Office 365 US Government Defense endpoints

Summary   : If your organization uses Office 365 and restricts computers on your network from connecting to the Internet, below you'll find the endpoints (FQDNs, Ports, URLs, IPv4, and IPv6 address ranges) that you should include in your outbound allow lists to ensure your computers can successfully use Office 365.

Office 365 endpoints: Worldwide | Office 365 operated by 21 Vianet | US Government Defense | Office 365 Germany

Last updated: 1/31/2017

Subscribe via RSS RSS to receive notice when endpoints are changed.

Tips: Use the endpoints here alongside our Office 365 US Government plans including; Defense and non-Defense. If you're using a plan within the Office 365 operated by 21 Vianet, Worldwide (including US Government plans, education, non-profit, and commercial), or Office 365 Germany endpoints offerings, please use the articles that cover those offerings.

Use the XML file for a list of the endpoints organized by service.

Office 365 US Government Defense is designed to deliver productivity services to organizations that adhere to regulations for US Government controlled data. The following endpoints are only applicable for Office 365 US Government Defense customers.

Office 365 requires internet connectivity from every computer connecting to the service.

If you're configuring access from your network to Office 365, managing Office 365 endpoints describes how to manage your firewall and proxy settings with scripts and sample PAC files.

If you're troubleshooting access to Office 365, troubleshooting Office 365 connectivity describes how to troubleshoot endpoints found in your network traces or firewall logs.

Content delivery networks and client connectivity offer more insight into how clients connect to Office 365 and how standard internet services are incorporated.

Warning: IP addresses filtering alone isn’t a complete solution due to dependencies on internet based services such as Domain Name Services, Content Delivery Networks (CDNs), Certificate Revocation Lists, and other third party or dynamic services. These dependencies include dependencies on other Microsoft services such as the Azure Content Delivery Network and will result in network traces or firewall logs indicating connections to IP addresses owned by third parties or Microsoft but not listed on this page. These unlisted IP addresses, whether from third party or Microsoft owned CDN and DNS services are dynamically assigned and can change at any time.

  • Some clients such as the Office 365 admin portal or Outlook Web App won’t be able to authenticate without contacting CDNs.

  • CDN, CRL, and other partners don't publish IP addresses.

  • New Office 365 infrastructure won’t become instantly available to client computers.

  • Some firewall providers and security policies don't allow for wildcards.

  • Updates will be required as frequently as weekly for both planned and emergency changes.

  • Future non-web based clients may not be able to authenticate.

Tip: If IP address filtering is your only option at the firewall, an automatic proxy configuration file can be used to route the destinations marked below as CDNs through an alternate path, such as through an outbound proxy. See the Routing office 365 traffic over the internet and ExpressRoute scenario in the article Routing with ExpressRoute for Office 365 for help with more complex routing configurations.

Every Office 365 service requires the endpoints in the Office 365 portal and shared as well as the Office 365 authentication and identity to function. Beyond that you'll need to select the services you've deployed or plan to deploy in your organization and filter accordingly. If you've fully adopted all Office 365 services in your organization, the entries from every service section below are required. If not, use these links to get to just the services your organization has adopted. The FQDNs and IP addresses tables are collapsed to improve navigation, you'll need to expand the sections to see the tables. If you want to search for a specific endpoint, search the the XML file for the current list of endpoints organized by service or the RSS feed to see a historical view including the dates when specific endpoints were added or removed.

Changes for each Office 365 service are combined and published at the end of each month. Occasionally emergency changes will occur outside of the end of month publishing. Expect changes three business days prior to the last business day of the month. When an endpoint is added, an effective date is listed in the RSS feed. If you're new to RSS, here is how to subscribe via Outlook or you can have the RSS feed updates emailed to you.

There's a lot of information on this page, can we present it to you in a simpler way?

Please consider voicing your thoughts at the bottom of this page, under the heading Was this information helpful? Click yes or no and enter detailed feedback. The more feedback we get from you the easier it will be for us to improve the page.

How to use the ExpressRouteGov for Office 365 column

The endpoints listed as a Yes in the ExpressRouteGov for Office 365 column are available both over the internet and over ExpressRoute with Microsoft peering configured.

