You need to recommend which inbound ports to the network and outbound ports to Office 365 must be allowed on the company's firewall after the planned upgrade. The solution must meet the security…

Question

Explanation

This question tests knowledge of firewall port requirements for Office 365 (Microsoft 365) connectivity, specifically which inbound ports the on-premises network must accept and which outbound ports must be permitted to reach Office 365 endpoints.

Approach. For outbound traffic to Office 365, TCP port 443 (HTTPS) is mandatory for nearly all Microsoft 365 services including Exchange Online, Teams, SharePoint, and Azure AD authentication. TCP port 80 (HTTP) is also required for certificate revocation list (CRL) checks. For hybrid Exchange or mail-flow scenarios, TCP port 25 (SMTP) outbound is needed to relay mail to Exchange Online Protection. For inbound traffic to the on-premises network, TCP port 25 (SMTP) must be allowed so that Office 365 can deliver inbound mail back to on-premises mailboxes in a hybrid configuration, and TCP port 443 may be required if Office 365 needs to reach on-premises endpoints (e.g., hybrid connectors, Azure AD Connect). The principle of least privilege applies: only open ports that are explicitly required by the planned services, and block all others.

Concept tested. Office 365 / Microsoft 365 firewall port requirements - specifically the distinction between inbound ports (what external services like Office 365 send INTO the on-premises network, typically TCP 25 for hybrid mail flow) and outbound ports (what on-premises clients/servers send OUT to Office 365, primarily TCP 443 and TCP 80). A common mistake is allowing unnecessary ports such as TCP 587 inbound, or blocking TCP 80 outbound which breaks CRL validation.

Reference. Microsoft Learn - Office 365 URLs and IP address ranges (aka.ms/o365endpoints); Microsoft 365 network connectivity principles

No community discussion yet for this question.