your client's IE Trusted Sites Zone to function.

3 The sub-FQDN login.windows.net is advertised via Expressroute and included in the office 365 BGP communities.

Note: ExpressRoute for Office 365 currently does not support IPv6

Office 365 authentication and identity IPv4 endpoints routable through the Internet and ExpressRoute

Office 365 authentication and identity IPv6 endpoints routable through the Internet only

13.67.50.224/29
13.71.201.64/26
13.106.4.128/25
13.75.48.16/29
13.75.80.16/29
13.106.56.0/25
23.100.16.168/29
23.100.32.136/29
23.100.64.24/29
23.100.72.32/29
23.100.80.64/29
23.100.88.32/29
23.100.101.112/28
23.100.104.16/28
23.100.112.64/29
23.100.120.64/29
23.101.5.104/29
23.101.144.136/29
23.101.165.168/29
23.101.181.128/29
23.101.210.24/29
23.101.222.240/28
23.101.224.16/29
23.101.226.16/28
40.112.64.16/28
40.113.192.16/29
40.114.120.16/29
40.115.152.16/28
40.127.67.24/29
52.125.0.0/17
52.172.144.16/28
65.52.1.16/29
65.52.193.136/29
65.54.170.128/25
70.37.128.0/23
104.40.240.48/28
104.41.13.120/29
104.41.216.16/28
104.42.72.16/29
104.43.208.16/29
104.43.240.16/29
104.44.218.128/25
104.44.254.128/25
104.44.255.0/25
104.45.0.16/28
104.45.208.104/29
104.46.112.8/29
104.46.224.64/28
104.209.144.16/29
104.210.48.8/29
104.210.83.160/29
104.210.208.16/29
104.211.16.16/29
104.211.48.16/29
104.211.88.16/28
104.211.98.138/32
104.211.98.146/32
104.211.98.246/32
104.211.99.236/32
104.211.100.160/32
104.211.100.204/32
104.211.102.225/32
104.211.152.32/27
104.211.161.150/32
104.211.161.165/32
104.211.161.185/32
104.211.162.33/32
104.211.165.35/32
104.211.166.139/32
104.211.216.32/27
104.211.224.118/32
104.211.225.135/32
104.211.227.110/32
104.211.231.147/32
104.211.231.248/32
104.215.96.24/29
104.215.144.64/29
104.215.184.16/29
131.253.120.128/32
132.245.165.0/25
134.170.67.0/25
134.170.172.128/25
157.55.45.128/25
157.55.59.128/25
157.55.130.0/25
157.55.145.0/25
157.55.155.0/25
157.55.227.192/26
157.56.53.128/25
157.56.55.0/25
157.56.58.0/25
157.56.151.0/25
191.232.2.128/25
191.237.248.32/29
191.237.252.192/28

2603:1020:201::4a0/128
2603:1020:201::4a1/128
2603:1020:201::4a2/128
2603:1020:201::4a3/128
2603:1020:201::4a4/128
2603:1020:201::4a5/128
2603:1020:201::4a6/128
2603:1020:201::4a7/128
2603:1020:201::4aa/128
2603:1020:201::581/128
2603:1020:201::583/128
2603:1020:201::584/128
2603:1020:201::586/128
2603:1020:201::588/128
2603:1020:201::589/128
2603:1020:201::58a/128
2603:1020:201::58b/128
2603:1020:201::58c/128
2603:1020:201:2::/64
2603:1020:201:3::/64
2603:1030:7::2c/128
2603:1030:7::2d/128
2603:1030:7::2f/128
2603:1030:7::30/128
2603:1030:7::34/128
2603:1030:7::3f/128
2603:1030:7::40/128
2603:1030:7::41/128
2a01:111:2005:6::/64
2a01:111:f100:1002::4134:d89f/128
2a01:111:f100:1002::4134:d944/128
2a01:111:f100:1002::4134:d95f/128
2a01:111:f100:1002::4134:da55/128
2a01:111:f100:1002::4134:da5c/128
2a01:111:f100:1002::4134:da81/128
2a01:111:f100:1002::4134:dab5/128
2a01:111:f100:1002::4134:daee/128
2a01:111:f100:1002::4134:db2a/128
2a01:111:f100:1002::4134:db60/128
2a01:111:f100:1002::4134:db89/128
2a01:111:f100:1002::4134:dbe7/128
2a01:111:f100:1002::4134:dc2d/128
2a01:111:f100:1002::4134:dc2e/128
2a01:111:f100:1002::4134:dc43/128
2a01:111:f100:1002::4134:dc6e/128
2a01:111:f100:1002::4134:dd7a/128
2a01:111:f100:1002::4134:ddcb/128
2a01:111:f100:2002::8975:2c3b/128
2a01:111:f100:2002::8975:2c3f/128
2a01:111:f100:2002::8975:2c6d/128
2a01:111:f100:2002::8975:2cdd/128
2a01:111:f100:2002::8975:2cea/128
2a01:111:f100:2002::8975:2ced/128
2a01:111:f100:2002::8975:2d08/128
2a01:111:f100:2002::8975:2d19/128
2a01:111:f100:2002::8975:2d25/128
2a01:111:f100:2002::8975:2d4d/128
2a01:111:f100:2002::8975:2d6a/128
2a01:111:f100:2002::8975:2d97/128
2a01:111:f100:2002::8975:2daa/128
2a01:111:f100:2002::8975:2dc7/128
2a01:111:f100:3002::8987:30a0/128
2a01:111:f100:3002::8987:3103/128
2a01:111:f100:3002::8987:3278/128
2a01:111:f100:3002::8987:328f/128
2a01:111:f100:3002::8987:3299/128
2a01:111:f100:3002::8987:3344/128
2a01:111:f100:3002::8987:3396/128
2a01:111:f100:3002::8987:3398/128
2a01:111:f100:3002::8987:33b3/128
2a01:111:f100:3002::8987:33ec/128
2a01:111:f100:3002::8987:34eb/128
2a01:111:f100:3002::8987:34f8/128
2a01:111:f100:3002::8987:353b/128
2a01:111:f100:3002::8987:35b5/128
2a01:111:f100:4001::4625:a3ee/128
2a01:111:f100:4001::4625:a4b6/128
2a01:111:f100:4001::4625:a4ba/128
2a01:111:f100:4001::4625:a4c7/128
2a01:111:f100:4001::4625:a4cf/128
2a01:111:f100:4001::4625:a4ee/128
2a01:111:f100:4001::4625:a56f/128
2a01:111:f100:4001::4625:a589/128
2a01:111:f100:7000::6fdd:6a44/128
2a01:111:f100:7000::6fdd:6b96/128
2a01:111:f100:7000::6fdd:6bb6/128
2a01:111:f100:7000::6fdd:6c82/128
2a01:111:f100:7000::6fdd:6d1c/128
2a01:111:f100:7000::6fdd:6d23/128
2a01:111:f100:7000::6fdd:6d50/128
2a01:111:f100:7000::6fdd:6d88/128
2a01:111:f100:a004::bfeb:8a92/128
2a01:111:f100:a004::bfeb:8ab0/128
2a01:111:f100:a004::bfeb:8b12/128
2a01:111:f100:a004::bfeb:8b15/128
2a01:111:f100:a004::bfeb:8b3c/128
2a01:111:f100:a004::bfeb:8b47/128
2a01:111:f100:a004::bfeb:8b6c/128
2a01:111:f100:a004::bfeb:8beb/128
2a01:111:f100:a004::bfeb:8c55/128
2a01:111:f100:a004::bfeb:8c6d/128
2a01:111:f100:a004::bfeb:8c6f/128
2a01:111:f100:a004::bfeb:8c88/128
2a01:111:f100:a004::bfeb:8cc0/128
2a01:111:f100:a004::bfeb:8cdc/128
2a01:111:f100:a004::bfeb:8d83/128
2a01:111:f100:a004::bfeb:8d96/128
2a01:111:f100:a004::bfeb:8daa/128
2a01:111:f102:8001::1761:4929/128
2a01:111:f102:8001::1761:4948/128
2a01:111:f102:8001::1761:4b83/128
2a01:111:f102:8001::1761:4f0d/128
2a01:111:f102:8001::1761:4f32/128
2a01:111:f102:8001::1761:4f64/128
2a01:111:f102:8001::1761:4f8d/128
2a01:111:f102:8001::1761:4fc0/128
2a01:111:f400::/48
2001:df0:d9:200::/64
2603:1047:100::/64
2a01:111:2035:8::/64
2a01:111:200a:a::/64
2a01:111:f406:1::/64
2a01:111:f406:2::/64
2a01:111:f406:1004::/64
2a01:111:f406:1805::/64
2a01:111:f406:3404::/64
2A01:111:F406:8000::/64
2a01:111:f406:8801::/64
2a01:111:f406:a003::/64
2A01:111:F406:C00::/64

