Update your firewall rules to allow outbound traffic on port 443 to new CDN endpoints and specific IP addresses by March 27, 2025, to ensure uninterrupted access to Microsoft Defender for Cloud Apps. Detailed instructions and required IP addresses are available in the provided documentation links.
Due to ongoing work on Microsoft Defender for Cloud Apps aimed at improving security and performance, you are required to update network information in your system's firewall and additional third-party services by the dates noted below.
When this will happen:
Please follow these instructions by March 27, 2025, to ensure uninterrupted access to our services.
How this affects your organization:
You are receiving this message because our reporting indicates your organization may be using Microsoft Defender for Cloud Apps. Administrators may no longer be able to access Microsoft Defender for Cloud Apps services if the changes listed below are not completed by March 27, 2025, when this change is implemented.
What you need to do to prepare:
Please update your firewall rules to allow outbound traffic on port 443 to the new CDN endpoints before March 27, 2025:
All required outbound access URLs can also be found in Defender for Cloud Apps network requirements page under 'Portal Access'.
To use Defender for Cloud Apps in the Microsoft Defender Portal, make sure you add outbound port 443 for all IP addresses and DNS names listed in our documentation to your firewall's allowlist.
To connect to third-party apps, enable Defender for Cloud Apps to connect from these IP addresses, also available in our documentation:
For US Government GCC and GCC High customers, to ensure the proper function of access controls, the following IP addresses used by our reverse proxy regions should be added to the allow list for both inbound and outbound connections:
To stay up to date on IP ranges that impact the experiences in Microsoft Defender for Cloud Apps in the areas of portal experience access, access and session controls, SIEM agent connection, app connectors, mail server, and log collector, it's recommended to refer to the Microsoft Azure service tag documentation. The latest IP ranges for Microsoft Defender for Cloud Apps services are found in the service tag 'MicrosoftCloudAppSecurity'. For more information, Virtual network service tags.
When this change takes effect, you will not need to take any action if you have followed the instructions above.
Learn more: Network requirements