Office 365 Germany endpoints

Applies To: Office 365 Admin

Summary: Office 365 requires connectivity to the Internet. The endpoints below should be reachable for customers using Office 365 Germany plans only.

Note

Microsoft has released a REST-based web service for the IP address and FQDN entries on this page. This new service will help you configure and update network perimeter devices such as firewalls and proxy servers. You can download the list of endpoints, the current version of the list, or specific changes. This service replaces the XML document linked from this page, which was deprecated on October 2, 2018. To try out this new service, go to Web service.

Office 365 endpoints: Worldwide (including GCC) | Office 365 operated by 21 Vianet | Office 365 Germany | Office 365 U.S. Government DoD | Office 365 U.S. Government GCC High |

Last updated: 10/1/2018 - RSS Change Log subscription Download: all required and optional destinations in one JSON formatted list.

Start with Managing Office 365 endpoints to understand our recommendations for managing network connectivity using this data. Endpoints data is updated at the beginning of each month with new IP Addresses and URLs published 30 days in advance of being active. This allows for customers who do not yet have automated updates to complete their processes before new connectivity is required. Endpoints may also be updated during the month if needed to address support escalations, security incidents, or other immediate operational requirements. You can always refer to the change log subscription.

The data shown on this page below is all generated from the REST-based web services. If you are using a script or a network device to access this data, you should go to the Web service directly.

Endpoint data below lists requirements for connectivity from a user’s machine to Office 365. It does not include network connections from Microsoft into a customer network, sometimes called hybrid or inbound network connections.

The endpoints are grouped into four service areas. The first three service areas can be independently selected for connectivity. The fourth service area is a common dependency (called Microsoft 365 Common and Office Online) and must always have network connectivity.

Data columns shown are:

  • ID: The ID number of the row, also known as an endpoint set. This ID is the same as is returned by the web service for the endpoint set.

  • Category: Shows whether the endpoint set is categorized as “Optimize”, “Allow”, or “Default”. You can read about these categories and guidance for management of them at http://aka.ms/pnc. This column also lists which endpoint sets are required to have network connectivity. For endpoint sets which are not required to have network connectivity, we provide notes in this field to indicate what functionality would be missing if the endpoint set is blocked. If you are excluding an entire service area, the endpoint sets listed as required do not require connectivity.

  • ER: This is Yes if the endpoint set is supported over Azure ExpressRoute with Office 365 route prefixes. The BGP community that includes the route prefixes shown aligns with the service area listed. When ER is No, this means that ExpressRoute is not supported for this endpoint set. However, it should not be assumed that no routes are advertised for an endpoint set where ER is No.

  • Addresses: Lists the FQDNs or wildcard domain names and IP Address ranges for the endpoint set. Note that an IP Address range is in CIDR format and may include many individual IP Addresses in the specified network.

  • Ports: Lists the TCP or UDP ports that are combined with the Addresses to form the network endpoint. You may notice some duplication in IP Address ranges where there are different ports listed.

Exchange Online

ID Category ER Addresses Ports
1 Optimize
Required
No outlook.office.de
51.4.64.0/23, 51.5.64.0/23
TCP: 443, 80
2 Default
Required
No r1.res.office365.com TCP: 443, 80
3 Default
Required
No outlook.office.de TCP: 143, 25, 587, 993, 995
4 Default
Required
No autodiscover-outlook.office.de TCP: 443, 80
5 Allow
Required
No *.mail.protection.outlook.de, *.protection.outlook.de, <tenant>.mail.protection.outlook.de
51.4.72.0/24, 51.4.80.0/27, 51.5.72.0/24, 51.5.80.0/27, 2a01:4180:4050:400::/64, 2a01:4180:4050:800::/64, 2a01:4180:4051:400::/64, 2a01:4180:4051:800::/64
TCP: 25, 443

SharePoint Online and OneDrive for Business

ID Category ER Addresses Ports
8 Optimize
Required
No <tenant>.sharepoint.de
51.4.66.0/23, 51.5.66.0/23
TCP: 443, 80
9 Default
Required
No odc.osi.office.de TCP: 443, 80
10 Default
Required
No wns.windows.com TCP: 443, 80
11 Default
Required
No officeapps.live.com TCP: 443, 80
12 Default
Required
No shellprod.msocdn.de, spoprod-a.akamaihd.net, static.sharepointonline.com TCP: 443, 80
13 Default
Required
No *.search.production.de.azuretrafficmanager.de TCP: 443
14 Default
Required
No odc.officeapps.live.com, officeclient.microsoft.com TCP: 443, 80
15 Default
Required
No mobile.pipe.aria.microsoft.com, ssw.live.com, watson.telemetry.microsoft.com TCP: 443, 80
16 Default
Required
No oneclient.sfx.ms TCP: 443, 80
17 Default
Required
No *.svc.ms TCP: 443, 80