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Office Online

To use Office Online, you must be able to connect to the endpoints marked required below.

Office Online is only available in the browser and requires the authenticated user to be passed.

Row

Purpose

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Office Online

*broadcast.officeapps.live.com

*excel.officeapps.live.com

*onenote.officeapps.live.com

*powerpoint.officeapps.live.com

*view.officeapps.live.com

*visio.officeapps.live.com

*word-edit.officeapps.live.com

*word-view.officeapps.live.com

No

Yes

Office Online IP Ranges.

TCP 443

3

Required: Content Delivery Network for Office Web Apps

*.cdn.office.net

contentstorage.osi.office.net

Yes

No

N/A

TCP 443

Note: The wildcards under the officeapps.live.com namespace, such as *visio.officeapps.live.com represents a 20+ list of regional nodes that are subject to change as the service expands.

Note: ExpressRoute for Office 365 currently does not support IPv6

Office Web Apps IPv4 endpoints routable through the Internet and ExpressRoute

Office Web Apps IPv6 endpoints routable through the Internet only

13.69.187.20/32
13.70.184.242/32
13.71.155.176/32
13.75.153.216/32
13.76.140.48/32
13.78.114.39/32
13.85.84.102/32
13.88.248.161/32
13.88.254.212/32
13.107.6.171/32
13.107.6.172/32
23.98.219.76/32
40.68.166.51/32
40.71.251.78/32
40.74.130.243/32
40.74.138.42/32
40.86.230.88/32
40.87.61.217/32
40.114.192.209/32
40.117.226.146/32
40.126.236.216/32
40.127.79.139/32
51.140.46.128/32
51.140.46.150/32
51.141.1.194/32
51.141.8.160/32
52.108.0.0/14
52.164.242.47/32
52.169.109.48/32
52.172.12.123/32
52.172.13.171/32
52.172.152.100/32
52.172.153.104/32
52.174.190.59/32
52.175.25.142/32
52.232.128.169/32
104.40.225.204/32
104.41.62.54/32
104.214.38.136/32
104.215.194.17/32
137.116.172.39/32
137.135.65.72/32
191.235.84.172/32
191.235.87.181/32
191.237.40.220/32
2603:1020:201::37/128
2603:1020:201:9::c6/128
2603:1030:1000::1d/128
2603:1030:f00::17/128
2603:1040:200::5dc/128
2603:1040:401::762/128
2603:1040:601::60f/128
2603:1040:a01::1e/128
2603:1040:c01::28/128
2603:1050:1::cd/128
2620:1ec:a92::171/128
2a01:111:f100:2002::8975:2d79/128
2a01:111:f100:2002::8975:2da8/128
2a01:111:f100:4001::4625:a1c3/128
2a01:111:f100:4001::4625:a419/128
2a01:111:f100:7000::6fdd:6cd5/128
2a01:111:f100:a004::bfeb:8ba7/128

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Exchange Online

To use Exchange Online, including mail retrieval, OWA, Unified Messaging, and so on, you must be able to connect to the endpoints marked required below. If your organization uses Exchange Hybrid, Delve, or is migrating email to Office 365, you'll find the associated endpoints below. All IP addresses entered directly in the Destination IP column are also listed in the IP tables and XML file for your convenience.

Row

Purpose

Source | Credentials

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Exchange Online Protection SMTP services

See Exchange Online Protection (EOP)

3

Required: Client SMTP Relay

Client Computer | Logged on user

smtp.office365.com

No

Yes

Exchange Online IP ranges.

TCP 587

4

Required: Exchange Online (including OWA, Outlook, and so on).

Client or Server / logged on user

outlook.office365.com

*.outlook.office.com

autodiscover-*.outlook.com

No

Yes

Exchange Online IP ranges.

TCP 80 & 443

5

Required: Exchange Online (including OWA, Outlook, Autodiscover, and so on).

Client or Server / logged on user

*.outlook.com

No

Yes

Exchange Online IP ranges.

TCP 80 & 443

6

Required: Exchange Online (including OWA, Outlook, and so on).

Client or Server / logged on user

xsi.outlook.com

r1.res.office365.com

r3.res.office365.com

r4.res.office365.com

Yes

No

N/A

TCP 80 & 443

7

Optional: Exchange Online Unified Messaging/SBC integration.

On-premises Session Border Controller

*.um.outlook.com

No

No

65.55.94.0/25    
207.46.198.0/25  
213.199.177.0/26   
157.55.9.128/25  
111.221.66.0/25  
207.46.58.128/25

Any-TCP/UDP

(Bidirectional for inbound, calls , MWI)

8

Optional: Exchange Hybrid Only

Existing Exchange Client Access Servers and Mailbox Servers | Machine account1

outlook.office365.com

*.outlook.office.com

No

Yes

Exchange Online IP ranges.

