Data/endpoints.json
|
{ "$comment": "DoctorDO endpoint manifest: the network endpoints Delivery Optimization and Windows Update need, as Microsoft documents them, each citing the Microsoft page it comes from (sources). The connectivity checks read it at run time. Hosts are never guessed: a wildcard is probed only on a host the device itself used (observed) or one a cited Microsoft page names (documentedHosts); otherwise it is reported not testable.", "version": 1, "verified": "2026-10-19", "sources": { "EP": { "title": "Microsoft Connected Cache content and services endpoints", "url": "https://learn.microsoft.com/windows/deployment/do/delivery-optimization-endpoints", "msDate": "2026-04-07" }, "CFG": { "title": "Configure Delivery Optimization for Windows", "url": "https://learn.microsoft.com/windows/deployment/do/delivery-optimization-configure", "msDate": "2026-05-20" }, "PROXY": { "title": "Using a proxy with Delivery Optimization", "url": "https://learn.microsoft.com/windows/deployment/do/delivery-optimization-proxy", "msDate": "2026-05-20" }, "FAQ": { "title": "Delivery Optimization frequently asked questions", "url": "https://learn.microsoft.com/windows/deployment/do/waas-delivery-optimization-faq", "msDate": "2026-09-29" }, "TSHOOT": { "title": "Troubleshoot Delivery Optimization", "url": "https://learn.microsoft.com/windows/deployment/do/delivery-optimization-troubleshoot", "msDate": "2026-05-20" }, "WIN11": { "title": "Manage connection endpoints for Windows 11 Enterprise", "url": "https://learn.microsoft.com/windows/privacy/manage-windows-11-endpoints", "msDate": "2026-06-16" }, "WIN2004": { "title": "Connection endpoints for Windows 10 Enterprise, version 2004", "url": "https://learn.microsoft.com/previous-versions/windows/it-pro/privacy/manage-windows-2004-endpoints", "msDate": "2024-08-01" }, "WUTS": { "title": "Windows Update issues troubleshooting", "url": "https://learn.microsoft.com/troubleshoot/windows-client/installing-updates-features-roles/windows-update-issues-troubleshooting", "msDate": "2026-02-12" }, "WUSEC": { "title": "Windows Update security", "url": "https://learn.microsoft.com/windows/deployment/update/windows-update-security", "msDate": "2024-08-15" }, "EDGE": { "title": "Allowlist for Microsoft Edge endpoints", "url": "https://learn.microsoft.com/deployedge/microsoft-edge-security-endpoints", "msDate": "2026-09-17" }, "M365": { "title": "Microsoft 365 URLs and IP address ranges", "url": "https://learn.microsoft.com/microsoft-365/enterprise/urls-and-ip-address-ranges", "msDate": "2026-08-14" }, "TEREDO": { "title": "Required firewall exceptions for Teredo", "url": "https://learn.microsoft.com/windows/win32/teredo/required-firewall-exceptions-for-teredo", "msDate": "2018-05-31" }, "MCCVERIFY": { "title": "Verify Microsoft Connected Cache for Enterprise and Education cache node functionality", "url": "https://learn.microsoft.com/windows/deployment/do/mcc-ent-verify-cache-node", "msDate": "2025-07-23" }, "MCCPRE": { "title": "Microsoft Connected Cache for Enterprise and Education prerequisites", "url": "https://learn.microsoft.com/windows/deployment/do/mcc-ent-prerequisites", "msDate": "2026-04-07" } }, "endpoints": [ { "id": "do-cloud", "service": "do-cloud", "label": "Delivery Optimization cloud service", "pattern": "*.do.dsp.mp.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3], "scope": "always", "callers": [], "pinned": true, "http": false, "range": false, "maxHosts": 2, "severity": "critical", "documentedHosts": [{ "host": "geo.prod.do.dsp.mp.microsoft.com", "relation": "match", "source": "PROXY", "anchor": "endpoints-to-exempt-from-tls-inspection" }], "citations": [{ "source": "EP", "anchor": "" }, { "source": "CFG", "anchor": "firewall" }, { "source": "PROXY", "anchor": "proxy-requirements" }], "why": "Peer discovery, configuration and content metadata. Without it a device gets no peer matches, every byte comes from the CDN, and Connected Cache cannot initialise. Certificate-pinned: TLS inspection breaks it. Microsoft's pages differ on the ports: the Delivery Optimization pages list HTTPS 443, which is what is tested, while the Edge and Copilot pages list it as (80, 443): HTTP port 80 and HTTPS port 443.", "verified": "2026-10-19" }, { "id": "do-array", "service": "do-cloud", "label": "Delivery Optimization peer matching (array)", "pattern": "array*.prod.do.dsp.mp.