Skip to content

Commit 6121355

Browse files
authored
Merge pull request #2861 from DeCohen/release-note-fix
added release note
2 parents 6f362a0 + 1ebffd3 commit 6121355

File tree

2 files changed

+59
-66
lines changed

2 files changed

+59
-66
lines changed

CloudAppSecurityDocs/network-requirements.md

Lines changed: 33 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -34,37 +34,39 @@ To see which data center you're connecting to, do the following steps:
3434

3535
## Portal access
3636

37-
To use Defender for Cloud Apps in the Microsoft Defender Portal, add **outbound port 443** for the following IP addresses and DNS names to your firewall's allowlist:
38-
39-
```ini
40-
cdn.cloudappsecurity.com
41-
cdn-discovery.cloudappsecurity.com
42-
adaproddiscovery.azureedge.net
43-
*.s-microsoft.com
44-
*.msecnd.net
45-
dev.virtualearth.net
46-
flow.microsoft.com
47-
static2.sharepointonline.com
48-
*.blob.core.windows.net
49-
discoveryresources-cdn-prod.cloudappsecurity.com
50-
discoveryresources-cdn-gov.cloudappsecurity.com
51-
52-
```
53-
54-
Additionally, the following items should be allowed, depending on which data center you use:
55-
56-
|Data center|IP addresses|DNS name|
57-
|----|----|----|
58-
|US1|13.64.26.88, 13.64.29.32, 13.80.125.22, 13.91.91.243, 40.74.1.235, 40.74.6.204, 51.143.58.207, 52.137.89.147, 52.183.75.62, 23.101.201.123, 20.228.186.154|\*.us.portal.cloudappsecurity.com|
59-
|US2|13.80.125.22, 20.36.222.59, 20.36.222.60, 40.74.1.235, 40.74.6.204, 51.143.58.207, 52.137.89.147, 52.183.75.62, 52.184.165.82, 20.15.114.156, 172.202.90.196|\*.us2.portal.cloudappsecurity.com|
60-
|US3|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.90.218.196, 40.90.218.198, 51.143.58.207, 52.137.89.147, 52.183.75.62, 20.3.226.231, 4.255.218.227|*.us3.portal.cloudappsecurity.com|
61-
|EU1|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.119.154.72, 51.143.58.207, 52.137.89.147, 52.157.238.58, 52.174.56.180, 52.183.75.62, 20.71.203.39, 137.116.224.49|\*.eu.portal.cloudappsecurity.com|
62-
|EU2|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.81.156.154, 40.81.156.156, 51.143.58.207, 52.137.89.147, 52.183.75.62, 20.0.210.84, 20.90.9.64|*.eu2.portal.cloudappsecurity.com|
63-
|Gov US1|13.72.19.4, 52.227.143.223|*.us1.portal.cloudappsecurity.us|
64-
|GCC| 52.227.23.181, 52.227.180.126| *.us1.portal.cloudappsecuritygov.com |
65-
66-
> [!NOTE]
67-
> For portal access, instead of a wildcard (\*), you can choose to open only your specific tenant URL. For example, based on the screenshot above you can open: `contoso.us.portal.cloudappsecurity.com`. To determine your tenant URL, see the earlier section [View your data center](#view-your-data-center), and look for **API URL**.
37+
To use Defender for Cloud Apps in the Microsoft Defender Portal:
38+
39+
1. Add **outbound port 443** for the following IP addresses and DNS names to your firewall's allowlist:
40+
41+
```ini
42+
cdn.cloudappsecurity.com
43+
cdn-discovery.cloudappsecurity.com
44+
adaproddiscovery.azureedge.net
45+
*.s-microsoft.com
46+
*.msecnd.net
47+
dev.virtualearth.net
48+
flow.microsoft.com
49+
static2.sharepointonline.com
50+
*.blob.core.windows.net
51+
discoveryresources-cdn-prod.cloudappsecurity.com
52+
discoveryresources-cdn-gov.cloudappsecurity.com
53+
54+
```
55+
56+
1. Allow the following items based on your data center:
57+
58+
|Data center|IP addresses|DNS name|
59+
|----|----|----|
60+
|US1|13.64.26.88, 13.64.29.32, 13.80.125.22, 13.91.91.243, 40.74.1.235, 40.74.6.204, 51.143.58.207, 52.137.89.147, 52.183.75.62, 23.101.201.123, 20.228.186.154|\*.us.portal.cloudappsecurity.com|
61+
|US2|13.80.125.22, 20.36.222.59, 20.36.222.60, 40.74.1.235, 40.74.6.204, 51.143.58.207, 52.137.89.147, 52.183.75.62, 52.184.165.82, 20.15.114.156, 172.202.90.196|\*.us2.portal.cloudappsecurity.com|
62+
|US3|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.90.218.196, 40.90.218.198, 51.143.58.207, 52.137.89.147, 52.183.75.62, 20.3.226.231, 4.255.218.227|*.us3.portal.cloudappsecurity.com|
63+
|EU1|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.119.154.72, 51.143.58.207, 52.137.89.147, 52.157.238.58, 52.174.56.180, 52.183.75.62, 20.71.203.39, 137.116.224.49|\*.eu.portal.cloudappsecurity.com|
64+
|EU2|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.81.156.154, 40.81.156.156, 51.143.58.207, 52.137.89.147, 52.183.75.62, 20.0.210.84, 20.90.9.64|*.eu2.portal.cloudappsecurity.com|
65+
|Gov US1|13.72.19.4, 52.227.143.223|*.us1.portal.cloudappsecurity.us|
66+
|GCC| 52.227.23.181, 52.227.180.126| *.us1.portal.cloudappsecuritygov.com |
67+
68+
> [!NOTE]
69+
> For portal access, instead of a wildcard (\*), you can choose to open only your specific tenant URL. For example, based on the screenshot above you can open: `contoso.us.portal.cloudappsecurity.com`. To determine your tenant URL, see the earlier section [View your data center](#view-your-data-center), and look for **API URL**.
6870

