You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/network-requirements.md
+22-7Lines changed: 22 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,9 +8,23 @@ ms.topic: reference
8
8
# Network requirements
9
9
10
10
>[!IMPORTANT]
11
+
> **Important notice for GCC and Gov customers**
11
12
>
12
-
> **Take Immediate Action by April, 29 2025**, to ensure optimal service quality and prevent the interruption of some services. Update your firewall rules to allow outbound traffic on port 443 for the following IP addresses: 13.107.228.0/24, 13.107.229.0/24, 13.107.219.0/24, 13.107.227.0/24, 150.171.97.0/24. Alternatively, if you currently allow outbound traffic based on Azure service tags, please add the new Azure service tag, ‘AzureFrontDoor.MicrosoftSecurity’ to your allowlist. This tag will be adjusted to reflect the above range by April 28, 2025.
13
-
> This change only affects commercial customers of Microsoft Defender for Cloud Apps. Customers connected to the Gov US1 or GCC datacenters won't be affected.
13
+
> To prevent service disruption in Microsoft Defender for Cloud Apps, take immediate action by August 25, 2025.
14
+
> Update your firewall configuration as follows:
15
+
>
16
+
> Allow outbound traffic on port 443 to the following IP ranges:
17
+
>
18
+
> -`51.54.53.136/29`
19
+
> -`51.54.114.160/29`
20
+
> -`62.11.173.176/29`
21
+
>
22
+
> If you use Azure service tags for outbound traffic, add the Azure Gov service tag `AzureFrontDoor.MicrosoftSecurity` tag to your firewall allowlist.
23
+
>
24
+
> Add the following endpoint to your firewall allowlist on port 443:
> For portal access, instead of a wildcard (\*), you can choose to open only your specific tenant URL. For example, based on the screenshot above you can open: `contoso.us.portal.cloudappsecurity.com`. To determine your tenant URL, see the earlier section [View your data center](#view-your-data-center), and look for **API URL**.
@@ -151,8 +166,8 @@ To enable Defender for Cloud Apps to connect to your SIEM, add **outbound port 4
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/release-notes.md
+29-7Lines changed: 29 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,18 +20,33 @@ For more information on what's new with other Microsoft Defender security produc
20
20
21
21
For news about earlier releases, see [Archive of past updates for Microsoft Defender for Cloud Apps](release-note-archive.md).
22
22
23
-
>[!IMPORTANT]
24
-
> **Take Immediate Action by April, 29 2025**, to ensure optimal service quality and prevent the interruption of some services. This change will only affect your organization if you're using a firewall allowlist that restricts outbound traffic based on IP addresses or Azure service tags. Update your firewall rules to allow outbound traffic on port 443 for the following IP addresses: 13.107.228.0/24, 13.107.229.0/24, 13.107.219.0/24, 13.107.227.0/24, 150.171.97.0/24. Alternatively use as an additional Azure service tag, ‘AzureFrontDoor.MicrosoftSecurity’, that will be adjusted to reflect the above range by April 28, 2025.\
25
-
> This update should be completed and the IP addresses or new Azure service tag added to your firewall's allowlist by April 29, 2025.
26
-
> This change only affects commercial customers of Microsoft Defender for Cloud Apps. Customers connected to the Gov US1 or GCC datacenters won't be affected.\
### Updated network requirements for GCC and Gov customers
26
+
27
+
To support ongoing security enhancements and maintain service availability, Microsoft Defender for Cloud Apps now requires updated firewall configurations for customers in GCC and Gov environments.
28
+
29
+
To avoid service disruption, take action by **August 25, 2025**, and update your firewall configuration as follows:
30
+
31
+
Allow outbound traffic on port 443 to the following IP ranges:
32
+
-`51.54.53.136/29`
33
+
-`51.54.114.160/29`
34
+
-`62.11.173.176/29`
35
+
36
+
If you're using Azure service tags, add `AzureFrontDoor.MicrosoftSecurity` to your firewall allowlist.
