Configuration Manager Proxy Exceptions

This post provides a summary of the URLs required for Configuration Manager current branch to provide resources that require Internet access. Because Configuration Manager relies on other components, it can be difficult to find a single source of URLs required. Software Updates rely on Windows Server Updates Services (WSUS) and the Service Connection Point uses Intune and other online services.

The features of Configuration Manager that require Internet access are:

  • Asset Intelligence Synchronisation Point;
  • Configuration Manger Console (pending investigation);
  • Cloud Distribution Points (pending investigation, initial URLs added);
  • Software Update Point (SUP);
  • Windows Store for Business;
  • Intune Subscription;
  • Service Connection Point.

Configuration Manager URLs

The table below contains a list of URLs required by Configuration Manager components to connect to the Internet. If I've missed anything, please let me know by leaving a comment and I'll update it ASAP!

Source Destination URL Component
Asset Intelligence Synchronisation Point sc.microsoft.com.nsatc.net Asset Intelligence
SUP windowsupdate.microsoft.com Software Updates
SUP *.windowsupdate.microsoft.com Software Updates
SUP *.update.microsoft.com Software Updates
SUP *.windowsupdate.com Software Updates
SUP download.windowsupdate.com Software Updates
SUP download.microsoft.com Software Updates
SUP *.download.windowsupdate.com Software Updates
SUP wustat.windows.com Software Updates
SUP ntservicepack.microsoft.com Software Updates
SUP go.microsoft.com Software Updates
SUP officecdn.microsoft.com Office 365 Software Updates
SUP officecdn.microsoft.com.edgesuite.net Office 365 Software Updates
SUP config.office.com Office 365 Software Updates
Service Connection Point *akamaiedge.net Updates and Servicing
Service Connection Point *.manage.microsoft.com Updates and Servicing
Service Connection Point go.microsoft.com Updates and Servicing
Service Connection Point blob.core.windows.net Updates and Servicing
Service Connection Point download.microsoft.com Updates and Servicing
Service Connection Point sccmconnected-a01.cloudapp.net Updates and Servicing
Service Connection Point https://silverlight.dlservice.microsoft.com Updates and Servicing
Service Connection Point *.manage.microsoft.com Microsoft Intune
Service Connection Point https://bspmts.mp.microsoft.com/V1/ Microsoft Intune
Service Connection Point https://login.microsoftonline.com// Microsoft Intune
Service Connection Point download.microsoft.com Windows 10 Servicing
Service Connection Point https://go.microsoft.com/fwlink/?LinkID=619849 Windows 10 Servicing
Primary Site *.core.windows.net Cloud Distribution Point
Primary Site *.cloudapp.net Cloud Distribution Point
Primary Site https://bspmts.mp.microsoft.com/V1/ Windows Store for Business
Primary Site https://login.microsoftonline.com/ Windows Store for Business
Console login.windows.net/ Any component requiring logon to online services
Site Server has.spserv.microsoft.com Cloud Device Attestation Service

Certain services require direct access from Configuration Manager clients to the internet.

Source Destination URL Component
Client https://wdcp.microsoft.com Microsoft Active Protection Service
Client https://wdcpalt.microsoft.com Microsoft Active Protection Service
Client has.spserv.microsoft.com Cloud Device Attestation Service

Information Sources

The information above is collected from the following articles and random experience:

Last update: 5th January 2017

  • 4th May 2016 - Added Cloud Distribution Points
  • 23rd May 2016 - Added Office 365 Client Software Updates
  • 7th June 2016 - Microsoft has published requirements for a Service Connection Point
  • 13th November 2016 - Included Windows Store for Business
  • 5th January 2017 - Included endpoints for Microsoft Active Protection Service & added https://silverlight.dlservice.microsoft.com based on feedback
  • Included additional URLs based on feedback for Office 365 Updates and Console login to cloud services
  • 15th September 2017 - Added Device Health Attestation