6971
## Access and session controls
7072

@@ -82,9 +84,6 @@ For more information, see [Protect apps with Microsoft Defender for Cloud Apps C
8284
8385
For commercial customers, to enable Defender for Cloud Apps reverse proxy, add **outbound port 443** for the following IP addresses and DNS names to your firewall's allowlist:
8486

85-
86-
87-
8887
```ini
8988
*.cas.ms
9089
*.mcas.ms
@@ -109,9 +108,6 @@ Additionally, the following IP addresses, used by our reverse proxy regions, sho
109108

110109
For US Government GCC High customers, to enable Defender for Cloud Apps reverse proxy, add **outbound port 443** for the following DNS names to your firewall's allowlist:
111110

112-
113-
114-
115111
```ini
116112
*.mcas-gov.us
117113
*.admin-mcas-gov.us

CloudAppSecurityDocs/release-notes.md

Lines changed: 26 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: What's new | Microsoft Defender for Cloud Apps
33
description: This article is updated frequently to let you know what's new in the latest release of Microsoft Defender for Cloud Apps.
4-
ms.date: 11/19/2024
4+
ms.date: 02/20/2025
55
ms.topic: overview
66
---
77

@@ -21,18 +21,6 @@ For news about earlier releases, see [Archive of past updates for Microsoft Defe
2121

2222
## February 2025
2323

24-
### Enhanced Visibility into OAuth Apps Connected to Microsoft 365 - General Availability
25-
26-
Defender for Cloud Apps users who use app governance will be able to gain visibility into the origin of OAuth apps connected to Microsoft 365. You can filter and monitor apps that have external origins, to proactively review such apps and improve the security posture of the organization.
27-
28-
The new *Permissions* filter and export capabilities allows you to quickly identify apps with specific permissions to access Microsoft 365.
29-
30-
You can now get granular insights into data accessed by apps using legacy EWS API alongside Microsoft Graph. The enhanced coverage of data usage insights will enable you to get deeper visibility into apps accessing emails using legacy EWS API.
31-
32-
We are also expanding the coverage of privilege level feature for all popular Microsoft first-party API permissions. The enhanced coverage of privilege level classification will enable you to view and monitor apps with powerful permissions into legacy and other non-Graph APIs that have access to Microsoft 365.
33-
34-
For more information, see [detailed insights into OAuth apps](/defender-cloud-apps/app-governance-visibility-insights-view-apps#getting-detailed-information-on-an-app).
35-
3624
### Enhanced alert source accuracy
3725