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [1, 2, 3], "scope": "always", "callers": [], "pinned": true, "http": false, "range": false, "maxHosts": 1, "severity": "critical", "documentedHosts": [], "citations": [{ "source": "PROXY", "anchor": "endpoints-to-exempt-from-tls-inspection" }], "why": "The DO cloud service instance that returns peers. Certificate-pinned: Microsoft lists it as an endpoint that must be exempt from TLS inspection. No concrete host is documented, so it is tested only on a host this device used.", "verified": "2026-10-13" }, { "id": "do-content", "service": "do-content", "label": "Delivery Optimization content and metadata CDN", "pattern": "*.dl.delivery.mp.microsoft.com", "wildcard": true, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": true, "range": true, "maxHosts": 2, "severity": "critical", "documentedHosts": [ { "host": "msedge.b.dl.delivery.mp.microsoft.com", "relation": "match", "source": "EDGE", "anchor": "download-locations-for-microsoft-edge" }, { "host": "msedge.f.dl.delivery.mp.microsoft.com", "relation": "match", "source": "EDGE", "anchor": "download-locations-for-microsoft-edge" } ], "citations": [{ "source": "EP", "anchor": "" }, { "source": "CFG", "anchor": "firewall" }, { "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WUTS", "anchor": "issues-related-to-httpproxy" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Windows Update, Defender, driver, Store, Edge and Teams payloads, and DO metadata. Must pass HTTP byte-range requests: DO downloads in pieces. HTTP 80 is tested. Microsoft also lists HTTPS 443 for this name (Teams content; the Windows 11 page says TLSv1.2/HTTPS/HTTP), but only some of its hosts serve HTTPS (Edge's msedge.sb and msedge.sf): the HTTP content hosts answer TLS with a CDN certificate for another name (seen 19 Oct 2026), so a TLS check on the hosts a device used would fail where nothing is wrong, and HTTPS 443 is not tested here.", "verified": "2026-10-19" }, { "id": "wu-content", "service": "wu-content", "label": "Windows Update content (windowsupdate.com)", "pattern": "*.windowsupdate.com", "wildcard": true, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": true, "range": true, "maxHosts": 2, "severity": "critical", "documentedHosts": [{ "host": "download.windowsupdate.com", "relation": "match", "source": "FAQ", "anchor": "how-does-delivery-optimization-handle-vpns" }], "citations": [{ "source": "EP", "anchor": "" }, { "source": "CFG", "anchor": "firewall" }, { "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WUTS", "anchor": "device-cant-access-update-files" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Operating system patches and updates, and DO metadata. Use HTTP here, not HTTPS: Microsoft warns the connection fails otherwise.", "verified": "2026-10-19" }, { "id": "wu-ctl", "service": "wu-metadata", "label": "Certificate trust list updates", "pattern": "ctldl.windowsupdate.com", "wildcard": false, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": true, "range": false, "maxHosts": 1, "severity": "warning", "documentedHosts": [], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Automatic Root Certificates Update contacts Windows Update for the certificate trust list. Without it roots are not refreshed and TLS to other endpoints can start failing.", "verified": "2026-10-19" }, { "id": "wu-service", "service": "wu-metadata", "label": "Windows Update and Store service (delivery.mp)", "pattern": "*.delivery.mp.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": true, "http": false, "range": false, "maxHosts": 1, "severity": "critical", "documentedHosts": [{ "host": "fe3.delivery.mp.microsoft.com", "relation": "match", "source": "WUTS", "anchor": "feature-updates-arent-being-offered-while-other-updates-are" }], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }, { "source": "WUTS", "anchor": "device-cant-access-update-files" }, { "source": "WUSEC", "anchor": "securing-metadata-connections" }], "why": "Windows Update scan (metadata) and Store online services, over HTTPS. Certificate-pinned: TLS proxies must pass it without interception.", "verified": "2026-10-19" }, { "id": "wu-update", "service": "wu-metadata", "label": "Windows Update and Microsoft Update service (update.microsoft.com)", "pattern": "*.update.