TCP 80 & 443

9

Optional: Exchange Hybrid Co-existence

Exchange Online IP ranges | N/A

Customer on-premises Exchange

No

Yes

Customer IP

TCP 443

10

Optional: Exchange Hybrid Proxy Authentication

Exchange Online IP ranges | N/A

Customer on-premises STS

No

Yes

Customer IP

TCP 443 (+ TCP 49443 for cert based authentication)

11

Optional: Used to configure Exchange Hybrid, using the Exchange Hybrid Configuration Wizard.

Note: These endpoints are only required to configure Exchange hybrid. Rows 8-10 describe the ongoing traffic.

Existing Exchange service | N/A

*.store.core.windows.net

mshrcstorageprod.blob.core.windows.net

No

No

N/A

TCP 80 & 443

12

Optional: Used to configure Exchange Hybrid, using the Exchange Hybrid Configuration Wizard.

Note: These endpoints are only required to configure Exchange hybrid. Rows 8-10 describe the ongoing traffic.

Existing Exchange service | N/A

domains.live.com2

No

Yes

40.118.209.192/32
168.62.190.41/32

TCP 80 & 443

13

Optional: Exchange Online IMAP4 migration

IMAP4 Service | N/A

outlook.office365.com

*.outlook.office.com

No

Yes

Exchange Online IP ranges.

TCP 143/993

14

Optional: Exchange Online POP3 migration

POP3 Service | N/A

outlook.office365.com

*.outlook.office.com

No

Yes

Exchange Online IP ranges.

TCP 995

15

Optional: All other Exchange Online migration tools

Existing Exchange service (EWS or MRS) | N/A

outlook.office365.com

*.outlook.office.com

No

Yes

Exchange Online IP ranges.

TCP 80 & 443

1Keep in mind that Machine accounts won’t work with proxies that require outbound authentication.

2 Only required for Exchange 2010 SP3 Hybrid Configuration Wizard.

Note: ExpressRoute for Office 365 currently does not support IPv6

Exchange Online IPv4 endpoints routable through the Internet and ExpressRoute

Exchange Online IPv6 endpoints routable through the Internet only

13.107.6.152/31
13.107.9.152/31
13.107.18.10/31
13.107.19.10/31
23.103.160.0/20
23.103.224.0/19
40.96.0.0/13
40.104.0.0/15
70.37.151.128/25
111.221.112.0/21
131.253.33.215/32
132.245.0.0/16
134.170.68.0/23
157.56.96.16/28
157.56.96.224/28
157.56.106.128/28
157.56.232.0/21
157.56.240.0/20
191.232.96.0/19
191.234.6.152/32
191.234.140.0/22
191.234.224.0/22
204.79.197.215/32
206.191.224.0/19
207.46.150.128/25
207.46.203.128/26
2603:1006::/40
2603:1016::/40
2603:1020:0800::/40
2603:1026::/40
2603:1026:0200::/39
2603:1026:0400::/39
2603:1026:0600::/40
2603:1026:0800::/40
2603:1036::/39
2603:1036:0200::/40
2603:1036:0400::/40
2603:1036:0600::/40
2603:1036:0800::/38
2603:1036:0c00::/40
2603:1046::/37
2603:1046:0900::/40
2603:1056::/40
2603:1056:0400::/40
2603:1056:0600::/40
2603:1096::/38
2603:1096:0400::/40
2603:1096:0600::/40
2603:1096:0c00::/40
2603:1096:a00::/39
2603:10a6:0200::/40
2603:10a6:0400::/40
2603:10a6:0600::/40
2603:10a6:0800::/40
2603:10d6:0200::/40
2620:1ec:4::152/128
2620:1ec:4::153/128
2620:1ec:a92::152/128
2620:1ec:a92::153/128
2620:1ec:c::10/128
2620:1ec:c::11/128
2620:1ec:d::10/128
2620:1ec:d::11/128
2a01:111:f400::/48

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Exchange Online Protection (EOP)

To use Exchange Online Protection as a stand alone service or as the SMTP engine with Exchange Online, you must be able to connect to the endpoints marked required below. Note the EOP SMTP IP addresses are linked to in row 2, 3, & 4 instead of being listed directly on this page.

Row

Purpose

Source | Credentials

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: EOP

Client or Server / logged on user

*.protection.outlook.com

No

Yes

See Exchange Online Protection IP Addresses

TCP 53 & 443

3

Required: Send SMTP email

Existing email environment | N/A

<customer domain-key>.mail.protection.outlook.com

No

Yes

See Exchange Online Protection IP Addresses

TCP 25

4

Required: Receive SMTP email

See Exchange Online Protection IP Addresses | N/A

Customer email environment

No

Yes

Customer email environment

TCP 25

Note: The wildcard in the second row of the EOP table represents a long list of nodes that are exclusively used for Exchange Online Protection. No other commercial or consumer services use this namespace.

Skype for Business Online

To use Skype for Business online, ensure both the FQDN and IP Address endpoints listed in the Skype for Business Online tables below are reachable. These tables are updated regularly as Microsoft works to build out its network to increase reliability and performance. Please be sure to subscribe to changes in this documentation to insure changes are incorporated in your networking configuration.

The IP Address endpoints listed in the Skype for Business online IP Addresses includes IP’s required for both Skype for Business online and Teams. If your company also wants to use Microsoft Teams, there is no extra work required as long as you whitelist all the IPs in this section. The FQDN endpoints listed in the Skype for Business online FQDNs only covers those FQDNs that are required for Skype for Business online. If your company wants to use Microsoft Teams, you need to add the FQDNs for Microsoft Teams listed in the Microsoft Teams section

To use Skype for Business Online, you must first enable endpoints for authentication as well as the Office 365 portal and shared service. These are rows number one and two respectively. You must also ensure the endpoints in the Skype for Business Online FQDN and IP Address tables are reachable. To see the IP addresses, expand the IP address section below the table describing the traffic flow.

Row

Purpose

Source | Credentials

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Authentication and identity

See Office 365 authentication and identity

2

Required: Portal and shared

See Office 365 portal and shared

3

Required: Skype for Business. Including SIP signaling, Persistent Shared Object Model (PSOM) connections web conferencing, HTTPS downloads, and Call Quality Dashboard

Client Computer | Logged on user

*.lync.com

*.cqd.lync.com

*.infra.lync.com

*.online.lync.com

*.resources.lync.com

*.config.skype.com

*.skypeforbusiness.com

*.pipe.aria.microsoft.com

config.edge.skype.com

pipe.skype.com

No

Yes

Skype for Business IP ranges.

TCP 443

4

Required: Audio, Video, & Desktop sharing

Client Computer | Logged on user

*.lync.com

No

Yes

Skype for Business IP ranges.

TCP 443, UDP 3478, 3479, 3480, & 3481

Optional: TCP & UDP 50,000-59,999

5

Required: Lync Mobile push notifications for Lync Mobile 2010 on iOS devices. You don't need this for Android, Nokia Symbian or Windows Phone mobile devices.

