Skip to content

Network requirements

Managed devices need to reach Intune, Entra ID, the platform push notification services and content delivery networks. Corporate proxies and firewalls are the most common cause of "the device just stopped checking in".

Microsoft's Network endpoints for Microsoft Intune page is the authoritative, changing list. This page summarizes what matters and the traps to avoid.

Core endpoints

Purpose Endpoints Ports
Intune service manage.microsoft.com, *.manage.microsoft.com TCP 443 (and 80)
Authentication login.microsoftonline.com, plus the Microsoft 365 identity endpoints TCP 443
Device registration enterpriseregistration.windows.net, certauth.enterpriseregistration.windows.net TCP 443
Endpoint discovery go.microsoft.com TCP 80, 443
Diagnostics from client components *.events.data.microsoft.com TCP 443

If your firewall can't use domain names, Intune publishes IP ranges, and its Azure Front Door ranges are in the Azure service tags download under AzureFrontDoor.MicrosoftSecurity.

Windows

Purpose Endpoints Notes
Win32 apps and scripts (Intune Management Extension) Region-specific CDNs under manage.microsoft.com, such as imeswda-afd-primary.manage.microsoft.com for North America, plus *.trouter.communications.svc.cloud.microsoft Find your region in Tenant administration > Tenant details > Tenant location. Proxies must allow HTTP partial responses (byte ranges).
Win32 app content swd*-mscdn.manage.microsoft.com; aam-content-cdn.manage.microsoft.com for Enterprise App Catalog apps TCP 80, 443
Push notifications (WNS) *.notify.windows.com, *.wns.windows.com TCP 443. Without WNS, remote actions and immediate syncs wait for the next scheduled check-in.
Delivery Optimization *.do.dsp.mp.microsoft.com, *.dl.delivery.mp.microsoft.com TCP 80, 443. Peer-to-peer uses TCP 7680, and Teredo UDP 3544 for NAT traversal. Byte-range requests must be allowed.
Windows Update and Autopatch See the Windows Autopatch prerequisites

Apple

Purpose Endpoints Ports
Apple Push Notification service *.push.apple.com TCP 5223, with 443 as a fallback
Enrollment, activation, app downloads Apple's documented hosts (see Use Apple products on enterprise networks) TCP 443
Intune agent for macOS scripts and apps Region-specific macsidecar*.manage.microsoft.com TCP 443

Android

Purpose Notes
Android Enterprise Google lists the required hosts and ports in its Android Enterprise network requirements
Push notifications Firebase Cloud Messaging, including TCP 5228 to 5230
AOSP devices intunecdnpeasd.manage.microsoft.com on TCP 443

Proxies and TLS inspection

  • Don't inspect Intune, Entra ID or push notification traffic. Many management channels use certificate-based authentication that breaks when a proxy re-signs the traffic. Add the endpoints above to your TLS inspection bypass list.
  • No proxy authentication for system traffic. MDM and agent traffic runs as the system, not the user, and can't answer an authentication prompt.
  • Allow byte-range requests for app content and Delivery Optimization.
  • Remote and home users need direct internet access to these endpoints or a VPN split tunnel that includes them, or devices only check in when they're in the office.

Quick connectivity test on Windows

'manage.microsoft.com', 'login.microsoftonline.com', 'enterpriseregistration.windows.net' |
    ForEach-Object { Test-NetConnection -ComputerName $_ -Port 443 } |
    Select-Object ComputerName, TcpTestSucceeded

Learn more