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Portal and shared

N/A
N/A

portal.apps.mil

portal.office365.us

Yes

TCP 443

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Identity management

157.56.53.128/25
157.55.59.128/25
157.56.58.0/25
157.56.151.0/25
N/A

msoid.<tenantdomain>

login.microsoftonline-p.com

loginex.microsoftonline.com

api.login.microsoftonline.com

nexus.microsoftonline-p.com

clientconfig.microsoftonline-p.net

hip.microsoftonline-p.net

hipservice.microsoftonline.com

monitoring.microsoftonline-p.com

msoid.<tenantdomain>

login.microsoftonline-p.com

loginex.microsoftonline.com

api.login.microsoftonline.com

nexus.microsoftonline-p.com

clientconfig.microsoftonline-p.net

hip.microsoftonline-p.net

hipservice.microsoftonline.com

monitoring.microsoftonline-p.com

Yes

TCP 443

Identity management

13.72.17.49/32
13.72.18.116/32
13.72.18.212/32
13.72.18.216/32
13.72.18.221/32
13.72.19.9/32
13.72.19.36/32
13.72.20.4/32
13.72.23.54/32
13.72.49.238/32
13.72.50.182/32
13.72.50.206/32
13.72.50.212/32
13.72.50.218/32
13.72.51.69/32
13.72.55.111/32
13.72.55.162/32
13.72.55.177/32
13.72.184.118/32
13.72.184.199/32
13.72.184.206/32
13.72.185.5/32
13.72.185.34/32
13.72.186.4/32
13.72.186.27/32
13.72.186.138/32
13.72.186.230/32
13.72.187.8/32
13.72.188.36/32
13.72.188.114/32
13.72.188.142/32
13.72.189.27/32
13.72.189.143/32
13.72.190.80/32
13.72.190.167/32
13.72.191.10/32
131.253.120.0/26
131.253.120.64/26
131.253.120.128/26
131.253.120.192/26
N/A

*.gov.us.microsoftonline.com

adminwebservice.gov.us.microsoftonline.com

adminwebservice-s1-bn1a.microsoftonline.com

adminwebservice-s1-dm2a.microsoftonline.com

becws.gov.us.microsoftonline.com

bws-s1-bn1a-relay.microsoftonline.com

bws-s1-bn1r-relay.microsoftonline.com

bws-s1-dm2a-relay.microsoftonline.com

bws-s1-dm2r-relay.microsoftonline.com

provisioningapi.gov.us.microsoftonline.com

provisioningapi-s1-dm2a.microsoftonline.com

provisioningapi-s1-dm2r.microsoftonline.com

*.gov.us.microsoftonline.com

adminwebservice.gov.us.microsoftonline.com

adminwebservice-s1-bn1a.microsoftonline.com

adminwebservice-s1-dm2a.microsoftonline.com

becws.gov.us.microsoftonline.com

bws-s1-bn1a-relay.microsoftonline.com

bws-s1-bn1r-relay.microsoftonline.com

bws-s1-dm2a-relay.microsoftonline.com

bws-s1-dm2r-relay.microsoftonline.com

provisioningapi.gov.us.microsoftonline.com

provisioningapi-s1-dm2a.microsoftonline.com

provisioningapi-s1-dm2r.microsoftonline.com

Yes

TCP 443

Authentication management

23.100.16.168/29
23.100.32.136/29
23.100.64.24/29
23.100.72.32/29
23.100.80.64/29
23.100.120.64/29
23.101.144.136/29
23.101.165.168/29
23.101.181.128/29
40.113.192.16/29
40.114.120.16/29
65.52.1.16/29
65.52.193.136/29
104.42.72.16/29
104.43.208.16/29
104.43.240.16/29
104.45.208.104/29
104.46.112.8/29
104.209.144.16/29
104.210.48.8/29
104.210.208.16/29
104.211.16.16/29
104.211.48.16/29
104.215.96.24/29
23.96.208.238/32
23.99.128.120/32
23.99.129.26/32
23.99.129.173/32
23.99.193.105/32
23.99.194.77/32
23.99.196.232/32
23.99.226.167/32
23.99.227.124/32
23.101.178.227/32
23.101.187.91/32
65.52.232.52/32
65.52.233.128/32
65.52.236.160/32
65.52.240.73/32
65.52.244.66/32
70.37.56.152/32
70.37.160.72/32
70.37.160.202/32
137.116.32.43/32
137.116.32.61/32
137.116.32.101/32
137.116.48.66/32
137.116.48.69/32
137.116.49.27/32
137.116.64.162/32
137.116.80.106/32
137.117.99.175/32
137.117.103.21/32
137.135.41.12/32
137.135.44.5/32
137.135.47.4/32
137.135.47.6/32
137.135.47.28/32
157.55.80.175/32
157.55.80.182/32
157.55.84.13/32
157.55.84.80/32
157.55.161.59/32
157.55.161.75/32
157.55.168.18/32
157.55.176.63/32
157.55.208.58/32
157.55.208.198/32
157.55.208.218/32
157.55.252.101/32
157.56.8.26/32
157.56.8.78/32
157.56.12.18/32
157.56.28.192/32
168.61.32.214/32
168.61.33.178/32
168.61.36.121/32
168.61.38.105/32
168.61.39.14/32
168.61.144.76/32
168.61.208.197/32
168.62.4.28/32
168.62.11.24/32
168.62.11.117/32
168.62.16.112/32
168.62.16.140/32
168.62.16.149/32
168.62.16.252/32
168.62.24.38/32
168.62.24.104/32
168.62.24.114/32
168.62.24.150/32
168.62.41.25/32
168.62.42.89/32
168.62.52.198/32
168.62.52.203/32
168.62.56.108/32
168.62.60.71/32
168.62.60.80/32
168.62.104.146/32
168.62.105.126/32
168.62.105.217/32
168.62.176.34/32
168.62.179.4/32
191.236.192.179/32
191.237.128.159/32
N/A