Client Computer | Logged on user

*.lync.com

No

Yes

Skype for Business IP ranges.

TCP 5223

6

Required: Skype for Business CDNs

Client Computer | Logged on user

*.sfbassets.com

*.urlp.sfbassets.com

skypemaprdsitus.trafficmanager.net

*.azureedge.net

Yes

No

N/A

TCP 80 & 443

7

Required: Skype client quicktips & OWA integration

Client Computer | Logged on user

quicktips.skypeforbusiness.com

swx.cdn.skype.com

No

No

N/A.

TCP 443

8

Optional: Federation with Skype and public IM connectivity: Contact picture retrieval

Client Computer | Logged on user

*.api.skype.com

*.users.storage.live.com

skypegraph.skype.com

No

No

SkypeGraph.skype.com IP range information

TCP 443

To use Skype Meeting Broadcast, the following endpoints need to be accessible to client computers.

Row

Purpose

Source |Credentials

Destination

CDN

ExpressRoute for Office 365

Destination IP

Destination Port

1

Required: Skype for Business endpoints.

See Skype for Business Online and ensure all entries labeled "required" are accessible.

2

Required: Skype Meeting Broadcast presenter and attendee

Client computer / logged on user

broadcast.skype.com

*.broadcast.skype.com1

browser.pipe.aria.microsoft.com

No

Yes

Skype for Business IP ranges.

TCP 443

aka.ms

amp.azure.net

No

No

N/A

TCP 443

3

Required: Skype Meeting Broadcast presenter and attendee

Client computer / logged on user

mlccdn.blob.core.windows.net

ajax.aspnetcdn.com

*.msecnd.net2

*.streaming.mediaservices.windows.net3

*.keydelivery.mediaservices.windows.net3

Yes

No

N/A

TCP 443

1 The wildcard for lync.com and broadcast.skype.com represents a long list of nodes that are exclusively used for Office 365.

2 The wildcard for msecnd.net represents a dynamically generated endpoint within the CDN that join page libraries are pulled from.

3 The wildcards for mediaservices.windows.net represents a list of media services endpoints associated with Azure Media Services where video content is pulled from. These endpoints are available via the internet and Azure Public peering.

Note: The wildcard for lync.com and broadcast.skype.com represents a long list of nodes that are exclusively used for Office 365.

Note: ExpressRoute for Office 365 currently does not support IPv6

Skype for Business Online IPv4 endpoints routable through the Internet and ExpressRoute

