MS O365 ip address range

[Alex_Samad]

Hi

Any one know if PA have a dynmic range that covers MS ip address range.

Seems like the sort of thing that would be easy to implement and would save me a lot of time.

A

[reaper]

hi @Alex_Samad

There are only dynamic lists for malicious IPs provided by Palo Alto Networks, but you can easily get external dynamic lists and import them through an EDL object

[JoeAndreini]

I do not have an instance to test, but you can create an O365 list in minemeld:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Safely-Enable-access-to-Office-365-usi...

In the past I have used the API and a powershell script to pull the list from Microsoft and create a dynamic address list from that, here are a few articles to point you in the right general direction:

https://support.office.com/en-us/article/office-365-urls-and-ip-address-ranges-8548a211-3fe7-47cb-ab...

https://gallery.technet.microsoft.com/office/Get-Office-365-IP-v4-562987d5

A smiliar strategy could be used to dump the list to an EDL if you have somewhere available to host it.

[BPry · Accepted solution]

@Alex_Samad,

Highly recommend spinning up MineMeld and simply using that to find the Office 365 addresses as it allow you to do a number of other EDL list mining to form usefull EDLs that can be utilized throughout the firewall. 

[vsys_remo · Accepted solution]

Use Minemeld! You'll see that it will be useful in quite a few other situations than simply for o365.

(Or vote for FR ID 9113 and wait for the implementation)