3826
Microsoft Defender for Cloud Apps is enhancing its alert sources to deliver more precise information. This update, applicable to new alerts only, will be reflected across various experiences and APIs, including the Defender XDR portal, Advanced hunting, and Graph API.
@@ -44,30 +32,39 @@ To learn more about the Graph API alert resource: [alert resource type - Microso
4432

4533
### Network requirement updates
4634

47-
Due to improvements being made to Microsoft Defender for Cloud Apps to improve security and performance, you must update network information in your system's firewall and additional third-party services. Make these changes by March 16, 2025 to ensure uninterrupted access to our services:
48-
49-
- Update your firewall rules to allow outbound traffic on port 443 to the following new CDN (Content Delivery Network) endpoints before March 16, 2025:
50-
51-
- cdn.cloudappsecurity.com
52-
- cdn-discovery.cloudappsecurity.com
35+
Microsoft Defender for Cloud Apps has improved its security and performance. Network information in firewalls and additional third-party services must be updated to comply with the new standards. To ensure uninterrupted access to our services you must apply these changes by March 16, 2025.
5336

54-
- All required outbound access URLs can also be found in Defender for Cloud Apps network requirements page under 'Portal Access'.
37+
To connect to third-party apps and enable Defender for Cloud Apps, use the following IP addresses:
5538

56-
- To use Defender for Cloud Apps in the Microsoft Defender portal, make sure you add outbound port 443 for all IP addresses and DNS names listed in our documentation to your firewall's allowlist.
39+
|Data center|IP addresses|DNS name|
40+
|----|----|----|
41+
|US1|13.64.26.88, 13.64.29.32, 13.80.125.22, 13.91.91.243, 40.74.1.235, 40.74.6.204, 51.143.58.207, 52.137.89.147, 52.183.75.62, 23.101.201.123, 20.228.186.154|\*.us.portal.cloudappsecurity.com|
42+
|US2|13.80.125.22, 20.36.222.59, 20.36.222.60, 40.74.1.235, 40.74.6.204, 51.143.58.207, 52.137.89.147, 52.183.75.62, 52.184.165.82, 20.15.114.156, 172.202.90.196|\*.us2.portal.cloudappsecurity.com|
43+
|US3|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.90.218.196, 40.90.218.198, 51.143.58.207, 52.137.89.147, 52.183.75.62, 20.3.226.231, 4.255.218.227|*.us3.portal.cloudappsecurity.com|
44+
|EU1|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.119.154.72, 51.143.58.207, 52.137.89.147, 52.157.238.58, 52.174.56.180, 52.183.75.62, 20.71.203.39, 137.116.224.49|\*.eu.portal.cloudappsecurity.com|
45+
|EU2|13.80.125.22, 40.74.1.235, 40.74.6.204, 40.81.156.154, 40.81.156.156, 51.143.58.207, 52.137.89.147, 52.183.75.62, 20.0.210.84, 20.90.9.64|*.eu2.portal.cloudappsecurity.com|
46+
|Gov US1|13.72.19.4, 52.227.143.223|*.us1.portal.cloudappsecurity.us|
47+
|GCC| 52.227.23.181, 52.227.180.126| *.us1.portal.cloudappsecuritygov.com |
5748

58-
- To connect to third-party apps, enable Defender for Cloud Apps to connect from the following IP addresses, also available in our documentation:
5949

60-
- **US1**: - 23.101.201.123 - 20.228.186.154
50+
For **US Government GCC High** customers:
6151