37
+
38
+
Add the following endpoint to your firewall allowlist on port 443:
For the full list of required IP addresses and endpoints, see [Network requirements](network-requirements.md#portal-access).
28
42
29
43
30
44
## June 2025
31
45
46
+
32
47
### “Behaviors” data type in Microsoft Defender for Cloud Apps - General Availability
33
48
34
-
The **Behaviors** data type significantly enhances overall threat detection accuracy by reducing alerts on generic anomalies and surfacing alerts only when observed patterns align with real security scenarios. You can now use **Behaviors** to conduct investigations in [Advanced Hunting](https://learn.microsoft.com/defender-xdr/advanced-hunting-overview), build better [custom detections](https://learn.microsoft.com/defender-xdr/custom-detection-rules) based on behavioral signals, and benefit from automatic inclusion of context-related behaviors into [incidents](https://learn.microsoft.com/defender-xdr/incidents-overview). This provides clearer context and helps security operations teams to reduce alert fatigue, prioritize, and respond more efficiently.
49
+
The **Behaviors** data type enhances overall threat detection accuracy by reducing alerts on generic anomalies and surfacing alerts only when observed patterns align with real security scenarios. You can now use **Behaviors** to conduct investigations in [Advanced Hunting](/defender-xdr/advanced-hunting-overview), build better [custom detections](/defender-xdr/custom-detection-rules) based on behavioral signals, and benefit from automatic inclusion of context-related behaviors into [incidents](/defender-xdr/incidents-overview). This provides clearer context and helps security operations teams to reduce alert fatigue, prioritize, and respond more efficiently.
35
50
36
51
For more information, see:
37
52
-[Investigate behaviors with advanced hunting](/defender-cloud-apps/behaviors).
@@ -80,6 +95,13 @@ For more information, see: [Find your cloud app and calculate risk scores](risk-
80
95
## April 2025
81
96
82
97
98
+
### Firewall configuration update required by April 29, 2025
99
+
100
+
**Take Immediate Action by April, 29 2025**, to ensure optimal service quality and prevent the interruption of some services. This change will only affect your organization if you're using a firewall allowlist that restricts outbound traffic based on IP addresses or Azure service tags. Update your firewall rules to allow outbound traffic on port 443 for the following IP addresses: 13.107.228.0/24, 13.107.229.0/24, 13.107.219.0/24, 13.107.227.0/24, 150.171.97.0/24. Alternatively use as an additional Azure service tag, ‘AzureFrontDoor.MicrosoftSecurity’, that will be adjusted to reflect the above range by April 28, 2025.\
101
+
- This update should be completed and the IP addresses or new Azure service tag added to your firewall's allowlist by April 29, 2025.
102
+
- This change only affects commercial customers of Microsoft Defender for Cloud Apps. Customers connected to the Gov US1 or GCC datacenters won't be affected.\
### OAuth app information is now available in attack paths (Preview)
84
106
85
107
The Security Exposure Management platform now includes OAuth applications as part of the attack path and attack surface map experiences. This enhancement enables you to visualize how attackers could exploit OAuth apps to move laterally within your environment and access critical assets. By identifying these attack paths and investigating associated permissions, you can reduce exposure and improve the security posture of your Microsoft 365 services.
@@ -227,7 +249,7 @@ For more information, see [OAuth app permission related details on app governanc
227
249
228
250
### Granular data usage insights into EWS API access (Preview)
229
251
230
-
Defender for Cloud Apps users who use app governance can now get granular insights into data accessed by apps using legacy EWS API alongside Microsoft Graph. The enhanced coverage of data usage insights enable you to get deeper visibility into apps accessing emails using legacy EWS API.
252
+
Defender for Cloud Apps users who use app governance can now get granular insights into data accessed by apps using legacy EWS API alongside Microsoft Graph. The enhanced coverage of data usage insights enables you to get deeper visibility into apps accessing emails using legacy EWS API.
231
253
232
254
For more information, see [OAuth app data usage insights on app governance](/defender-cloud-apps/app-governance-visibility-insights-view-apps#getting-detailed-information-on-an-app).
0 commit comments