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": true, "http": false, "range": false, "maxHosts": 1, "severity": "critical", "documentedHosts": [], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }, { "source": "WUTS", "anchor": "device-cant-access-update-files" }, { "source": "WUSEC", "anchor": "securing-metadata-connections" }], "why": "Connections to Windows Update and Microsoft Update. The pages cited name no concrete host, so it is tested only on a host this device used.", "verified": "2026-10-19" }, { "id": "wu-traffic-shaping", "service": "wu-metadata", "label": "Windows Update content regulation", "pattern": "tsfe.trafficshaping.dsp.mp.microsoft.com", "wildcard": false, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "warning", "documentedHosts": [], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }, { "source": "WUTS", "anchor": "device-cant-access-update-files" }, { "source": "FAQ", "anchor": "how-does-delivery-optimization-handle-vpns" }], "why": "Content regulation for the Windows Update Agent; without it fallback behaviour is used.", "verified": "2026-10-19" }, { "id": "wu-emdl", "service": "wu-content", "label": "Windows Update content (emdl)", "pattern": "emdl.ws.microsoft.com", "wildcard": false, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": true, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [], "citations": [{ "source": "WUTS", "anchor": "device-cant-access-update-files" }], "why": "Listed among the endpoints Windows Update must reach over HTTP (the article's Windows 10 2004 example). When verified the name did not exist in public DNS, so it may be retired: advisory, and a name that does not exist is reported as a warning.", "verified": "2026-10-13" }, { "id": "wu-compat", "service": "wu-metadata", "label": "Compatibility database updates", "pattern": "adl.windows.com", "wildcard": false, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": true, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Compatibility database updates for Windows, used when evaluating feature updates. HTTP 80 is tested. The Windows 11 page lists HTTPS for it, but the CDN that serves it answers TLS with a certificate for another name (an Akamai one, seen 19 Oct 2026), so a TLS check would fail where nothing is wrong; if your firewall opens only HTTPS for it, this check reports TCP 80 as blocked.", "verified": "2026-10-19" }, { "id": "wu-msa", "service": "wu-metadata", "label": "Microsoft account sign-in (feature update offers)", "pattern": "*login.live.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [{ "host": "login.live.com", "relation": "match", "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }, { "source": "WUTS", "anchor": "feature-updates-arent-being-offered-while-other-updates-are" }], "why": "Microsoft documents the Windows Update and Store endpoints as dependent on the Microsoft Account endpoints, and feature update scans need the Microsoft Account Sign-in Assistant for the global device ID.", "verified": "2026-10-19" }, { "id": "teredo-do", "service": "teredo", "label": "Teredo server for Delivery Optimization", "pattern": "win1910.ipv6.microsoft.com", "wildcard": false, "ports": [{ "port": 3544, "protocol": "udp" }], "modes": [2, 3], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "warning", "documentedHosts": [], "citations": [{ "source": "CFG", "anchor": "firewall" }, { "source": "CFG", "anchor": "ports" }], "why": "Teredo NAT traversal for Group (2) and Internet (3) peers behind different NATs. UDP: name resolution is tested; reachability of a connectionless port cannot be confirmed by a probe.", "verified": "2026-10-13" }, { "id": "teredo-server", "service": "teredo", "label": "Teredo server name", "pattern": "teredo.ipv6.microsoft.com", "wildcard": false, "ports": [{ "port": 3544, "protocol": "udp" }], "modes": [2, 3], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [], "citations": [{ "source": "TEREDO", "anchor": "" }], "why": "The client firewall must allow resolution of this name and UDP 3544 for Teredo clients to reach the Teredo server.", "verified": "2026-10-13" }, { "id": "store-catalog", "service": "store", "label": "Microsoft Store catalog", "pattern": "*displaycatalog.mp.