62-
- **US2**: - 20.15.114.156 - 172.202.90.196
52+
||IP addresses|DNS name|
53+
|----|----|----|
54+
|**Session controls**|US Gov Arizona: 52.244.144.65, 52.244.43.90, 52.244.43.225, 52.244.215.117, 52.235.134.195, 52.126.54.167, 52.126.55.65 <br /><br />US Gov Virginia: 13.72.27.223, 13.72.27.219, 13.72.27.220, 13.72.27.222, 20.141.230.137, 52.235.179.167, 52.235.184.112|\*.mcas-gov.us<br/>\*.admin-mcas-gov.us|
55+
|**Access controls**|US Gov Arizona: 52.244.215.83, 52.244.212.197, 52.127.2.97, 52.126.54.254, 52.126.55.65 <br /><br />US Gov Virginia: 13.72.27.216, 13.72.27.215, 52.127.50.130, 52.235.179.123, 52.245.252.18, 52.245.252.131, 52.245.252.191, 52.245.253.12, 52.245.253.58, 52.245.253.229, 52.245.254.39, 52.245.254.51, 52.245.254.212, 52.245.254.245, 52.235.184.112, 52.235.184.112|\*.access.mcas-gov.us<br/>\*.access.cloudappsecurity.us|
56+
|**SAML proxy**|US Gov Arizona: 20.140.49.129, 52.126.55.65<br /><br />US Gov Virginia: 52.227.216.80, 52.235.184.112|\*.saml.cloudappsecurity.us|
6357

64-
- **US3**: - 20.3.226.231 - 4.255.218.227
58+
For **US Government GCC** customers:
6559

66-
- **EU1**: - 20.71.203.39 - 137.116.224.49
60+
||IP addresses|DNS name|
61+
|----|----|----|
62+
|**Session controls**|US Gov Arizona: 52.235.147.86, 52.126.49.55, 52.126.48.233 <br /><br /> US Gov Virginia: 52.245.225.0, 52.245.224.229, 52.245.224.234, 52.245.224.228, 20.141.230.215, 52.227.10.254, 52.126.48.233, 52.227.3.207 | \*.mcas-gov.ms<br/>\*.admin-mcas-gov.ms|
63+
|**Access controls** |US Gov Arizona: 52.127.2.97, 52.235.143.220, 52.126.48.233 <br /><br />US Gov Virginia: 52.245.224.235, 52.245.224.227, 52.127.50.130, 52.245.222.168, 52.245.222.172, 52.245.222.180, 52.245.222.209, 52.245.223.38, 52.245.223.72, 52.245.223.177, 52.245.223.181, 52.245.223.182, 52.245.223.190, 23.97.12.140, 52.227.3.207 | \*.access.mcas-gov.ms|
64+
|**SAML proxy** |US Gov Arizona: 52.126.48.233 <br /> US Gov Virginia: 52.227.216.80, 52.126.48.233, 52.227.3.207 | \*.saml.cloudappsecuritygov.com|
6765

68-
- **EU2**: - 20.0.210.84 - 20.90.9.64
66+
To stay up to date on IP ranges, it's recommended to refer to the following Azure service tags for Microsoft Defender for Cloud Apps services. The latest IP ranges are found in the service tag. For more information, see [Azure IP ranges](/azure/virtual-network/service-tags-overview).
6967

70-
- To stay up to date on IP ranges that impact the experiences in Microsoft Defender for Cloud Apps in the areas of portal experience access, access and session controls, SIEM agent connection, app connectors, mail servers, and log collector, we recommend using the Azure service tag for Microsoft Defender for Cloud Apps services, and 'MicrosoftCloudAppSecurity.' The latest IP ranges are found in the service tag. For more information, see [Azure IP ranges](/azure/virtual-network/service-tags-overview).
7168

7269
## November 2024
7370

@@ -86,7 +83,7 @@ Defender for Cloud Apps customers can now query data about discovered apps via t
8683
For more information, see:
8784

8885
- [Work with discovered apps via Graph API](discovered-apps-api-graph.md)
89-
- [Microsoft Graph API reference for Microsoft Defender for Cloud Apps](/graph/api/resources/security-cloudappdiscovery-overview?view=graph-rest-beta)
86+
- [Microsoft Graph API reference for Microsoft Defender for Cloud Apps](/graph/api/resources/security-cloudappdiscovery-overview?view=graph-rest-beta&preserve-view=true)
9087

9188
### SaaS Security initiative in Exposure Management
9289

0 commit comments

Comments
 (0)