Intune network endpoints & ports
Last reviewed 2026-07-18 by the Just Software engineering team · print-friendly
Devices must reach these services directly — TLS inspection and authenticated proxies break enrolment and check-in. Allow the wildcard domains rather than pinning IP addresses where possible.
Authoritative source: these endpoints change over time. Always confirm against Microsoft's own list at learn.microsoft.com/en-us/intune/intune-service/fundamentals/intune-endpoints before finalising firewall rules. Microsoft also publishes the list as a machine-readable service tag / endpoint feed.
Core Intune service
| Endpoint |
Port |
Purpose |
*.manage.microsoft.com |
TCP 80, 443 |
Intune enrolment, check-in, policy and app delivery |
manage.microsoft.com |
TCP 80, 443 |
Intune service entry point |
*.dm.microsoft.com |
TCP 443 |
Device management (MDM) traffic |
login.microsoftonline.com |
TCP 443 |
Entra ID authentication |
graph.microsoft.com |
TCP 443 |
Microsoft Graph (service and admin tooling) |
enterpriseregistration.windows.net |
TCP 443 |
Device registration with Entra ID |
portal.manage.microsoft.com |
TCP 443 |
Company Portal website |
Windows enrolment, Autopilot and updates
| Endpoint |
Port |
Purpose |
ztd.dds.microsoft.com, cs.dds.microsoft.com |
TCP 443 |
Autopilot deployment service |
login.live.com |
TCP 443 |
Autopilot device authentication (MSA ticket) |
time.windows.com |
UDP 123 |
NTP time sync — Autopilot/TPM attestation fails with badly skewed clocks |
*.windowsupdate.com |
TCP 80, 443 |
Windows Update content |
*.update.microsoft.com |
TCP 443 |
Windows Update service |
*.delivery.mp.microsoft.com |
TCP 80, 443 |
Update/app content delivery |
*.do.dsp.mp.microsoft.com |
TCP 443 |
Delivery Optimization service |
| — (LAN peers) |
TCP 7680 |
Delivery Optimization peer-to-peer on the local network |
| Teredo |
UDP 3544 |
Delivery Optimization group/internet peering (optional) |
Apple (iOS/iPadOS/macOS enrolment)
| Endpoint |
Port |
Purpose |
17.0.0.0/8 |
TCP 5223, 443, 80 |
Apple's network block — APNs and services |
*.push.apple.com |
TCP 5223 (fallback 443) |
Apple Push Notification service — devices won't check in without it |
*.itunes.apple.com, *.apps.apple.com |
TCP 443 |
App Store / VPP app delivery |
albert.apple.com |
TCP 443 |
Device activation |
Note: APNs is required on the device network (corporate Wi-Fi), not just the server side. Port 5223 from the device to *.push.apple.com; devices fall back to 443 only on some networks.
Google (Android enrolment)
| Endpoint |
Port |
Purpose |
mtalk.google.com |
TCP 5228–5230 |
Firebase Cloud Messaging (push) — required for policy delivery |
*.googleapis.com |
TCP 443 |
Android management APIs |
play.google.com, *.gvt1.com |
TCP 443 |
Managed Google Play and app content |
accounts.google.com |
TCP 443 |
Google account/work profile provisioning |
Port summary
| Port |
Protocol |
Used by |
| 443 |
TCP |
Everything — the baseline requirement |
| 80 |
TCP |
CRL/AIA fetches, some content delivery |
| 5223 |
TCP |
Apple Push Notification service |
| 5228–5230 |
TCP |
Google Firebase Cloud Messaging |
| 7680 |
TCP |
Delivery Optimization LAN peering |
| 3544 |
UDP |
Delivery Optimization (Teredo, optional) |
| 123 |
UDP |
NTP (time.windows.com) |
Rules of thumb: no SSL inspection on *.manage.microsoft.com, *.dm.microsoft.com, APNs or FCM; allow certificate revocation endpoints (port 80) or chain validation fails; and re-check Microsoft's endpoint doc after service updates — this sheet is a starting point, not a contract.