Skype for Business Online IPv6 endpoints routable through the Internet only

13.64.106.229/32
13.64.240.95/32
13.67.56.225/32
13.67.109.136/32
13.67.180.128/32
13.67.186.105/32
13.67.209.156/32
13.67.214.76/32
13.67.222.144/32
13.68.31.102/32
13.70.89.162/32
13.70.156.147/32
13.70.159.107/32
13.70.186.54/32
13.73.109.13/32
13.73.155.42/32
13.74.146.183/32
13.75.42.168/32
13.75.120.15/32
13.75.120.61/32
13.75.125.228/32
13.75.126.46/32
13.75.127.250/32
13.75.154.195/32
13.75.159.17/32
13.75.159.51/32
13.76.188.52/32
13.76.189.79/32
13.76.241.210/32
13.77.1.253/32
13.77.7.84/32
13.78.59.246/32
13.78.93.8/32
13.78.94.7/32
13.78.95.252/32
13.78.112.190/32
13.79.153.60/32
13.79.161.153/32
13.79.234.229/32
13.88.183.247/32
13.88.241.210/32
13.89.44.84/32
13.91.40.251/32
13.91.106.134/32
13.91.108.91/32
13.91.252.242/32
13.92.80.132/32
13.92.136.118/32
13.93.149.3/32
13.93.156.214/32
13.93.167.93/32
13.93.209.18/32
13.94.47.37/32
13.95.88.228/32
13.95.233.176/32
13.95.234.10/32
13.95.236.192/32
13.107.3.0/24
13.107.8.0/24
13.107.17.0/24
13.107.64.0/18
13.107.242.0/24
23.97.72.141/32
23.97.75.102/32
23.97.78.16/32
23.97.164.28/32
23.99.101.49/32
23.99.101.118/32
23.99.112.73/32
23.99.113.23/32
23.99.113.163/32
23.99.115.104/32
23.99.121.38/32
23.99.121.255/32
23.99.122.87/32
23.99.124.9/32
23.99.195.117/32
23.101.61.176/32
23.101.112.170/32
23.101.115.193/32
23.103.128.0/23
23.103.130.0/24
23.103.176.128/26
23.103.176.192/27
23.103.178.128/26
23.103.178.192/27
40.68.225.164/32
40.68.250.216/32
40.68.251.17/32
40.69.45.108/32
40.69.210.145/32
40.74.62.125/32
40.74.84.253/32
40.74.113.62/32
40.74.127.186/32
40.74.128.205/32
40.74.129.215/32
40.74.130.253/32
40.74.143.94/32
40.76.24.32/32
40.76.24.177/32
40.76.77.68/32
40.77.16.36/32
40.78.68.158/32
40.78.71.48/32
40.78.98.202/32
40.78.146.128/32
40.79.38.101/32
40.79.41.254/32
40.79.74.185/32
40.79.82.21/32
40.83.17.24/32
40.83.121.219/32
40.83.124.144/32
40.83.176.46/32
40.83.177.162/32
40.83.183.236/32
40.84.28.125/32
40.86.90.132/32
40.86.92.191/32
40.112.188.2/32
40.113.16.205/32
40.113.87.220/32
40.113.136.240/32
40.114.149.220/32
40.114.244.22/32
40.115.1.44/32
40.115.74.171/32
40.117.100.83/32
40.117.145.132/32
40.118.169.78/32
40.118.214.164/32
40.118.251.206/32
40.118.253.51/32
40.121.200.212/32
40.121.221.52/32
40.122.44.96/32
40.122.165.60/32
40.122.168.86/32
40.123.43.195/32
40.123.50.17/32
40.126.239.210/32
40.126.251.57/32
40.127.129.109/32
40.127.169.165/32
51.140.51.73/32
51.140.53.252/32
51.140.55.82/32
51.140.62.120/32
51.140.79.167/32
51.140.126.38/32
51.140.183.120/32
51.141.5.99/32
51.141.9.8/32
51.141.12.151/32
51.141.13.77/32
51.141.28.50/32
51.141.42.151/32
51.141.49.0/32
52.112.0.0/14
52.160.110.94/32
52.163.112.45/32
52.163.114.181/32
52.163.115.44/32
52.163.118.82/32
52.163.224.242/32
52.163.225.1/32
52.163.229.196/32
52.163.230.187/32
52.163.231.50/32
52.163.231.126/32
52.164.253.101/32
52.164.255.104/32
52.165.35.53/32
52.165.45.77/32
52.165.150.215/32
52.166.61.83/32
52.169.9.241/32
52.169.10.109/32
52.169.30.95/32
52.169.67.1/32
52.169.104.89/32
52.169.105.194/32
52.169.105.219/32
52.169.106.115/32
52.169.154.144/32
52.169.190.101/32
52.172.53.101/32
52.172.54.196/32
52.172.55.238/32
52.173.190.229/32
52.174.144.192/32
52.174.150.25/32
52.174.166.73/32
52.174.166.107/32
52.174.166.156/32
52.174.186.47/32
52.175.24.155/32
52.175.33.58/32
52.175.37.105/32
52.175.38.240/32
52.177.186.61/32
52.177.186.70/32
52.177.186.78/32
52.178.25.175/32
52.178.34.159/32
52.178.36.12/32
52.178.36.169/32
52.178.38.115/32
52.178.108.202/32
52.178.114.127/32
52.178.145.227/32
52.178.148.1/32
52.178.148.152/32
52.178.158.225/32
52.178.179.194/32
52.178.186.230/32
52.178.198.107/32
52.179.139.166/32
52.179.142.102/32
52.183.117.84/32
52.185.146.154/32
52.185.151.102/32
52.187.6.119/32
52.187.79.90/32
52.187.117.218/32
52.187.123.78/32
52.187.126.35/32
52.187.135.79/32
52.225.131.249/32
52.232.76.40/32
52.232.78.53/32
52.232.129.71/32
52.232.132.60/32
52.232.135.81/32
52.233.128.227/32
52.233.29.169/32
52.233.30.121/32
65.55.127.0/24
66.119.157.192/26
66.119.158.0/25
104.40.82.150/32
104.40.91.215/32
104.40.189.177/32
104.41.151.83/32
104.41.207.112/32
104.41.208.54/32
104.41.210.140/32
104.42.228.150/32
104.42.229.230/32
104.43.12.164/32
104.44.195.0/24
104.44.200.0/23
104.45.18.178/32
104.45.231.95/32
104.45.231.155/32
104.46.62.41/32
104.46.96.162/32
104.46.97.194/32
104.46.101.116/32
104.46.105.95/32
104.47.151.128/32
104.208.28.54/32
104.208.31.113/32
104.208.152.137/32
104.209.188.207/32
104.210.1.218/32
104.210.9.95/32
104.210.80.193/32
104.211.162.59/32
104.211.165.113/32
104.211.165.216/32
111.221.76.128/25
111.221.77.0/26
111.221.101.75/32
111.221.122.192/26
131.253.128.0/19
131.253.160.0/20
132.245.0.0/24
132.245.1.0/25
132.245.112.0/24
132.245.113.0/25
134.170.0.0/25
134.170.54.0/26
134.170.54.128/25
134.170.113.192/26
134.170.115.128/25
137.116.66.252/32
137.116.132.4/32
137.116.157.126/32
137.116.159.19/32
137.116.159.228/32
137.116.248.105/32
137.117.109.221/32
137.117.128.25/32
157.55.40.128/25
157.55.238.0/25
157.56.176.68/32
168.61.145.101/32
168.61.152.29/32
168.61.155.249/32
168.63.14.15/32
168.63.204.74/32
168.63.219.57/32
168.63.245.120/32
191.237.44.60/32
207.46.5.0/24
207.46.155.141/32
207.46.156.136/32
207.46.230.50/32
2603:1027::/48
2603:1029:100::/48
2603:1037::/48
2603:1039:100::/48
2603:1047::/48
2603:1049:100::/48
2603:1057::/48
2620:1ec:6::/48 
2620:01ec:0042::/48
2620:1ec:40::/42
2a01:111:2047:2::/64
2a01:111:2047:1::/64
2a01:111:2048:2::/64
2a01:111:2048:1::/64
2a01:111:f406:3406::/64
2a01:111:f406:3405::/64
2a01:111:200f:11::/64
2a01:111:200f:10::/64
2a01:111:2007:3::/64
2a01:111:2007:4::/64
2a01:111:200f:6::/64
2a01:111:200f:7::/64 
2a01:111:200f:8::/64
2a01:111:200f:9::/64
2a01:111:2012:2::/64 
2a01:111:2012:3::/64
2a01:111:2012:4::/64
2a01:111:2012:5::/64
2a01:111:2012:6::/64
2a01:111:2012:7::/64
2a01:111:202a:2::/64
2a01:111:202a:3::/64
2a01:111:202b:3::/64
2a01:111:202b:4::/64
2a01:111:202b:9::/64
2a01:111:202b:a::/64
2a01:111:202f::/48
2a01:111:2034:2::/64
2a01:111:2034:3::/64
2a01:111:2035:6::/64
2a01:111:2035:7::/64
2a01:111:2036:2::/64
2a01:111:2036:3::/64
2a01:111:203e:1::/64
2a01:111:203e:2::/64
2a01:111:2040:1::/64
2a01:111:2040:2::/64
2a01:111:2046:4::/64
2a01:111:2046:5::/64
2a01:111:2a:7::/64
2a01:111:2a:8::/64
2a01:111:f402:5802::/64
2a01:111:f402:5803::/64
2a01:111:f402:5805::/64
2a01:111:f404:0c06::/64
2a01:111:f404:0c07::/64
2a01:111:f404:0c09::/64
2a01:111:f404:0c0a::/64
2a01:111:f404:3400::/64
2a01:111:f404:3401::/64
2a01:111:f404:8002::/64
2a01:111:f404:8003::/64
2a01:111:f404:9400::/64
2a01:111:f404:9401::/64
2a01:111:f404:a000::/64
2a01:111:f404:a001::/64
2a01:111:f404:a800::/64
2a01:111:f404:a801::/64
2a01:111:f404:c0b::/64
2a01:111:f404:c0c::/64
2a01:111:f406:2400::/64
2a01:111:f406:2401::/64
2a01:111:f406:402::/64
2a01:111:f406:403::/64

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Microsoft Teams

To use Microsoft Teams, ensure both the FQDN and IP Address endpoints listed in the Microsoft Teams tables below are reachable. These tables are updated regularly as Microsoft works to build out its network to increase reliability and performance. Please be sure to subscribe to changes in this documentation to insure changes are incorporated in your networking configuration.

Row

Purpose

Source |Credentials

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Authentication and identity

See Office 365 authentication and identity

2

Required: Microsoft Teams.

Client or Server / logged on user

*.teams.skype.com

*.teams.microsoft.com

teams.microsoft.com

No

Yes

Microsoft Teams IP ranges.

TCP 80 & 443

3

Required: Microsoft Teams collaboration

Client or Server / logged on user

*.conv.skype.com1

*.asm.skype.com1

*.cc.skype.com1

*.msg.skype.com1

*.dc.trouter.io1

prod.registrar.skype.com

prod.tpc.skype.com

No

Yes

Microsoft Teams IP ranges.

