Security Compliance

Firewall requirements to include Microsoft 365 resources in ARM

To include Microsoft 365 resources in ARM, certain ports must be open and certain endpoints must be reachable.

First published date

10/7/2020 11:18 AM

Last published date

7/2/2021 3:06 PM

Overview

This article describes which ports must be open and which endpoints must be reachable in order to be able to include Microsoft 365 resources in ARM.

Product section

Access Rights Manager

Cause

To include Microsoft 365 resources in ARM, communication must be possible through port 443 (HTTPS) and possibly also through port 80 (HTTP).
Security policies may require that communication between the ARM server/collectors and Microsoft 365 is allowed only to specific endpoints.

Resolution

Endpoints
  1. Exchange Online: https://outlook.office365.com/powershell-liveid/ (can be configured)
  2. SharePoint Online: depends on customers configuration
  3. AzureAD, OneDrive, Teams: https://graph.microsoft.com, https://login.microsoftonline.com, https://manage.office.com/api/v1.0/
Ports
  1. For Exchange Online, ARM uses PowerShell for the connection (HTTPS, port 443)
  2. SharePoint Online can be configured by the customer by the URL he is using (HTTP, Port 80 oder HTTPS, Port 443)
  3. AzureAD, Teams, OneDrive: the APIs communicate via HTTPS, port 443