Skype for Business Online and Microsoft Teams

ID Category ER Addresses Ports
6 Optimize
Required
No *.germeetings.skype.de, *.infra.skype.de, *.online.skype.de, *.resources.skype.de
51.4.68.0/26, 51.4.68.128/25, 51.5.69.0/26, 51.5.69.128/25, 2a01:4180:4040:1::/64, 2a01:4180:4040:2::/64, 2a01:4180:4040:7::/64, 2a01:4180:4040:8::/64
TCP: 443, 80
UDP: 3478
7 Default
Required
No *.germeetings.skype.de, *.infra.skype.de, *.online.skype.de, *.resources.skype.de TCP: 5061, 50000-59999
UDP: 50000-59999

Microsoft 365 Common and Office Online

ID Category ER Addresses Ports
18 Allow
Required
No *.online.office.de, broadcast.online.office.de, excel.online.office.de, onenote.online.office.de, powerpoint.online.office.de, visio.online.office.de, word-edit.online.office.de, word-view.online.office.de
51.4.144.200/32, 51.5.149.3/32, 51.18.16.0/23
TCP: 443
19 Default
Required
No broadcast.cdn.office.de, excel.cdn.office.de, officeapps.cdn.office.de, onenote.cdn.office.de, powerpoint.cdn.office.de, view.cdn.office.de, visio.cdn.office.de, word-edit.cdn.office.de, word-view.cdn.office.de TCP: 443
20 Allow
Required
No adminwebservice.microsoftonline.de, becws.microsoftonline.de, companymanager.microsoftonline.de, device.login.microsoftonline.de, directoryprovisioning.cloudapi.de, graph.cloudapi.de, login.microsoftonline.de, logincert.microsoftonline.de, pas.cloudapi.de, passwordreset.activedirectory.microsoftazure.de, provisioningapi.microsoftonline.de, syncservice.microsoftonline.de
51.4.70.0/24, 51.4.136.0/24, 51.4.144.0/24, 51.5.70.0/24, 51.5.136.0/24, 51.5.144.0/24
TCP: 443, 80
21 Default
Required
No *.azurecloudapp.de, *.cloudapi.de, *.windows.de, windowsazure.de TCP: 443, 80
22 Default
Required
No secure.aadcdn.microsoftonline-p.com TCP: 443, 80
23 Default
Required
No *.microsoftonline.de, *.windows.net TCP: 443, 80
24 Allow
Required
No cegsignup.microsoft.de, negsignup.microsoft.de TCP: 443, 80
25 Default
Required
No *.de.msods.nsatc.net, *.office.de.akadns.net, *.windows.de.nsatc.net, officehome.msocdn.de TCP: 443, 80
26 Default
Required
No *.d-trust.net TCP: 443, 80
27 Allow
Required
No *.onmicrosoft.de, *.osi.office.de, office.de, portal.office.de, webshell.suite.office.de, www.office.de
51.4.70.0/24, 51.4.71.0/24, 51.4.226.115/32, 51.4.227.178/32, 51.4.230.178/32, 51.5.70.0/24, 51.5.71.0/24, 51.5.147.48/32, 51.5.242.163/32, 51.5.245.67/32, 2a01:4180:2001::92/128, 2a01:4180:2001::234/128, 2a01:4180:2001::3b8/128, 2a01:4180:2401::11f/128, 2a01:4180:2401::33b/128, 2a01:4180:2401::55b/128
TCP: 443, 80
28 Default
Required
No *.cloudfront.net, prod.msocdn.de, r1.res.office365.com, shellprod.msocdn.de, videoplayer.osi.office.net TCP: 443, 80
29 Allow
Required
No arms.osi.office.de, excelcs.osi.office.de, excelps.osi.office.de, manage.osi.office.de, ols.osi.office.de, omexdiagnostics.osi.office.de, plattest.osi.office.de, pptcs.osi.office.de, pptps.osi.office.de, wordcs.osi.office.de, wordps.osi.office.de
51.4.144.41/32, 51.4.144.174/32, 51.4.145.38/32, 51.4.147.81/32, 51.4.147.233/32, 51.4.148.12/32, 51.4.150.145/32, 51.5.147.242/32, 51.5.149.100/32, 51.5.149.119/32, 51.5.149.123/32, 51.5.149.180/32, 51.5.149.186/32, 51.18.0.0/21
TCP: 443, 80
30 Default
Required
No graph.microsoft.de, ocws.osi.office.de, odc.osi.office.de, roaming.osi.office.de, sharepoint.de, store.office.de TCP: 443, 80
31 Default
Required
No o15.officeredir.microsoft.com, odc.officeapps.live.com, odcsm.officeapps.live.com, office.microsoft.com, office15client.microsoft.com, officeimg.vo.msecnd.net, roaming.officeapps.live.com TCP: 443, 80