TCP 443

4

Required: Microsoft Teams media

Client or Server / logged on user

These IPs are used by media without explicit FQDN mappings.

No

Yes

13.107.3.0/24
13.107.8.0/24
13.107.17.0/24
13.107.64.0/24
13.107.65.0/24
13.107.242.0/24
52.114.60.0/22
52.114.124.0/22
52.114.188.0/22
52.114.220.0/22
104.44.195.0/24
104.44.200.0/24
104.44.201.0/24

TCP 443

UDP 3478-3481

5

Required: Microsoft Teams shared services

Client or Server / logged on user

config.edge.skype.com

*.config.skype.com

*.pipe.skype.com

*.pipe.aria.microsoft.com

pipe.skype.com

s-0001.s-msedge.net

s-0004.s-msedge.net

scsinstrument-ss-us.trafficmanager.net

scsquery-ss-us.trafficmanager.net

scsquery-ss-eu.trafficmanager.net

scsquery-ss-asia.trafficmanager.net

No

Yes

Microsoft Teams IP ranges.

TCP 443

6

Required: Microsoft Teams shared services

Client or Server / logged on user

*.msedge.net

compass-ssl.microsoft.com

feedback.skype.com

No

No

N/A

TCP 443

7

Required: Microsoft Teams shared services

Client or Server / logged on user

*.secure.skypeassets.com

mlccdnprod.azureedge.net

videoplayercdn.osi.office.net

Yes

No

N/A

TCP 443

8

Optional: Messaging interop with Skype for Business

Client or Server / logged on user

*.lync.com

*.infra.lync.com

*.online.lync.com

*.resources.lync.com

*.skypeforbusiness.com

No

Yes

Skype for Business IP ranges.

TCP 443

9

Optional: Messaging interop with Skype for Business

Client or Server / logged on user

skypemaprdsitus.trafficmanager.net

swx.cdn.skype.com

latest-swx.cdn.skype.com

*.sfbassets.com

*.azureedge.net

Yes

No

N/A

TCP 443

10

Optional: Skype Graph

Client or Server / logged on user

skypegraph.skype.com

No

No

SkypeGraph.skype.com IP range information

TCP 443

11

Optional: Microsoft Teams third-party integrations

Client or Server / logged on user

*.giphy.com

N/A

No

N/A

TCP 443

1 These wildcards represent regional installations of these services.

Microsoft Teams IPv4 endpoints routable through the Internet and ExpressRoute

Microsoft Teams IPv6 endpoints routable through the Internet only

13.64.106.229/32
13.64.240.95/32
13.67.56.225/32
13.67.109.136/32
13.67.180.128/32
13.67.186.105/32
13.67.209.156/32
13.67.214.76/32
13.67.222.144/32
13.68.31.102/32
13.70.89.162/32
13.70.156.147/32
13.70.159.107/32
13.70.186.54/32
13.73.109.13/32
13.73.155.42/32
13.74.146.183/32
13.75.42.168/32
13.75.120.15/32
13.75.120.61/32
13.75.125.228/32
13.75.126.46/32
13.75.127.250/32
13.75.154.195/32
13.75.159.17/32
13.75.159.51/32
13.76.188.52/32
13.76.189.79/32
13.76.241.210/32
13.77.7.84/32
13.78.93.8/32
13.78.94.7/32
13.78.95.252/32
13.78.112.190/32
13.79.153.60/32
13.79.161.153/32
13.79.234.229/32
13.88.183.247/32
13.89.44.84/32
13.91.40.251/32
13.91.106.134/32
13.91.108.91/32
13.91.252.242/32
13.93.149.3/32
13.93.156.214/32
13.93.209.18/32
13.94.47.37/32
13.95.88.228/32
13.95.234.10/32
13.95.236.192/32
13.107.3.0/24
13.107.8.0/24
13.107.17.0/24
13.107.64.0/18
13.107.242.0/24
23.97.72.141/32
23.97.75.102/32
23.97.78.16/32
23.99.101.49/32
23.99.101.118/32
23.99.112.73/32
23.99.113.23/32
23.99.113.163/32
23.99.115.104/32
23.99.121.38/32
23.99.121.255/32
23.99.122.87/32
23.99.124.9/32
23.99.195.117/32
23.101.61.176/32
23.101.112.170/32
23.101.151.89/32
23.102.24.114/32
40.68.225.164/32
40.68.250.216/32
40.68.251.17/32
40.69.45.108/32
40.69.210.145/32
40.74.62.125/32
40.74.113.62/32
40.74.127.186/32
40.74.129.215/32
40.74.130.253/32
40.74.143.94/32
40.76.24.177/32
40.76.77.68/32
40.77.16.36/32
40.78.68.158/32
40.78.71.48/32
40.78.98.202/32
40.78.146.128/32
40.79.38.101/32
40.79.41.254/32
40.79.74.185/32
40.79.82.21/32
40.83.17.24/32
40.83.121.219/32
40.83.124.144/32
40.83.176.46/32
40.83.177.162/32
40.83.183.236/32
40.84.28.125/32
40.86.90.132/32
40.86.92.191/32
40.113.87.220/32
40.113.136.240/32
40.114.149.220/32
40.114.244.22/32
40.115.1.44/32
40.117.100.83/32
40.117.145.132/32
40.118.169.78/32
40.118.214.164/32
40.118.253.51/32
40.121.221.52/32
40.122.44.96/32
40.122.165.60/32
40.122.168.86/32
40.123.43.195/32
40.123.50.17/32
40.126.239.210/32
40.127.129.109/32
40.127.169.165/32
51.140.51.73/32
51.140.55.82/32
51.140.62.120/32
51.140.79.167/32
51.140.126.38/32
51.141.12.151/32
51.141.13.77/32
51.141.28.50/32
51.141.42.151/32
51.141.49.0/32
52.112.0.0/14
52.160.110.94/32
52.163.112.45/32
52.163.114.181/32
52.163.115.44/32
52.163.118.82/32
52.163.224.242/32
52.163.225.1/32
52.163.229.196/32
52.163.230.187/32
52.163.231.50/32
52.163.231.126/32
52.164.253.101/32
52.164.255.104/32
52.165.35.53/32
52.165.45.77/32
52.165.150.215/32
52.166.61.83/32
52.169.9.241/32
52.169.10.109/32
52.169.30.95/32
52.169.67.1/32
52.169.104.89/32
52.169.105.194/32
52.169.105.219/32
52.169.106.115/32
52.169.190.101/32
52.172.53.101/32
52.174.144.192/32
52.174.150.25/32
52.174.166.73/32
52.174.166.107/32
52.174.166.156/32
52.174.186.47/32
52.175.24.155/32
52.175.33.58/32
52.175.37.105/32
52.175.38.240/32
52.177.186.61/32
52.177.186.70/32
52.177.186.78/32
52.178.25.175/32
52.178.34.159/32
52.178.36.12/32
52.178.36.169/32
52.178.38.115/32
52.178.108.202/32
52.178.114.127/32
52.178.145.227/32
52.178.148.1/32
52.178.148.152/32
52.178.158.225/32
52.178.179.194/32
52.178.186.230/32
52.178.198.107/32
52.179.139.166/32
52.179.142.102/32
52.183.117.84/32
52.185.146.154/32
52.187.79.90/32
52.187.117.218/32
52.187.123.78/32
52.187.126.35/32
52.187.135.79/32
52.225.131.249/32
52.232.76.40/32
52.232.78.53/32
52.233.29.169/32
52.233.30.121/32
104.40.82.150/32
104.40.91.215/32
104.40.189.177/32
104.41.151.83/32
104.41.208.54/32
104.41.210.140/32
104.42.228.150/32
104.42.229.230/32
104.44.195.0/24
104.44.200.0/23
104.45.18.178/32
104.45.231.95/32
104.45.231.155/32
104.46.62.41/32
104.46.96.162/32
104.46.97.194/32
104.46.101.116/32
104.46.105.95/32
104.47.151.128/32
104.208.28.54/32
104.208.31.113/32
104.208.152.137/32
104.209.188.207/32
104.210.1.218/32
104.210.9.95/32
104.211.165.216/32
111.221.101.75/32
137.116.66.252/32
137.116.132.4/32
137.116.157.126/32
137.116.159.19/32
137.116.159.228/32
137.116.248.105/32
137.117.109.221/32
137.117.128.25/32
157.56.176.68/32
168.61.145.101/32
168.61.152.29/32
168.61.155.249/32
168.63.245.120/32
191.237.44.60/32
207.46.155.141/32
2603:1027::/48
2603:1029:100::/48
2603:1037::/48
2603:1039:100::/48
2603:1047::/48
2603:1049:100::/48
2603:1057::/48
2620:1ec:6::/48
2620:1ec:40::/42
2a01:111:202f::/48

