Table of Contents
Blocklists - Microsoft - Get Microsoft URLs, IP addresses and Ports
Microsoft updates the Office 365 IP address and FQDN entries at the end of each month.
Out-of-band updates are sometimes published due to support incidents, security updates or other operational requirements.
Create a GUID
Microsoft require a GUID to download the list of current URLs and IPs.
By default, Microsoft uses the following UUID, b10c5ed1-bad1-445f-b386-b919946339a7, as an example, but this specific UUID may be disallowed in future, so it is recommended to use an alternative UUID.
uuidgen
returns:
948beb0b-32bb-4e1c-a67d-091c861a0cc6
NOTE: There are alternative ways to create a UUID.
Download the endpoints file
curl https://endpoints.office.com/endpoints/worldwide?clientrequestid=948beb0b-32bb-4e1c-a67d-091c861a0cc6 > office.txt
returns:
% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 56888 100 56888 0 0 76053 0 --:--:-- --:--:-- --:--:-- 75951
NOTE: This will download the file in JSON format.
- CSV format is also available by adding &format=CSV.
- For example
curl "https://endpoints.office.com/endpoints/worldwide?noipv6&format=CSV&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office2.txt
The actual Data columns in the file:
- ID: The ID number of the row, also known as an endpoint set.
- Category: Shows whether the endpoint set is categorized as “Optimize”, “Allow”, or “Default”.
- ER: This is Yes if the endpoint set is supported over Azure ExpressRoute with Office 365 route prefixes.
- Addresses: Lists the FQDNs or wildcard domain names and IP Address ranges for the endpoint set.
- An IP Address range is in CIDR format and may include many individual IP Addresses in the specified network.
- Ports: Lists the TCP or UDP ports that are combined with the Addresses to form the network endpoint.
- There may be some duplication in IP Address ranges where there are different ports listed.
Alternative Options to used with the curl command, including:
- ServiceAreas=<Common | Exchange | SharePoint | Skype>
- NoIPv6=<true | false>
- Instance=<Worldwide | China | Germany | USGovDoD | USGovGCCHigh>
For example:
- To exclude IPv6, use this:
curl "https://endpoints.office.com/endpoints/worldwide?noipv6&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office.txt
- To download only for the Skype service, in CSV format:
curl "https://endpoints.office.com/endpoints/worldwide?ServiceAreas=Skype&noipv6&format=CSV&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office.txt
- To download only the China instance:
curl "https://endpoints.office.com/endpoints/China?noipv6&format=CSV&ClientRequestId=948beb0b-32bb-4e1c-a67d-091c861a0cc6" > office.txt
The UUID created earlier is used with the curl commands.
- The default UUID provided by Microsoft, b10c5ed1-bad1-445f-b386-b919946339a7, could also be used.
Check list of Services
jq -r '.[].serviceArea' office.txt | sort | uniq
returns:
Common Exchange SharePoint Skype
NOTE: The Skype service includes Microsoft Teams.
Because Common service area items are a prerequisite for all other service areas, the web service always includes them.
Get IPs for the Specific Service
Assuming IPs for the Exchange Service is needed.
jq -r '.[] | select(.serviceArea=="Exchange") | select(.ips) .ips[]' office.txt | sort -t . -k1,1n -k2,2n -k3,3n -k4,4n | uniq
returns:
13.107.6.152/31 13.107.18.10/31 13.107.128.0/22 23.103.160.0/20 40.92.0.0/15 40.96.0.0/13 40.104.0.0/15 40.107.0.0/16 52.96.0.0/14 52.100.0.0/14 52.238.78.88/32 104.47.0.0/17 131.253.33.215/32 132.245.0.0/16 150.171.32.0/22 204.79.197.215/32
NOTE: The following query could be used, but be aware that this may sometimes drop some IPs. See Numeric Sort Bug.
jq -r '.[] | select(.serviceArea=="Exchange") | select(.ips) .ips[]' office.txt | sort | uniq
Get Current List of URLs
jq -r '.[] | select(.serviceArea=="Exchange") | select(.urls) .urls[]' office.txt | sort -t . -k1,1n -k2,2n -k3,3n -k4,4n | uniq
returns:
Get Current List of Ports
jq -r '.[] | select(.serviceArea=="Exchange") | .tcpPorts' office.txt | sort | uniq
or
jq -r '.[] | select(.serviceArea=="Exchange") | .tcpPorts' office.txt | sed 's/,/\n/'g | sort | uniq