MS Office & Teams: Network Connection Target Hosts

Networking, Security
Published Feb 22, 2021 Updated Mar 27, 2021

This post lists the internet communication targets of Microsoft Office and Teams. It is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.

The series consists of the following articles:

Part 1: explanation of the methodology
Part 2 (this article): list of MS Office & Teams communication targets
Part 3: list of Windows, OS services & UWP apps communication targets
Part 4: list of Citrix CVAD communication targets
Part 5: list of Adobe Acrobat Reader, Photoshop, & Creative Cloud communication targets

TL;DR

Microsoft Office talks to 69 hosts and 451 IPs on the internet. List of URLs & details below.

About This Data

What Is This List?

The table below lists the internet hosts the MS Office and Teams applications and processes communicated with in a real environment. For each application, the table shows:

Application name
Application version(s)
Process(es) of the application
Number of distinct target IP addresses
Names and ports of the target hosts

Where Does the Data Come From?

The data was collected in vast limits’ internal network by uberAgent, our endpoint monitoring and analytics product. The data spans a 30-day time range in early 2021. The table contains metadata of actual network communications. It is accurate and complete insofar as I did not alter anything. I did, however, remove some internal systems and the results of manual web browsing (or similar). Some hostnames may be specific to our location (Germany).

List of Office & Teams Network Connection Target Hosts

Application	App version(s)	Process(es)	#Target IPs	Targets
Microsoft Office	16.0.12527.21378 16.0.12527.21416 16.0.12624.20374 16.0.13127.21062 16.0.13127.21064 16.0.13426.20566 16.0.13530.20038 16.0.13530.20062 16.0.13530.20122 16.0.13530.20132 16.0.13530.20316 16.0.13530.20368 16.0.13530.20376 16.0.13530.20418 16.0.13530.20440 16.0.13628.20128 16.0.13628.20246 16.0.13628.20258 16.0.13628.20274 16.0.13628.20346	EXCEL.EXE HxTsr.exe Integrator.exe OfficeC2RClient.exe OfficeClickToRun.exe POWERPNT.EXE SDXHelper.exe WINWORD.EXE msoia.exe	451	a-0020.a-msedge.net:80 a7288ab4bb8141e6bf2c769558148a94.fp.measure.office.com:443 acdc-direct.office.com:443 atm-fp-direct.office.com:443 augloop.office.com:443 autodiscover-s.outlook.com:443 binaries.templates.cdn.office.net:443 browser.pipe.aria.microsoft.com:443 cdn.hubblecontent.osi.office.net:443 cdn.odc.officeapps.live.com:443 cdn.uci.officeapps.live.com:443 clients.config.office.net:443 crl.identrust.com:80 crl3.digicert.com:80 dataservice.protection.outlook.com:443 ecs.office.com:443 enrichment.osi.office.net:443 eur03.dataservice.protection.outlook.com:443 fa000000002.resources.office.net:443 fa000000005.resources.office.net:443 fa000000018.resources.office.net:443 fa000000054.resources.office.net:443 fs.microsoft.com:443 hubblecontent.osi.office.net:443 messaging.office.com:443 metadata.templates.cdn.office.net:443 mobile.pipe.aria.microsoft.com:443 mrodevicemgr.officeapps.live.com:443 nexusrules.officeapps.live.com:443 nleditor.osi.office.net:443 ocps.manage.microsoft.com:443 ocsp.digicert.com:80 ocsp.godaddy.com:80 ocsp.starfieldtech.com:80 ocsp.usertrust.com:80 ocsp.verisign.com:80 ocws.officeapps.live.com:443 odc.officeapps.live.com:443 officecdn.microsoft.com.edgesuite.net:80 officecdn.microsoft.com:80 officeclient.microsoft.com:443 ols.officeapps.live.com:443 oneocsp.microsoft.com:80 outlook.office.com:443 outlook.office365.com:443 outlookmobile-office365-tas.msedge.net:443 ow1.res.office365.com:443 peoplegraph.firstpartyapps.oaspapps.com:443 pptsgs.officeapps.live.com:443 r3.o.lencr.org:80 r4.res.office365.com:443 roaming.officeapps.live.com:443 self.events.data.microsoft.com:443 settings-win.data.microsoft.com:443 shredder.osi.office.net:443 spoprod-a.akamaihd.net:443 status.geotrust.com:80 status.thawte.com:80 store.office.com:443 substrate.office.com:443 support.content.office.net:443 sv.symcd.com:80 syncservice.protection.outlook.com:443 upload.fp.measure.office.com:443 v20.events.data.microsoft.com:443 visio.officeapps.live.com:443 waconafd.officeapps.live.com:443 waconatm.officeapps.live.com:443 wordsgs.officeapps.live.com:443
Microsoft Teams	1.3.00.13565	Teams.exe	40	api.flightproxy.teams.microsoft.com:3478 api.flightproxy.teams.microsoft.com:443 api.microsoftstream.com:443 api.userstore.skype.com:443 browser.pipe.aria.microsoft.com:443 config.teams.microsoft.com:443 df.trap.teams.microsoft.com:443 emea.ng.msg.teams.microsoft.com:443 eu-api.asm.skype.com:443 eu-prod.asyncgw.teams.microsoft.com:443 mobile.pipe.aria.microsoft.com:443 outlook.office.com:443 presence.teams.microsoft.com:443 res-1.cdn.office.net:443 sfeur.loki.delve.office.com:443 statics.teams.cdn.office.net:443 teams.events.data.microsoft.com:443 teams.microsoft.com:443 westeurope.notifications.teams.microsoft.com:443 whiteboard.microsoft.com:443
Microsoft.MicrosoftOfficeHub	18.2008.12711.0	WWAHost.exe	2	browser.pipe.aria.microsoft.com:443 ocsp.digicert.com:80
Office Subscription Licensing Heartbeat	16.0.12527.21416 16.0.13127.21064 16.0.13530.20316 16.0.13530.20376 16.0.13530.20440 16.0.13628.20274	OLicenseHeartbeat.exe	16	activation.sls.microsoft.com:443 ecs.office.com:443 nexusrules.officeapps.live.com:443 ocsp.digicert.com:80 officeclient.microsoft.com:443 ols.officeapps.live.com:443