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

SharePoint Online and OneDrive for Business

To use SharePoint Online or OneDrive for Business, you must be able to connect to the endpoints marked required below. If your organization uses Exchange Hybrid, Delve, or is migrating email to Office 365, you'll find the associated endpoints below.

Row

Purpose

Source | Credentials

Destination

CDN

ExpressRoute for Office 365 BGP Communities

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Office Online

See Office Online

3

Required: SharePoint Online and associated applications

Client or Server / logged on user

*.sharepoint.com

<tenant>.sharepoint.com1

<tenant>-my.sharepoint.com1

<tenant>-files.sharepoint.com1

<tenant>-myfiles.sharepoint.com1

*.svc.ms

No

Yes

SharePoint Online IP Ranges.

TCP 80 & 443

4

Required: CDNs for SharePoint Online and associated applications

Client or Server / logged on user

*.sharepointonline.com

cdn.sharepointonline.com

Static.sharepointonline.com

prod.msocdn.com

spoprod-a.akamaihd.net

publiccdn.sharepointonline.com

privatecdn.sharepointonline.com

Yes

No

N/A

TCP 80 & 443

5

Required: OneDrive for Business admin & Sharing from the Sync client

Client or Server / logged on user

admin.onedrive.com

No

No

N/A

TCP 80 & 443

6

Required: OneDrive for Business update verification and download

Client or Server / logged on user

oneclient.sfx.ms

Yes

No

N/A

TCP 80 & 443

7

Required: OneDrive for Business: Determines consumer v commercial

Client or Server / logged on user

https://officeclient.microsoft.com/config16

http://odc.officeapps.live.com/odc/emailhrd

No

No

N/A

TCP 80 & 443

8

Required: OneDrive for Business: Oauth login with AAD

Client or Server / logged on user

login.microsoftonline.com

No

Yes

Authentication and Identity IP ranges

TCP 443

9

Required: Client push notification

Client or Server / logged on user

skydrive.wns.windows.com

No

No

N/A

TCP 443

10

Optional: OneDrive for Business: supportability and telemetry

Client or Server / logged on user

ssw.live.com

mobile.pipe.aria.microsoft.com

watson.telemetry.microsoft.com

*.log.optimizely.com

No

No

N/A

TCP 443

11

Optional: OneDrive for Business: Office integration

Client or Server / logged on user

nexus.officeapps.live.com

Yes

No

Portal and shared IP ranges.

TCP 443

12

Optional: APIs to allow users to get help and retrieve logs to diagnose.

Client or Server / logged on user

storage.live.com/clientLogs

storage.live.com/sendFeedback

No

No

N/A

TCP 443

13

Optional: embedded email links

Client or Server / logged on user

click.email.microsoftonline.com

No

No

N/A

TCP 443

14

Optional: SharePoint Hybrid Search - Endpoint to SearchContentService where the hybrid crawler feeds documents

The crawler on the on-prem SP authenticates to SCS as the tenant that does the feeding.

*.search.production.us.trafficmanager.net

*.search.production.emea.trafficmanager.net

*.search.production.apac.trafficmanager.net

No

No

N/A

TCP 443

15

Optional: SharePoint Hybrid Search - Endpoint to SearchContentService to successfully authenticate to remote farm with OAuth authentication and authorization. The authorization server in this scenario is Microsoft Azure Access Control Service (ACS).

The Host Controller/Node Runner Account on the on-prem SP server.

accounts.accesscontrol.windows.net

No

No

N/A

TCP 443

16

Optional: SharePoint Hybrid Search - Required for onboarding script to connect to Office 365 Provisioning Web Services. As a part of script execution adds the Office 365 Service Principal ID to the local farm and sets the correct Service Principal Name in Azure AD for the on-premises URL. This ensures that the outbound query federation can occur between the Office 365 tenant and the on-premises farm

Global admin or equivalent credentials on the tenant for which Hybrid Search is being configured

provisioningapi.microsoftonline.com

No

Yes

Authentication and Identity IP ranges

TCP 443

1 This FQDN needs to be in your client's IE Trusted Sites Zone for Explorer View to function.

Note: ExpressRoute for Office 365 currently does not support IPv6. Customers not using ExpressRoute will want to ensure both IP lists below are reachable over the internet.

SharePoint Online IPv4 endpoints routable through the Internet and ExpressRoute

SharePoint Online IPv6 endpoints routable through the Internet only

13.107.6.150/31
13.107.6.168/32
13.107.9.150/31
13.107.9.168/32
40.108.0.0/19
40.108.128.0/17
52.104.0.0/14
104.146.0.0/19
104.146.128.0/17
134.170.200.0/21
134.170.208.0/21
191.232.0.0/23
191.234.128.0/21
191.235.0.0/20
2620:1ec:a92::150/128
2620:1ec:4::150/128
2620:1ec:6::129/128
2a01:111:f402::/48
2801:80:1d0:1400::/54

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Office 365 Video and Microsoft Stream

To use Office 365 Video or Microsoft Stream, you must be able to connect to the endpoints marked required below.