login-us.microsoftonline.com

login-us.microsoftonline.com

Yes

TCP 443

Authentication management

23.96.208.238
23.97.64.252
23.97.66.110
23.97.68.113
23.97.70.147
23.97.72.158
23.97.72.161
23.97.72.165
23.97.98.128
23.97.99.4
23.97.99.164
23.97.100.76
23.97.100.92
23.97.100.105
23.97.100.152
23.97.102.90
23.97.103.118
23.97.145.9
23.97.148.36
23.97.148.228
23.98.66.168
23.98.69.116
23.98.70.90
23.99.128.120
23.99.129.26
23.99.129.173
23.99.193.105
23.99.194.77
23.99.196.232
23.99.226.167
23.99.227.124
23.101.19.99
23.101.25.224
23.101.178.227
23.101.187.91
23.102.64.16
23.102.64.138
23.102.64.255
23.102.65.171
23.102.65.203
23.102.65.221
40.115.48.147
40.115.52.169
40.115.54.55
40.115.54.162
40.115.55.208
65.52.64.61
65.52.64.230
65.52.136.224
65.52.144.125
65.52.176.72
65.52.228.75
65.52.228.99
65.52.228.100
65.52.232.52
65.52.233.128
65.52.236.160
65.52.240.73
65.52.244.66
70.37.56.152
70.37.160.72
70.37.160.202
94.245.88.194
94.245.88.223
104.41.1.233
104.47.143.47
104.47.146.37
104.211.98.2
104.211.98.6
104.211.98.138
104.211.98.146
104.211.98.194
104.211.98.246
104.211.99.88
104.211.99.127
104.211.99.181
104.211.99.236
104.211.100.160
104.211.100.170
104.211.100.196
104.211.100.204
104.211.102.225
104.211.160.36
104.211.161.31
104.211.161.69
104.211.161.150
104.211.161.165
104.211.161.170
104.211.161.171
104.211.161.185
104.211.162.33
104.211.162.51
104.211.162.180
104.211.164.26
104.211.165.35
104.211.165.64
104.211.166.139
104.211.224.71
104.211.224.118
104.211.225.135
104.211.225.215
104.211.226.231
104.211.226.240
104.211.227.110
104.211.227.238
104.211.229.0
104.211.230.178
104.211.230.245
104.211.231.147
104.211.231.218
104.211.231.219
104.211.231.248
137.116.32.43
137.116.32.61
137.116.32.101
137.116.48.66
137.116.48.69
137.116.49.27
137.116.64.162
137.116.80.106
137.116.129.62
137.116.200.108
137.116.242.169
137.117.99.175
137.117.103.21
137.135.41.12
137.135.44.5
137.135.47.4
137.135.47.6
137.135.47.28
138.91.1.59
138.91.2.208
138.91.2.210
138.91.2.212
138.91.17.43
138.91.17.108
138.91.18.52
138.91.56.78
138.91.56.97
138.91.58.210
138.91.59.78
138.91.59.239
138.91.60.177
138.91.61.35
138.91.61.153
157.55.80.175
157.55.80.182
157.55.84.13
157.55.84.80
157.55.161.59
157.55.161.75
157.55.168.18
157.55.176.63
157.55.208.58
157.55.208.198
157.55.208.218
157.55.252.101
157.56.8.26
157.56.8.78
157.56.12.18
157.56.28.192
168.61.32.214
168.61.33.178
168.61.36.121
168.61.38.105
168.61.39.14
168.61.83.48
168.61.85.193
168.61.144.76
168.61.208.197
168.62.4.28
168.62.11.24
168.62.11.117
168.62.16.112
168.62.16.140
168.62.16.149
168.62.16.252
168.62.24.38
168.62.24.104
168.62.24.114
168.62.24.150
168.62.41.25
168.62.42.89
168.62.52.198
168.62.52.203
168.62.56.108
168.62.60.71
168.62.60.80
168.62.104.146
168.62.105.126
168.62.105.217
168.62.176.34
168.62.179.4
168.63.16.66
168.63.16.141
168.63.25.227
168.63.27.2
168.63.164.177
168.63.165.67
168.63.166.200
168.63.213.203
168.63.216.117
168.63.252.71
191.233.32.111
191.233.32.201
191.233.37.141
191.235.135.139
191.235.135.222
191.236.192.179
191.237.128.159
191.238.80.160
191.238.80.241
191.238.81.69
191.238.83.220
191.239.64.124
191.239.64.125
191.239.64.129
191.239.64.130
191.239.64.131
191.239.64.132
191.239.64.133
191.239.64.134
191.239.160.46
191.239.160.93
191.239.160.140
191.239.160.141
191.239.160.142
191.239.160.143
191.239.160.144
191.239.160.145
213.199.128.58
213.199.128.91
213.199.132.97
N/A

