Implementing VPN split tunneling for Microsoft 365

Publisher

Microsoft

URL

https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-vpn-implement-split-tunnel

Published

2026-06-26

Updated

unknown

Accessed

2026-09-25

HTTP status

200

License

Microsoft Learn terms of use (CC BY 4.0 for docs content in MicrosoftDocs repos; verify); no-redistribution; short excerpts and locators only

Source notes citing this source

• The current Optimize IP ranges and URLs can be queried from the Microsoft 365 IP and URL web service at endpoints.office.com by filtering on category Optimize. in context
• Microsoft's Optimize endpoint category is a small set of endpoints that carries around 70-80% of Microsoft 365 traffic volume and includes the latency-sensitive Teams media endpoints; these are the endpoints to divert away from the VPN tunnel. in context
• Microsoft's recommended remote-access change for Microsoft 365 is to move VPN clients from a forced tunnel to a forced tunnel with a small number of trusted exceptions (its split tunnel model #2). in context
• Microsoft's route-table example lists the Teams media endpoints as 52.112.0.0/14, 52.122.0.0/15 and 2603:1063::/38. in context

Cite this source record

APA

WarmTransfer. (2026, June 26). Implementing VPN split tunneling for Microsoft 365. WarmTransfer. https://warmtransfer.net/knowledge/sources/ms-learn-m365-vpn-implement-split-tunnel

BibTeX

@misc{warmtransfer-ms-learn-m365-vpn-implement-split-tunnel,
  title  = {Implementing VPN split tunneling for Microsoft 365},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/ms-learn-m365-vpn-implement-split-tunnel},
  note   = {Microsoft, accessed 2026-09-25}
}