Microsoft office 365.

[JReese]

I have a customer that uses Office365, and I found out a few weeks ago that this failed due to Microsoft changing their IP's.

I have looked and so far Microsoft seem to not give FQDN for their server supporting the office suite that I can find.

I have found however that Microsoft has a lot of online document that have 365 pages and more.

[hshah]

Hi Jeff,

Are you looking for IP address for office 365? 

If its something else provide us more details.

Regards,

Hardik Shah

[JReese]

No I have the IP's but I would think that MS would use domain names to prevent the companies from having to manually readdress each time MS changes the office365 IP's.

I am also hoping PA can create something to make our customers job easier for the same actions.

[hshah]

Hi Jeff,

Do you need IP to allow or block 365, if yes you dont need it.

You can allow/block it based on application. Thats the advantage of having next-generation firewall.

Lets say if someone wants to block facebook, then he doesnt have to specify facebook IPs in policy. Which is different world wide.

Just specify facebook in application field of policy, palo alto will identify it based on packet excahgne.

In your case specify office 365 in policy that will take care of it.

Regards,

Hardik Shah

[jperry1]

Jeff Reese

Also keep in mind that if the customer is using Microsoft Office 365 as a front end CAS server and then has mail distributed to an onsite Exchange server then our application signature will not work. You will have to manually create address objects for the exchange Office365 subnets that are allowed and place them in an address group to apply to your security policy. But if it's just browser based Office 365 then the application signature will work. Hope this helps Jeff.