misp-warninglists/lists/microsoft-office365/list.json

{
  "description": "Office 365 URLs and IP address ranges",
  "list": [
    "aadrm.com",
    "account.activedirectory.windowsazure.com",
    "account.live.com",
    "account.office.net",
    "accounts.accesscontrol.windows.net",
    "acompli.net",
    "activation.sls.microsoft.com",
    "activity.windows.com",
    "adl.windows.com",
    "admin.microsoft.com",
    "admin.onedrive.com",
    "adminwebservice.microsoftonline.com",
    "ajax.aspnetcdn.com",
    "aka.ms",
    "amp.azure.net",
    "api.passwordreset.microsoftonline.com",
    "apis.live.net",
    "appex-rf.msn.com",
    "appex.bing.com",
    "apps.identrust.com",
    "appsforoffice.microsoft.com",
    "aria.microsoft.com",
    "assets-yammer.com",
    "assets.onestore.ms",
    "auth.gfx.ms",
    "auth.microsoft.com",
    "autologon.microsoftazuread-sso.com",
    "azure-apim.net",
    "azureedge.net",
    "azurerms.com",
    "becws.microsoftonline.com",
    "blob.core.windows.net",
    "broadcast.skype.com",
    "c.bing.com",
    "c.bing.net",
    "c.live.com",
    "c1.microsoft.com",
    "cacerts.digicert.com",
    "ccs.login.microsoftonline.com",
    "cdn.odc.officeapps.live.com",
    "cdn.onenote.net",
    "cdn.uci.officeapps.live.com",
    "cdnprod.myanalytics.microsoft.com",
    "cert.int-x3.letsencrypt.org",
    "clientconfig.microsoftonline-p.net",
    "cloudapp.net",
    "companymanager.microsoftonline.com",
    "compass-ssl.microsoft.com",
    "compliance.microsoft.com",
    "cortana.ai",
    "crl.globalsign.com",
    "crl.globalsign.net",
    "crl.identrust.com",
    "crl.microsoft.com",
    "crl3.digicert.com",
    "crl4.digicert.com",
    "d.docs.live.net",
    "dc.services.visualstudio.com",
    "defender.microsoft.com",
    "device.login.microsoftonline.com",
    "dgps.support.microsoft.com",
    "directory.services.live.com",
    "docs.live.net",
    "docs.microsoft.com",
    "ecdn.microsoft.com",
    "ecn.dev.virtualearth.net",
    "enterpriseregistration.windows.net",
    "entrust.net",
    "eus-www.sway-cdn.com",
    "eus-www.sway-extensions.com",
    "events.data.microsoft.com",
    "excelbingmap.firstpartyapps.oaspapps.com",
    "firstpartyapps.oaspapps.com",
    "flow.microsoft.com",
    "g.live.com",
    "geotrust.com",
    "go.microsoft.com",
    "graph.microsoft.com",
    "graph.windows.net",
    "hip.live.com",
    "informationprotection.azure.com",
    "informationprotection.hosting.portal.azure.net",
    "isrg.trustid.ocsp.identrust.com",
    "keydelivery.mediaservices.windows.net",
    "login-us.microsoftonline.com",
    "login.live.com",
    "login.microsoft.com",
    "login.microsoftonline-p.com",
    "login.microsoftonline.com",
    "login.windows-ppe.net",
    "login.windows.net",
    "logincert.microsoftonline.com",
    "loginex.microsoftonline.com",
    "lync.com",
    "mail.protection.outlook.com",
    "manage.microsoft.com",
    "management.azure.com",
    "media.azure.net",
    "mem.gfx.ms",
    "microsoft.com",
    "microsoftonline-p.com",
    "microsoftonline.com",
    "microsoftstream.com",
    "microsoftusercontent.com",
    "mlccdn.blob.core.windows.net",
    "mlccdnprod.azureedge.net",
    "msauth.net",
    "msauthimages.net",
    "mscrl.microsoft.com",
    "msdn.microsoft.com",
    "msecnd.net",
    "msftauth.net",
    "msftauthimages.net",
    "msftidentity.com",
    "msidentity.com",
    "msocdn.com",
    "mstea.ms",
    "myanalytics-gcc.microsoft.com",
    "myanalytics.microsoft.com",
    "nexus.microsoftonline-p.com",
    "nps.onyx.azure.net",
    "o15.officeredir.microsoft.com",
    "o365weve.com",
    "ocos-office365-s2s.msedge.net",
    "ocsp.digicert.com",
    "ocsp.globalsign.com",
    "ocsp.int-x3.letsencrypt.org",
    "ocsp.msocsp.com",
    "ocsp2.globalsign.com",
    "ocspx.digicert.com",
    "office.com",
    "office.live.com",
    "office.net",
    "office15client.microsoft.com",
    "office365.com",
    "officeapps.live.com",
    "officecdn.microsoft.com",
    "officecdn.microsoft.com.edgesuite.net",
    "officeclient.microsoft.com",
    "officepreviewredir.microsoft.com",
    "officeredir.microsoft.com",
    "officespeech.platform.bing.com",
    "omniroot.com",
    "oneclient.sfx.ms",
    "onenote.com",
    "online.office.com",
    "onmicrosoft.com",
    "outlook.com",
    "outlook.office.com",
    "outlook.office365.com",
    "outlookmobile.com",
    "partnerservices.getmicrosoftkey.com",
    "passwordreset.microsoftonline.com",
    "peoplegraph.firstpartyapps.oaspapps.com",
    "phonefactor.net",
    "platform.linkedin.com",
    "policykeyservice.dc.ad.msft.net",
    "portal.cloudappsecurity.com",
    "powerapps.com",
    "prod.firstpartyapps.oaspapps.com.akadns.net",
    "prod.msocdn.com",
    "protection.office.com",
    "protection.outlook.com",
    "provisioningapi.microsoftonline.com",
    "public-trust.com",
    "r.office.microsoft.com",
    "search.production.apac.trafficmanager.net",
    "search.production.emea.trafficmanager.net",
    "search.production.us.trafficmanager.net",
    "secure.globalsign.com",
    "secure.skypeassets.com",
    "security.microsoft.com",
    "sfbassets.com",
    "sharepoint.com",
    "sharepointonline.com",
    "shellprod.msocdn.com",
    "signup.live.com",
    "skype.com",
    "skypeforbusiness.com",
    "smtp.office365.com",
    "spoprod-a.akamaihd.net",
    "ssw.live.com",
    "staffhub.ms",
    "storage.live.com",
    "streaming.mediaservices.windows.net",
    "support.microsoft.com",
    "svc.ms",
    "sway.com",
    "symcb.com",
    "symcd.com",
    "teams.microsoft.com",
    "technet.microsoft.com",
    "telemetryservice.firstpartyapps.oaspapps.com",
    "tse1.mm.bing.net",
    "users.storage.live.com",
    "verisign.com",
    "verisign.net",
    "virtualearth.net",
    "wikipedia.firstpartyapps.oaspapps.com",
    "wns.windows.com",
    "wus-firstpartyapps.oaspapps.com",
    "wus-www.sway-cdn.com",
    "wus-www.sway-extensions.com",
    "www.acompli.com",
    "www.bing.com",
    "www.digicert.com",
    "www.microsoft.com",
    "www.microsoft365.com",
    "www.onedrive.com",
    "www.outlook.com",
    "www.sway.com",
    "yammer.com",
    "yammerusercontent.com"
  ],
  "matching_attributes": [
    "domain",
    "domain|ip",
    "hostname"
  ],
  "name": "List of known Office 365 URLs",
  "type": "string",
  "version": 20230102
}