Microsoft 365 network connectivity principles

Publisher

Microsoft

URL

https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-network-connectivity-principles

Published

2026-08-26

Updated

unknown

Accessed

2026-09-24

HTTP status

200

License

Microsoft Learn content; CC BY 4.0 for docs text per repository, verify; short excerpts and locators only

Source notes citing this source

• Microsoft recommends local DNS and local internet egress for Microsoft 365, avoiding network hairpins through intermediate security stacks or cloud gateways, and prioritising direct internet access over WAN backhaul. in context
• Microsoft says TLS termination or deep packet inspection of Microsoft 365 domains, and forcing protocol downgrade such as UDP to TCP, are untested scenarios known to cause connectivity issues. in context
• Microsoft lists migrating from traditional WAN to SD-WAN as one of its incremental Microsoft 365 connectivity optimisations, to improve WAN performance and manageability and reduce load on network devices. in context
• Microsoft lists blocking specific protocols or protocol versions on intermediate network infrastructure, with QUIC and WebSockets as examples, as known to cause Microsoft 365 connectivity issues. in context
• For all Required Microsoft 365 network endpoints, Microsoft recommends bypassing TLS decryption, traffic interception, deep packet inspection and network packet and content filtering. in context
• Microsoft does not support selective allow-listing of only the Microsoft 365 endpoints thought to serve particular scenarios, and says to apply its guidance to the full set of published required endpoints. in context
• Microsoft 365 admins can deliver PAC scripts through WPAD or GPO so that Microsoft 365 requests bypass the proxy and use direct internet connections. in context
• Microsoft lists forcing protocol downgrade or failover between client apps and Microsoft 365, such as UDP to TCP or TLS 1.3 to TLS 1.2, as a network scenario known to cause connectivity issues. in context
• Microsoft lists routing Microsoft 365 connections through network infrastructure that applies its own authentication, such as proxy authentication, as known to cause connectivity issues. in context
• Microsoft states that it has not tested TLS termination or deep packet inspection of any Microsoft 365 domain by customer proxies or other network devices, and that these are known to cause connectivity issues. in context

Cite this source record

APA

WarmTransfer. (2026, August 26). Microsoft 365 network connectivity principles. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-learn-m365-network-connectivity-principles

BibTeX

@misc{warmtransfer-ms-learn-m365-network-connectivity-principles,
  title  = {Microsoft 365 network connectivity principles},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-learn-m365-network-connectivity-principles},
  note   = {Microsoft, accessed 2026-09-24}
}