Microsoft 365 IP ranges

Official Microsoft 365 ranges from the vendor's publication, split by purpose: common, exchange, sharepoint, teams. The ranges below render live from the signed slash0 feed.

The feed classifies this service as mixed: not every purpose runs on vendor-dedicated infrastructure. Review a purpose before treating its ranges as exclusively Microsoft 365.

purpose	direction	IPv4	IPv6
`microsoft-365/common`	egress	·	·
`microsoft-365/exchange`	egress	·	·
`microsoft-365/sharepoint`	egress	·	·
`microsoft-365/teams`	egress	·	·

microsoft-365/common

Direction: egress. Ranges your workloads connect out to; use them in security group egress rules.

loading ranges from the feed…

Terraform

data "ipranges_egress" "microsoft_365_common" {
  service = "microsoft-365"
  purpose = "common"
}

resource "aws_security_group_rule" "microsoft_365_common" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.microsoft_365_common.ipv4_cidrs
  ipv6_cidr_blocks  = data.ipranges_egress.microsoft_365_common.ipv6_cidrs
  security_group_id = aws_security_group.app.id
}

microsoft-365/exchange

Direction: egress. Ranges your workloads connect out to; use them in security group egress rules.

loading ranges from the feed…

Terraform

data "ipranges_egress" "microsoft_365_exchange" {
  service = "microsoft-365"
  purpose = "exchange"
}

resource "aws_security_group_rule" "microsoft_365_exchange" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.microsoft_365_exchange.ipv4_cidrs
  ipv6_cidr_blocks  = data.ipranges_egress.microsoft_365_exchange.ipv6_cidrs
  security_group_id = aws_security_group.app.id
}

microsoft-365/sharepoint

Direction: egress. Ranges your workloads connect out to; use them in security group egress rules.

loading ranges from the feed…

Terraform

data "ipranges_egress" "microsoft_365_sharepoint" {
  service = "microsoft-365"
  purpose = "sharepoint"
}

resource "aws_security_group_rule" "microsoft_365_sharepoint" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.microsoft_365_sharepoint.ipv4_cidrs
  ipv6_cidr_blocks  = data.ipranges_egress.microsoft_365_sharepoint.ipv6_cidrs
  security_group_id = aws_security_group.app.id
}

microsoft-365/teams

Direction: egress. Ranges your workloads connect out to; use them in security group egress rules.

loading ranges from the feed…

Terraform

data "ipranges_egress" "microsoft_365_teams" {
  service = "microsoft-365"
  purpose = "teams"
}

resource "aws_security_group_rule" "microsoft_365_teams" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = data.ipranges_egress.microsoft_365_teams.ipv4_cidrs
  ipv6_cidr_blocks  = data.ipranges_egress.microsoft_365_teams.ipv6_cidrs
  security_group_id = aws_security_group.app.id
}

keep rules current automatically

Terraform data sources refresh only when you run an apply. The hosted tier publishes the same data via AWS managed prefix lists (slash0.microsoft-365.common.v4 and so on), shared into your account via AWS RAM: rules reference one pl-… id and update within a minute of a vendor change, with removals held through a 72 hour grace window. Request early access or read how it works.

provenance

Ranges come from Microsoft 365's official publication: https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-ip-web-service. Fetched sources:

https://endpoints.office.com/endpoints/worldwide?clientrequestid=<uuid>

Every publish is signed (ECDSA P-256 over the feed index, each service document hash-chained to it) and every range change is recorded in the changelog. Verification steps: security. Provider setup: quickstart.