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "warning", "documentedHosts": [{ "host": "displaycatalog.mp.microsoft.com", "relation": "match", "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Communication with the Microsoft Store: apps cannot be installed or updated without it. The pattern has no dot after the asterisk, so its bare name is itself a match.", "verified": "2026-10-19" }, { "id": "store-licensing", "service": "store", "label": "Licensing and online activation", "pattern": "*licensing.mp.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [{ "host": "licensing.mp.microsoft.com", "relation": "match", "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Online activation and app licensing; Store app installs need it.", "verified": "2026-10-19" }, { "id": "store-revocation", "service": "store", "label": "Store app licence revocation", "pattern": "storecatalogrevocation.storequality.microsoft.com", "wildcard": false, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Revokes licences for malicious Store apps.", "verified": "2026-10-19" }, { "id": "store-images", "service": "store", "label": "Store and inbox app images", "pattern": "img-prod-cms-rt-microsoft-com.akamaized.net", "wildcard": false, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "advisory", "documentedHosts": [], "citations": [{ "source": "WIN11", "anchor": "windows-11-enterprise-connection-endpoints" }, { "source": "WIN2004", "anchor": "windows-10-2004-enterprise-connection-endpoints" }], "why": "Image files Store apps load; Microsoft notes apps cannot be installed or updated from the Store without it.", "verified": "2026-10-19" }, { "id": "edge-update", "service": "edge", "label": "Microsoft Edge update service", "pattern": "msedge.api.cdp.microsoft.com", "wildcard": false, "ports": [{ "port": 443, "protocol": "https" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "always", "callers": [], "pinned": false, "http": false, "range": false, "maxHosts": 1, "severity": "warning", "documentedHosts": [], "citations": [{ "source": "EDGE", "anchor": "update-service" }], "why": "The service Edge checks for updates; it then names a download location under *.dl.delivery.mp.microsoft.com, delivered by DO.", "verified": "2026-10-13" }, { "id": "office-cdn", "service": "office-cdn", "label": "Microsoft 365 Apps CDN (officecdn)", "pattern": "*.officecdn.microsoft.com", "wildcard": true, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "when-used", "callers": ["office", "click-to-run", "c2r"], "pinned": false, "http": true, "range": true, "maxHosts": 1, "severity": "critical", "documentedHosts": [{ "host": "officecdn.microsoft.com", "relation": "base", "source": "M365", "anchor": "microsoft-365-common-and-office-online" }], "citations": [{ "source": "EP", "anchor": "" }, { "source": "M365", "anchor": "microsoft-365-common-and-office-online" }], "why": "Microsoft 365 Apps updates. Probed only where the device downloads Microsoft 365 Apps content. officecdn.microsoft.com is named in Microsoft 365 endpoint set 92: the base name of the wildcard, not a match of it.", "verified": "2026-10-13" }, { "id": "office-cdn-net", "service": "office-cdn", "label": "Microsoft 365 Apps CDN (cdn.office.net)", "pattern": "*.cdn.office.net", "wildcard": true, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "when-used", "callers": ["office", "click-to-run", "c2r"], "pinned": false, "http": true, "range": true, "maxHosts": 1, "severity": "warning", "documentedHosts": [], "citations": [{ "source": "EP", "anchor": "" }], "why": "Microsoft 365 Apps updates. No concrete host is documented, so it is tested only on a host this device used.", "verified": "2026-10-13" }, { "id": "m365-static", "service": "office-cdn", "label": "Microsoft 365 static content (static.microsoft)", "pattern": "*.static.microsoft", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }, { "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "when-used", "callers": ["office", "click-to-run", "c2r", "teams"], "pinned": false, "http": false, "range": true, "maxHosts": 1, "severity": "warning", "documentedHosts": [], "citations": [{ "source": "EP", "anchor": "" }, { "source": "M365", "anchor": "microsoft-365-unified-domains" }], "why": "Microsoft 365 Apps updates over HTTP 80 and Teams over HTTPS 443, as the Connected Cache endpoints page lists them, so both ports are tested. No concrete host is documented, so it is tested only on a host this device used.", "verified": "2026-10-19" }, { "id": "intune-win32", "service": "intune", "label": "Intune Win32 app content", "pattern": "*.manage.microsoft.com", "wildcard": true, "ports": [{ "port": 443, "protocol": "https" }, { "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "when-used", "callers": ["intune"], "pinned": false, "http": false, "range": true, "maxHosts": 1, "severity": "critical", "documentedHosts": [], "citations": [{ "source": "EP", "anchor": "" }], "why": "Intune Win32 app content. Probed only where the device downloads Intune apps; no concrete content host is documented, so it is tested only on a host this device used.", "verified": "2026-10-13" }, { "id": "xbox", "service": "store", "label": "Xbox and PC Game Pass content", "pattern": "*.xboxlive.com", "wildcard": true, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3, 99, 100], "scope": "when-used", "callers": ["xbox", "gaming"], "pinned": false, "http": true, "range": true, "maxHosts": 1, "severity": "advisory", "documentedHosts": [], "citations": [{ "source": "EP", "anchor": "" }], "why": "PC Game Pass content. Probed only where the device downloads it.", "verified": "2026-10-13" }, { "id": "mcc", "service": "mcc", "label": "Microsoft Connected Cache server", "pattern": "(DOCacheHost)", "wildcard": false, "ports": [{ "port": 80, "protocol": "http" }], "modes": [0, 1, 2, 3], "scope": "configured", "callers": [], "pinned": false, "http": true, "range": true, "maxHosts": 2, "severity": "critical", "documentedHosts": [], "probePath": { "path": "/filestreamingservice/files/7bc846e0-af9c-49be-a03d-bb04428c9bb5/Microsoft.png?cacheHostOrigin=dl.delivery.mp.microsoft.com", "source": "MCCVERIFY", "anchor": "steps-to-verify-functionality-of-connected-cache-node" }, "citations": [{ "source": "MCCVERIFY", "anchor": "steps-to-verify-functionality-of-connected-cache-node" }, { "source": "MCCPRE", "anchor": "" }, { "source": "CFG", "anchor": "3-using-connected-cache" }], "why": "The cache server named by DOCacheHost, or one the device was given or used. Clients reach it on HTTP 80; Microsoft's verification request is used, with the smallest byte range.", "verified": "2026-10-13" } ], "local": [ { "id": "p2p-listener", "port": 7680, "protocol": "tcp", "direction": "inbound", "what": "DoSvc listening on TCP 7680 (expected to stop when idle)", "citations": [{ "source": "FAQ", "anchor": "why-is-the-delivery-optimization-service-not-listening-on-port-7680" }] }, { "id": "p2p-firewall-rule", "port": 7680, "protocol": "tcp", "direction": "inbound", "what": "The Delivery Optimization inbound rules in the active firewall policy, and whether a profile or policy blocks inbound connections regardless of them", "citations": [{ "source": "CFG", "anchor": "ports" }] }, { "id": "teredo-state", "port": 3544, "protocol": "udp", "direction": "outbound", "what": "Teredo state, for Group (2) and Internet (3) modes", "citations": [{ "source": "CFG", "anchor": "ports" }] } ], "excluded": [ { "source": "WIN2004", "area": "Apps (Weather, OneNote Live Tile, Photos)", "hosts": ["blob.weather.microsoft.com", "tile-service.weather.microsoft.com", "cdn.onenote.net/*", "evoke-windowsservices-tas.msedge.net"], "reason": "App content and configuration fetched by the apps themselves, not by Delivery Optimization or Windows Update." }, { "source": "WIN2004", "area": "Cortana and Live Tiles, Windows Spotlight, Maps, Font streaming, Device metadata", "hosts": ["www.bing.com*", "arc.msn.com", "*maps.windows.com", "fs.microsoft.com*", "dmd.metaservices.microsoft.com"], "reason": "Consumer and shell features; none is on a Delivery Optimization or Windows Update download path." }, { "source": "WIN2004", "area": "Diagnostic data and error reporting", "hosts": ["v10.events.data.microsoft.com", "*.telecommand.telemetry.microsoft.com", "watson.*.microsoft.com"], "reason": "Telemetry: blocking it changes nothing about how content is delivered." }, { "source": "WIN2004", "area": "Microsoft forward link redirection (FWLink)", "hosts": ["go.microsoft.com"], "reason": "A redirect service. Defender definitions and update content are tested at the endpoints they are actually delivered from." }, { "source": "WIN2004", "area": "Microsoft Store: push notifications and analytics", "hosts": ["*.wns.windows.com", "manage.devcenter.microsoft.com"], "reason": "Push notification and Store analytics services, not content delivery. (Intune relies on WNS for MDM push; that belongs to an Intune endpoint check, not to this one.)" }, { "source": "WIN2004", "area": "Network