Discuss your project

TOOLBOX · TOOL

Allow Endpoints.

Which addresses must your firewall allow for Microsoft 365, and which should the proxy not break open? Choose service and category, copy the list.

Loading the list …

THE THREE CATEGORIES

Optimize. Allow.
Default.

Microsoft assigns every endpoint set to a category. It determines how strictly firewall and proxy should treat the connections. Our glossary explains the basic terms under Firewall and Microsoft 365.

  • Optimize

    A few especially critical addresses. Microsoft recommends routing them directly into the Microsoft network, for example via SD-WAN or split tunneling in the VPN.

  • Allow

    Also required for Microsoft 365. As with Optimize, TLS break and inspect and proxy authentication do not fit according to Microsoft.

  • Default

    The remaining addresses. They may run through your usual internet access with a proxy and inspection.

  • If an address appears in several categories, the one with the highest priority applies. The lists to copy take this into account.
  • Microsoft 365 needs the required endpoint sets to be supported. Missing optional ones only affect certain features; which ones is stated in Microsoft’s note for the set.
  • The shared addresses (Microsoft 365 Common) belong to every service and are therefore always included unless you deselect them.

Sources on Microsoft Learn: Microsoft 365 IP Address and URL web service, Microsoft 365 URLs and IP address ranges, Managing Microsoft 365 endpoints, Network connectivity overview and Network connectivity principles.

HOW CURRENT

Checked Hourly.
Changed Monthly.

We follow the rules Microsoft sets for the web service, so that the list stays current and the service is not burdened unnecessarily.

  • We check the version at most once an hour and only load the list when there is a new version.
  • Microsoft updates at the beginning of every month; new addresses appear 30 days before they are used.
  • If our server cannot reach Microsoft for more than two hours, a note appears above the list.
  • Without a tenant name: addresses of your organization contain the placeholder *.

NOT INCLUDED

What the List
Does Not Cover.

The web service describes the connections from your devices to Microsoft 365. Some things are listed elsewhere.

Microsoft 365, Exchange Online, SharePoint and Microsoft Teams are trademarks of Microsoft Corporation. This tool is not an offering of Microsoft and only shows data that Microsoft provides publicly.

QUESTIONS

Good to Know.

Where does the list come from?

From the “Microsoft 365 IP Address and URL web service” at endpoints.office.com, which Microsoft operates for exactly this purpose. Our server queries the current version there at most once an hour and only reloads the list when Microsoft has published a new version, as Microsoft recommends. Shown is the Worldwide instance for Microsoft 365 outside China and the US government clouds.

What do Optimize, Allow and Default mean?

Microsoft assigns every endpoint set to a category. Optimize covers a few especially critical addresses that should be routed directly into the Microsoft network. For Optimize and Allow, Microsoft writes that TLS break and inspect and proxy authentication do not fit with them. Default are the remaining addresses that can run through the usual internet access with a proxy. If an address appears in several categories, the highest applies.

How often does the list change?

Microsoft updates the addresses at the beginning of every month, and out of turn for incidents or security updates. Microsoft publishes new addresses 30 days before they go into operation. The version number above the list shows which state you are seeing.

Why do some addresses contain an asterisk?

Without your tenant name, Microsoft inserts the placeholder * there, for example for SharePoint addresses of your organization. We deliberately query without a tenant name. For your firewall, replace the asterisk with your tenant name or keep the placeholder if your proxy understands wildcards.

Which data goes to whom, and does TOMORIS store anything?

You enter nothing. Your browser loads the list from our server; filtering, copying and downloading run in your browser. Our server retrieves the list from Microsoft without any data from you: Microsoft only receives the address of our server and a fixed identifier that Microsoft requires from every querying server.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result