Row

Purpose

Source | Credentials

Destination

CDN

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: SharePoint Online endpoints listed above as required

See SharePoint Online

3

Required: Office 365 Video

Client or Server / logged on user

*.keydelivery.mediaservices.windows.net

*.streaming.mediaservices.windows.net

Azure Media Services

N/A

TCP 443

4

Required: Office 365 Video

Client or Server / logged on user

ajax.aspnetcdn.com

r3.res.outlook.com

spoprod-a.akamaihd.net

webanalytics.localytics.com

Yes

N/A

TCP 443

5

Required: Microsoft Stream

AAD user token

web.microsoftstream.com

*.cloudapp.net

api.microsoftstream.com

*.api.microsoftstream.com

*.api.microsoftstream.com

*.notification.api.microsoftstream.com

amp.azure.net

web.localytics.com

az416426.vo.msecnd.net

s0.assets-yammer.com

vortex.data.microsoft.com

No

N/A

TCP 443

6

Required: Office 365 Video & Microsoft Stream

browser.pipe.aria.microsoft.com

No

Portal and shared IP ranges.

TCP 443

7

Required: Microsoft Stream

Unauthenticated (content is encrypted)

*.streaming.mediaservices.windows.net

Azure Media Services

N/A

TCP 443

8

Required: Microsoft Stream

assets.onestore.ms

amsglob0cdnstream11.azureedge.net

Yes

N/A

TCP 443

9

Optional: Microsoft Stream

nps.onyx.azure.net

cdn.optimizely.com

N/A

N/A

TCP 443

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Yammer

To use Yammer, you must be able to connect to the endpoints marked required below.

Yammer is only available in the browser and requires the authenticated user to be passed.

Row

Purpose

Destination

CDN

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Yammer

*.yammer.com1

*.yammerusercontent.com1

No

13.107.6.158/31
13.107.9.158/31
134.170.148.0/22

TCP 443

3

Required: Yammer

*.assets-yammer.com1

Yes

N/A

TCP 443

1 This FQDN needs to be in your client's IE Trusted Sites Zone to function.

Note: The wildcard for yammer.com represents a long list of nodes that are exclusively used for Office 365.

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Sway

To use Sway, you must be able to connect to the endpoints marked required below.

Sway is only available in the browser and requires the authenticated user to be passed.

Row

Purpose

Destination

CDN

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Sway

sway.com

www.sway.com

eus-www.sway.com

eus-000.www.sway.com

eus-001.www.sway.com

eus-002.www.sway.com

eus-003.www.sway.com

eus-004.www.sway.com

eus-005.www.sway.com

eus-006.www.sway.com

eus-007.www.sway.com

eus-008.www.sway.com

eus-009.www.sway.com

eus-00a.www.sway.com

eus-00b.www.sway.com

eus-00c.www.sway.com

eus-00d.www.sway.com

eus-00e.www.sway.com

wus-www.sway.com

wus-000.www.sway.com

wus-001.www.sway.com

wus-002.www.sway.com

wus-003.www.sway.com

wus-004.www.sway.com

wus-005.www.sway.com

wus-006.www.sway.com

wus-007.www.sway.com

wus-008.www.sway.com

wus-009.www.sway.com

wus-00a.www.sway.com

wus-00b.www.sway.com

wus-00c.www.sway.com

wus-00d.www.sway.com

wus-00e.www.sway.com

No

40.76.22.51/32
40.76.30.255/32
40.76.213.143/32
40.76.216.125/32
40.76.221.181/32
40.76.222.175/32
40.83.185.108/32
40.114.8.214/32
40.114.14.121/32
40.114.15.127/32
40.114.15.142/32
40.114.45.182/32
40.114.40.12/32
40.114.51.204/32
40.114.51.239/32
40.118.210.94/32
40.112.188.120/32
40.118.131.134/32
40.118.135.86/32
40.118.131.27/32
40.118.209.10/32
104.41.155.129/32
104.210.43.160/32
137.135.51.71/32
137.135.52.204/32
138.91.155.70/32
138.91.159.117/32
138.91.160.172/32
138.91.164.243/32
138.91.245.66/32

TCP 443

3

Required: Sway

eus-www.sway-cdn.com

wus-www.sway-cdn.com

eus-www.sway-extensions.com

wus-www.sway-extensions.com

Yes

N/A

TCP 443

4

Optional: Sway website analytics

c.microsoft.com

c1.microsoft.com

prod.msocdn.com

www.google-analytics.com

No

N/A

TCP 443

5

Optional: Sway third party content

Access to third party content such as Bing, Flickr, and so on.

No

N/A

TCP 443

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Planner

To use Planner, you must be able to connect to the endpoints marked required below.

Planner is only available in the browser and requires the authenticated user to be passed.

Row

Purpose

Destination

CDN

Destination IP

Destination Port

1

Required: Suite-wide services

See Office 365 required entries for shared services and authentication

2

Required: Planner

tasks.office.com

controls.office.com

cus-000.tasks.osi.office.net

ea-000.tasks.osi.office.net

eus-zzz.tasks.osi.office.net

neu-000.tasks.osi.office.net

sea-000.tasks.osi.office.net

weu-000.tasks.osi.office.net

wus-000.tasks.osi.office.net

No

13.107.6.160/32
13.107.9.160/32
23.97.56.236/32
23.97.78.215/32
40.76.80.180/32
40.112.223.206/32
40.127.139.229/32
104.40.214.0/32
104.43.235.252/32

TCP 443

3

Required: Planner

outlook.office365.com

www.outlook.com

No

Exchange Online IP ranges & Portal and shared IP ranges.

TCP 443

4

Required: Planner

clientlog.portal.office.com

No

Portal and shared IP ranges.

TCP 443

5

Required: Planner CDNs

ajax.aspnetcdn.com

prod.msocdn.com

Yes

N/A

TCP 443

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Office clients

Office clients include both desktop and mobile clients, the online endpoints these applications use to improve the product experience are detailed below.

To understand Office 2016 for Mac endpoint requirements, refer to our reference article Network requests in Office 2016 for Mac.

To understand Office client network requests including, Office 365 ProPlus, Office 2016 for Windows, Outlook App for iOS and Windows, and OneNote refer to the article Network requests in Office and Mobile clients.

(Back to top | Office 365 shared services | Office 365 authentication | Exchange Online | Exchange Online Protection | Skype for Business Online | SharePoint Online | Office 365 Video and Microsoft Stream | Office Online | Yammer | Sway | Planner | Microsoft Teams | Office Clients)

Here’s a short link you can use to come back: https://aka.ms/o365endpoints

Related Topics

Network connectivity to Office 365
Managing Office 365 endpoints
Troubleshooting Office 365 connectivity
Client connectivity
Content delivery networks
Microsoft Azure Datacenter IP Ranges
Microsoft Public IP Space

Connect with an expert
Contact us
Expand your skills
Explore training

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×