Connection Status Indicator", "hosts": ["www.msftconnecttest.com*"], "reason": "Internet connectivity detection for the network status icon; not a documented Delivery Optimization or Windows Update dependency." }, { "source": "WIN2004", "area": "Office portal, OneDrive, Settings, Skype, Teams configuration", "hosts": ["*ow1.res.office365.com", "office.com", "blobs.officehome.msocdn.com", "self.events.data.microsoft.com", "*g.live.com", "oneclient.sfx.ms", "logincdn.msauth.net", "settings-win.data.microsoft.com", "*.pipe.aria.microsoft.com", "config.edge.skype.com", "config.teams.microsoft.com"], "reason": "Portal, sync and app configuration services. Microsoft 365 Apps and Teams content is covered by the Microsoft 365 CDN entries from the Connected Cache endpoints page instead." }, { "source": "WIN2004", "area": "Windows Defender cloud protection and SmartScreen", "hosts": ["wdcp.microsoft.com", "*.smartscreen-prod.microsoft.com", "*.smartscreen.microsoft.com", "checkappexec.microsoft.com"], "reason": "Cloud protection and reputation lookups; definition updates arrive through the Windows Update endpoints, which are tested." }, { "source": "WIN2004", "area": "Xbox Live assets", "hosts": ["dlassets-ssl.xboxlive.com"], "reason": "An HTTPS asset service for the Xbox app. PC Game Pass content delivered by DO is covered by *.xboxlive.com from the Connected Cache endpoints page, probed only where it is used." }, { "source": "WIN2004", "area": "Windows Update (narrower duplicate)", "hosts": ["*.prod.do.dsp.mp.microsoft.com"], "reason": "Covered by the broader *.do.dsp.mp.microsoft.com entry." }, { "source": "EP", "area": "New Outlook companion apps", "hosts": ["*.res.cdn.office.net"], "reason": "Microsoft states peering and Connected Cache support is planned, not available: not delivered by DO today." }, { "source": "EP", "area": "Connected Cache server deployment and management", "hosts": ["*.azure-devices.net", "*.global.azure-devices-provisioning.net", "*.azurecr.io", "*.blob.core.windows.net", "*.mcr.microsoft.com", "*.github.com", "*.ubuntu.com", "api.snapcraft.io", "release-assets.githubusercontent.com", "releases.githubusercontent.com", "raw.github.com", "packages.microsoft.com", "download.microsoft.com", "aka.ms", "raw.githubusercontent.com", "microsoft.com/pkiops"], "reason": "Needed by the cache host, not by clients. DoctorDO runs on clients, so it cannot test them from where they matter (rule DO-NET-013 covers the host)." } ], "patternTests": [ { "pattern": "*.dl.delivery.mp.microsoft.com", "host": "1d.tlu.dl.delivery.mp.microsoft.com", "match": true }, { "pattern": "*.dl.delivery.mp.microsoft.com", "host": "msedge.b.dl.delivery.mp.microsoft.com", "match": true }, { "pattern": "*.dl.delivery.mp.microsoft.com", "host": "dl.delivery.mp.microsoft.com", "match": false }, { "pattern": "*.dl.delivery.mp.microsoft.com", "host": "evil-dl.delivery.mp.microsoft.com", "match": false }, { "pattern": "*.dl.delivery.mp.microsoft.com", "host": "x.dl.delivery.mp.microsoft.com.evil.example", "match": false }, { "pattern": "*.delivery.mp.microsoft.com", "host": "fe3cr.delivery.mp.microsoft.com", "match": true }, { "pattern": "*.windowsupdate.com", "host": "au.download.windowsupdate.com", "match": true }, { "pattern": "*.windowsupdate.com", "host": "notwindowsupdate.com", "match": false }, { "pattern": "array*.prod.do.dsp.mp.microsoft.com", "host": "array614.prod.do.dsp.mp.microsoft.com", "match": true }, { "pattern": "array*.prod.do.dsp.mp.microsoft.com", "host": "geo.prod.do.dsp.mp.microsoft.com", "match": false }, { "pattern": "array*.prod.do.dsp.mp.microsoft.com", "host": "array1.x.prod.do.dsp.mp.microsoft.com", "match": false }, { "pattern": "*displaycatalog.mp.microsoft.com", "host": "displaycatalog.mp.microsoft.com", "match": true }, { "pattern": "*displaycatalog.mp.microsoft.com", "host": "storeedgefd.displaycatalog.mp.microsoft.com", "match": true }, { "pattern": "*login.live.com", "host": "login.live.com", "match": true }, { "pattern": "ctldl.windowsupdate.com", "host": "CTLDL.WindowsUpdate.com.", "match": true }, { "pattern": "ctldl.windowsupdate.com", "host": "xctldl.windowsupdate.com", "match": false }, { "pattern": "*.manage.microsoft.com", "host": "swda01-mscdn.manage.microsoft.com", "match": true }, { "pattern": "*.static.microsoft", "host": "res-1.static.microsoft", "match": true } ] } |