====== Blocklists - Microsoft - Get Microsoft URLs, IP addresses and Ports ======
Microsoft updates the Office 365 IP address and FQDN entries at the end of each month.
Out-of-band updates are sometimes published due to support incidents, security updates or other operational requirements.
----
===== Create a GUID =====
Microsoft require a GUID to download the list of current URLs and IPs.
By default, Microsoft uses the following UUID, b10c5ed1-bad1-445f-b386-b919946339a7, as an example, but this specific UUID may be disallowed in future, so it is recommended to use an alternative UUID.
uuidgen
returns:
948beb0b-32bb-4e1c-a67d-091c861a0cc6
**NOTE:** There are alternative ways to create a UUID.
* https://www.guidgenerator.com/
----
===== Download the endpoints file =====
curl https://endpoints.office.com/endpoints/worldwide?clientrequestid=948beb0b-32bb-4e1c-a67d-091c861a0cc6 > office.txt
returns:
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 56888 100 56888 0 0 76053 0 --:--:-- --:--:-- --:--:-- 75951
**NOTE:** This will download the file in JSON format.
* CSV format is also available by adding **&format=CSV**.
* For example curl "https://endpoints.office.com/endpoints/worldwide?noipv6&format=CSV&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office2.txt
The actual Data columns in the file:
* **ID**: The ID number of the row, also known as an endpoint set.
* **Category**: Shows whether the endpoint set is categorized as "Optimize", "Allow", or "Default".
* See https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-network-connectivity-principles?view=o365-worldwide#new-office-365-endpoint-categories.
* **ER**: This is Yes if the endpoint set is supported over Azure ExpressRoute with Office 365 route prefixes.
* **Addresses**: Lists the FQDNs or wildcard domain names and IP Address ranges for the endpoint set.
* An IP Address range is in CIDR format and may include many individual IP Addresses in the specified network.
* **Ports**: Lists the TCP or UDP ports that are combined with the Addresses to form the network endpoint.
* There may be some duplication in IP Address ranges where there are different ports listed.
----
Alternative Options to used with the curl command, including:
* ServiceAreas=
* NoIPv6=
* Instance=
For example:
* To exclude IPv6, use this:
curl "https://endpoints.office.com/endpoints/worldwide?noipv6&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office.txt
* To download only for the Skype service, in CSV format: curl "https://endpoints.office.com/endpoints/worldwide?ServiceAreas=Skype&noipv6&format=CSV&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office.txt
* To download only the China instance: curl "https://endpoints.office.com/endpoints/China?noipv6&format=CSV&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office.txt
----
The UUID created earlier is used with the curl commands.
* The default UUID provided by Microsoft, b10c5ed1-bad1-445f-b386-b919946339a7, could also be used.
----
See https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
----
===== Check list of Services =====
jq -r '.[].serviceArea' office.txt | sort | uniq
returns:
Common
Exchange
SharePoint
Skype
**NOTE:** The **Skype** service includes Microsoft Teams.
Because **Common** service area items are a prerequisite for all other service areas, the web service always includes them.
----
===== Get IPs for the Specific Service =====
Assuming IPs for the Exchange Service is needed.
jq -r '.[] | select(.serviceArea=="Exchange") | select(.ips) .ips[]' office.txt | sort -t . -k1,1n -k2,2n -k3,3n -k4,4n | uniq
returns:
13.107.6.152/31
13.107.18.10/31
13.107.128.0/22
23.103.160.0/20
40.92.0.0/15
40.96.0.0/13
40.104.0.0/15
40.107.0.0/16
52.96.0.0/14
52.100.0.0/14
52.238.78.88/32
104.47.0.0/17
131.253.33.215/32
132.245.0.0/16
150.171.32.0/22
204.79.197.215/32
**NOTE:** The following query could be used, but be aware that this may sometimes drop some IPs. See [[BASH:Commands:sort:Numeric Sort Bug|Numeric Sort Bug]].
jq -r '.[] | select(.serviceArea=="Exchange") | select(.ips) .ips[]' office.txt | sort | uniq
----
===== Get Current List of URLs =====
jq -r '.[] | select(.serviceArea=="Exchange") | select(.urls) .urls[]' office.txt | sort -t . -k1,1n -k2,2n -k3,3n -k4,4n | uniq
returns:
----
===== Get Current List of Ports =====
jq -r '.[] | select(.serviceArea=="Exchange") | .tcpPorts' office.txt | sort | uniq
or
jq -r '.[] | select(.serviceArea=="Exchange") | .tcpPorts' office.txt | sed 's/,/\n/'g | sort | uniq
----
===== References =====
https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service?view=o365-worldwide
https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-network-connectivity-principles?view=o365-worldwide#new-office-365-endpoint-categories