Home
Microsoft

Note: We updated our port requirements. For more details see: Simplified port requirements for Skype for Business Online

 

Updated IP ranges and ports for Skype for Business Online 

We heard from some of our customers recently, that the number of IP ranges and ports required for Skype for Business make it complex to configure firewalls. To address this feedback, Microsoft decided to perform several optimizations to simplify the requirements.

 

Skype for Business Online has a significant infrastructure, so while we have started with these changes, it will take some time to be completed. We strongly recommend to open the IP subnets and ports today, to avoid any negative impact to connectivity.

 

  • New IP ranges: We already started to move the Skype for Business infrastructure to new  ranges. The ranges are required in addition to the existing ranges, so remember to open all IP ranges documented in Office 365 URLs and IP address ranges.
  • New ports: While this might take a little bit more time than the new IP ranges, we will leverage the following ports for media traffic in addition to the existing ports:
    • UDP 3479
    • UDP 3480
    • UDP 3481

Please note that the complete list of IP ranges and ports can be found at Office 365 URLs and IP address ranges.The changes to the IP and port ranges were added in August, but now is a great time to go back and review your firewall and other security devices to ensure they are being allowed as we move ahead with the deployment.

 

Note: Though the plan is to move to these new smaller ranges, it’s possible due to the requirements for growth in the environment that the team may add new IP addresses outside of the current ranges before the consolidation is complete.

 

Call to action:

  1. Verify that your firewall is configured for all IP ranges and ports as documented in Office 365 URLs and IP address ranges – and open them if you have not done it yet.
  2. If you are a partner, get sure to update your firewall design templates.
  3. Follow this blog and the Office 365 URLs and IP address ranges to learn when you must add new IP ranges or when you can close some of the ranges that are not required anymore.

 

5 Comments
New Contributor

Hi Thomas

Do you have any dates when this move to 2 consolidated ip ranges will be completed.

Currently asking to allow all those ip ranges for SfB online is a nightmare.

 

Thanks

Sukh

Microsoft

@sukh rehal, reducing teh number of IP ranges is an ongoing effort. Please note taht while it will be much less ranges in the future, it will be always more than two.

Occasional Visitor

Has there been any progress on the consolidation work? As the current SfB list still contains 300+ IP addresses  I'm assuming this work is far from done. 

Contributor

Many of those IP addresses listed are /32 - that is what comprises a bulk of the # of entries you see in the list.  Most of the core services are housed within several large, contigous blocks:

13.107.3.0/24
13.107.8.0/24
13.107.17.0/24
13.107.64.0/18
13.107.242.0/24

23.103.176.128/26
23.103.176.192/27
23.103.178.128/26
23.103.178.192/27

52.112.0.0/14

104.44.195.0/24
104.44.200.0/23

111.221.77.0/26

132.245.0.0/24
132.245.1.0/25
132.245.112.0/24
132.245.113.0/25
134.170.0.0/25
134.170.54.0/26
134.170.54.128/25
134.170.113.192/26
134.170.115.128/25

157.55.238.0/25

 

There is definitely work to be done on MSFT's part, but a significant portion of functionality comes from the 23 ranges above from within the larger list of 300.  (Note: that list above consists of 250,000+ IP addresses!)  This doesn't all IPs especially regrding Teams, mind you, but it also doesn't mean you can omit the other entries in the list.  My advice:

Keep up with the RSS feed or take a look at AzureRange or MineMeld for ways to automate and ease your pain.

Microsoft

@Mark Picker, as @Trevor Miller pointed out, there has already been done some work. However there is much more to do and you should see more results in the coming quarters.