login.windows.net

login.microsoftonline.com

login.windows.net

login.microsoftonline.com

Yes

TCP 443

Supporting services

Akamai CDN

N/A

secure.aadcdn.microsoftonline-p.com

secure.aadcdn.microsoftonline-p.com

No

TCP 443

Supporting services

Certificate Revocation List

N/A

mscrl.microsoft.com

mscrl.microsoft.com

No

TCP 80 & 443

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Exchange Online

131.253.80.0/20

2001:489a:2200:0028::/62
2001:489a:2200:44::/62
2001:489a:2200:3c::/62

webmail.apps.mil

outlook-dod.office365.us

autodiscover.<tenant>.onmicrosoft.com

autodiscover.<tenant>.mail.onmicrosoft.com

outlook.office365.us

autodiscover.<tenant>.onmicrosoft.com

autodiscover.<tenant>.mail.onmicrosoft.com

Yes

TCP 25, 80, 143, 443, 587, 993, 995

Exchange Online CDN

N/A

N/A

r4.office365.us

r4.office365.us

No

TCP 80 & 443

Exchange Hybrid Configuration Wizard

65.55.79.128/25

N/A

domains.live.com

domains.live.com

Yes

TCP 80 & 443

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Exchange Online Protection

23.103.199.0/24
23.103.204.0/22
23.103.208.0/22
N/A

*.protection.office365.us

*.protection.office365.us

Yes

TCP 25 & 443

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

SharePoint Online and OneDrive for Business

104.212.48.0/22
2001:489a:2204::/62

*.sharepoint-mil.us

*.dps.mil

*.sharepoint.us

Yes

TCP 80 & 443

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Skype for Business Online

104.212.32.0/22
104.212.44.0/22
104.212.60.0/23
N/A

*.online.dod.skypeforbusiness.us

*.online.gov.skypeforbusiness.us

Yes

TCP 80, 443, 5061, 50000-59999

UDP 3478, 50000-59999

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Office Online

N/A
N/A

Broadcast.online.apps.mil

Excel.online.apps.mil

OneNote.online.apps.mil

PowerPoint.online.apps.mil

View.online.apps.mil

Word-Edit.online.apps.mil

Word-View.online.apps.mil

Broadcast.online.office365.us

Excel.online.office365.us

OneNote.online.office365.us

PowerPoint.online.office365.us

View.online.office365.us

Word-Edit.online.office365.us

Word-View.online.office365.us

Yes

TCP 443

(Back Home)

Service

IPv4 addresses

IPv6 addresses

Office 365 US Government Defense Destination FQDNs

Office 365 US Government Non-Defense Destination FQDNs

ExpressRouteGov for Office 365

Destination Ports

Office 365 ProPlus

Same IP ranges as standard Office clients

activation.sls.microsoft.com

crl.microsoft.com

odc.officeapps.live.com

ols.officeapps.live.com

office15client.microsoft.com

officeclient.microsoft.com

ocsredir.officeapps.live.com

r.office.microsoft.com

officeredir.microsoft.com

office15redir.microsoft.com

officepreviewredir.microsoft.com

ocws.officeapps.live.com

officecdn.microsoft.com

officecdn.microsoft.com.edgesuite.net

officecdn.microsoft.com.edgekey.net

ocsa.officeapps.live.com

insertmedia.bing.office.net

go.microsoft.com

activation.sls.microsoft.com

crl.microsoft.com

odc.officeapps.live.com

ols.officeapps.live.com

office15client.microsoft.com

officeclient.microsoft.com

ocsredir.officeapps.live.com

r.office.microsoft.com

officeredir.microsoft.com

office15redir.microsoft.com

officepreviewredir.microsoft.com

ocws.officeapps.live.com

officecdn.microsoft.com

officecdn.microsoft.com.edgesuite.net

officecdn.microsoft.com.edgekey.net

ocsa.officeapps.live.com

insertmedia.bing.office.net

go.microsoft.com

No

TCP 80 & 443

(Back Home)

Here’s a short link you can use to come back: https://aka.ms/o365usendpoints

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×