Simplifying Office 365 URL publishing by FQDN deduplication for proxy servers

[Paul Andrew]

Office 365 publishes IP Addresses and Fully Qualified Domain Names (FQDNs) so that customers can configure firewalls and proxy servers to allow appropriate access by users. These are published to http://aka.ms/o365ip and there is a web service which makes them available along with change tracking and 30 days notice for additions at http://aka.ms/ipurlws.

We publish updates at the end of each month and included in todays publishing is a new method for deduplicating FQDNs which would be already allowed by a published wildcard URL. This new method has two implications for customers:

1) There is a new change impact description in our changes web service called RemovedDuplicateIpOrUrl. This will be included any time we remove an FQDN because it is not necessary due to it matching a wildcard URL. When you see these changes, it means that an FQDN was removed from publishing, but that the FQDN is still in use by Office 365. The FQDN is covered by a wildcard URL which is also published.

For example: connectivity to *.office.com is required for Office 365. Proxy servers do not need to additional have config.office.com allowed since access to that is already permitted by the *.office.com entry.

2) There are fewer entries published now that need to be listed on a proxy server. The changes to the Office 365 worldwide instance are published here, show 52 fewer FQDN/URL entries than yesterday. Note that the changes URL shows all changes since June 28, 2020 and will show additional changes in the future.

This should help simplify proxy server configuration for Office 365.

[#2]

@Paul Andrew 

Hi, what would be useful to know is how does Microsoft's revised approach to O365 URL Publishing impact on services, such a Microsoft Whiteboard, are looked at.  I mention Whiteboard because it isn't covered by the current list of O365 URLs and IPs.

I'm sure that Microsoft have a process that brings a service like Whiteboard in to scope of the O365 URL list, so it would be useful to understaand a high-level overview of just how this works.

It would help with many 'discussions' in my own organisation because the O365 URL list is seen as being definitive, so you get a response like "if its not on the list..." and end up driving around in circles.

Pete