topic Office 365 App-ID in General Topics

Office 365 App-ID

Manu_Shankar — Tue, 24 Nov 2020 10:47:41 GMT

Hi,

We are in the process of implementing office 365. May I know what is the correct APP-ID for the below services? Please share if there is any best practice document for this.

Microsoft Stream
Audio Conferencing
My Analytics
Azure Active Directory
Azure Information Protection
Privileged Access Management
Privileged Identity Management
Management and security
Advanced Security Management
Intune (MDM)
Microsoft 365 Cloud App Security
Advanced Threat Protection

Thanks,

Manu

Re: Office 365 App-ID

S.Cantwell — Tue, 01 Dec 2020 02:26:22 GMT

Hello there

This is somewhat of a loaded gun type of question.

There are 3360 apps known to the FW.

The list you described are general "umbrella" type traffic, that could hit many of the apps IDs.

Microsoft streaming and Office365 are two, somewhat overlapping but also disparate traffic patterns.

What you should do, is only allow traffic from the inside of your network, to the known O365 IPs (or use FQDN address object) and allow "any" application on the "application default" ports.

Now, because the traffic can only goto approved O365 addresses, the FW will see what the apps are, and then tell you (looking at logs, using the Apps Detected columns in 9.0 and higher) to tell you what apps are seen.

You can then allow these apps, or refine them to only what you needed.

I apologize for the general overview, but your question cannot really be answered in specifics.

Re: Office 365 App-ID

Manu_Shankar — Wed, 02 Dec 2020 08:28:39 GMT

@S.Cantwell , thank you.