What are the FQDNs used for Office 365 logon and authentication?

Question

Hello,We run a computer lab with Office 365 installed, with a network firewall that restricts all outbound internet traffic. We had made allowances for Office 365 logons so that users could use the Office 365 desktop applications, by allowing the following entries:&nbsp;*.office.com*.office365.com*.microsoftonline.com*.office.net&nbsp;And that was working until earlier this month. Suddenly a couple weeks ago, users were no longer able to sign into Office 365.&nbsp;I found this list https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide of all URLs and IPs that Microsoft tries to use for Office 365, and I tried adding&nbsp;*.auth.microsoft.com*.msftidentity.com*.msidentity.com&nbsp;to our firewall, but still no ability to log in.&nbsp;As a test, I disabled the outbound network block on one of the lab machines, and confirmed that I was indeed able to log in. So I know the issue is with this firewall rule. But I cannot add every single URL on that huge list above, that's not feasible. So please, I would like to know just what URLs are required for the Office 365 sign-on to work. I don't need or care about the other services on that list.

kidd_ip · Answer

md5hash&nbsp;You may referring this:&nbsp;Office 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn

md5hash · Answer

Kidd_Ip&nbsp;&nbsp;I mentioned that in my original post, quote "I found this list https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide of all URLs and IPs that Microsoft tries to use for Office 365, and I tried adding"&nbsp;That link, in the word here, goes to that post you mentioned. Did you read my original post, or click the link?&nbsp;That is a huge list though. I only want URLs that pertain to authentication for Office 365. Not random stuff to make skype, onedrive sync, etc work.

kidd_ip · Answer

md5hash&nbsp;When you have a chance to look at the URL, you can realize it needs to allow based on what you want&nbsp; but not Office 365 since quite a huge of productivity platform, there is NO one go for ALL Office 365 services and not practical, nor FQDN but URL and IP address to allow for the authentication, hope clear your understanding here.For how to have a systematic way for the allowed list handling, you may consider firewall feature on category release, or further study how your 'authentication' means? Say protocols, devices, authentication method, etc.

md5hash · Answer

This is not practical. We run a secure computer lab. We don't need or want the vast majority of these IPs. I know you don't work for Microsoft directly, and are an MCT in Hong Kong. Perhaps you can sympathize with my question. All we want are URLs - not even IP addresses, since I know that Microsoft operates random huge IP pools that can change at any time - just URLs, FQDNs, that we can allow that will handle authentication for Office 365. That's it.I'm afraid I'm not quite understanding your post.Why is it so difficult for Microsoft to have a single FQDN URL to handle Office 365 authentication? At least, for the USA where I am located.Like I said, I know the issue is that I'm not being lax enough on my firewall rules. We run a secure ship here, and I'm not interested in opening thousands of IPs and URLs. I just want authentication to Office 365.

kidd_ip · Answer

md5hash&nbsp;I am the same thoughts as you since I am one of the full-time IT infra guys but also would like to spend effort and contribute my time here to help others.Back to your question, I am quite sure Microsoft will provide your below URL to release even raised a ticket, as the result and you can observe from the list, it was mixed with URL and IP address and it's confirmed no pure IP address list ONLY (please note that partial release of URL\IP address may work but possibly introduce performance issue and unexpected error).From my experience, you can consider handling this kind of 'change' systemically, some firewall called this as 'object' while some called 'category', you just simply release 'Office 365' as category and your firewall will update the URLs and IP address without bothering you.Hope this help&nbsp;

Forum Discussion

What are the FQDNs used for Office 365 logon and authentication?

7 Replies

Resources