Self Service Password Reset - Urls and IP address ranges

[Chris Johnston]

Minimum set of Urls and IP address ranges to allow SSPR:

We have a secure environment where users access Office 365 using a VDI solution hosted in Azure. Cloud only identities are used and AD DS is implemented for logging on to VDI (Windows 2016 RDS sessions)

web filtering prevents the users from accessing Office 365 and associated services directly from their corporate devices.

This creates a situation when users are unable to access SSPR to reset their own passwords from their devices, and without valid creds they cannot log on to VDI to perform the reset from there, where access is allowed. 

We want to configure web filtering to allow access SSPR from the corporate network, without allowing access to any other services e.g. office.com

I could use network trace in Fiddler to work out the URLs but hoping for something more supportable.

[#2 · Accepted solution]

@Chris Johnston SSPR network connectivity below are the two link which you need to whitelist.

The most common point of failure is that firewall and or proxy ports and idle timeouts are incorrectly configured, you need outbound HTTPS access to the following:

• *.passwordreset.microsoftonline.com
• *.servicebus.windows.net

[#3]

@Nandan Tripathi thanks for providing the information. I'll configure the white listing accordingly. 

[#4]

hello I am taking AZ-720 and got this question, I was not able to find a list of URLs, or anything like that ANYWHERE so can you please tell me a little bit more since all the answers none of them are like the ones u described there maybe I choose the correct options but the second one is .onmicrosoft, not  microsoftonline...thanks in advance