Network requests in Office for Mac
Office for Mac applications provide a native app experience on the macOS platform. Each app is designed to work in a variety of scenarios, including states when no network access is available. When a machine is connected to a network, the applications automatically connect to a series of web-based services to provide enhanced functionality. The following information describes which endpoints and URLs the applications try to reach, and the services provided. This information is useful when troubleshooting network configuration issues and setting policies for network proxy servers. The details in this article are intended to complement the Office 365 URL and address ranges article, which includes endpoints for computers running Microsoft Windows. Unless noted, the information in this article also applies to Office 2019 for Mac and Office 2016 for Mac, which are available as a one-time purchase from a retail store or through a volume licensing agreement.
Most of this article is tables detailing network URLs, type, and description of service or feature provided by that endpoint. Each of the Office apps may differ in its service and endpoint usage. The following apps are defined in the tables below:
- W: Word
- P: PowerPoint
- X: Excel
- O: Outlook
- N: OneNote
The URL type is defined as follows:
ST: Static - The URL is hard-coded into the client application.
SS: Semi-Static - The URL is encoded as part of a web page or redirector.
CS: Config Service - The URL is returned as part of the Office Configuration Service.
Office for Mac default configuration
Installation and updates
The following network endpoints are used to download the Office for Mac installation program from the Microsoft Content Delivery Network (CDN).
| URL | Type | Description |
|---|---|---|
https://go.microsoft.com/fwlink/ |
ST |
Microsoft 365 Installation Portal forward link service to latest installation packages. |
https://officecdn-microsoft-com.akamaized.net/ |
SS |
Location of installation packages on the Content Delivery Network. |
https://officecdn.microsoft.com/ |
SS |
Location of installation packages on the Content Delivery Network. |
https://officeci-mauservice.azurewebsites.net/ |
ST |
Management Control endpoint for Microsoft AutoUpdate |
https://officecdnmac.microsoft.com/ |
Enhanced content delivery network (CDN) for Microsoft AutoUpdate updates |
First app launch
The following network endpoints are contacted on first launch of an Office app. These endpoints provide enhanced Office functionality for users, and the URLs are contacted regardless of license type (including Volume License installations).
| URL | Apps | Type | Description |
|---|---|---|---|
https://config.edge.skype.com/ |
WXPON |
ST |
'Flighting' Configuration - allows for feature light-up and experimentation. |
https://ocos-office365-s2s.msedge.net/ |
WXPON |
ST |
'Flighting' Network Configuration Test |
https://client-office365-tas.msedge.net/ |
WXPON |
ST |
'Flighting' Network Configuration Test |
https://officeclient.microsoft.com/ |
WXPON |
ST |
Office Configuration Service - Master list of service endpoints. |
https://nexusrules.officeapps.live.com/ |
WXPON |
ST |
Office Rules Telemetry download - Informs the client about what data and events to upload to the telemetry service. |
https://mobile.pipe.aria.microsoft.com/ |
N |
CS |
OneNote Telemetry Service |
https://nexus.officeapps.live.com/ |
WXPON |
ST |
Office Telemetry Upload Reporting - "Heartbeart" and error events that occur on the client are uploaded to the telemetry service. |
https://templateservice.office.com/ |
WXP |
CS |
Office Template Service - Provides users with online document templates. |
https://omextemplates.content.office.net/ |
WXP |
CS |
Office Templates Downloads - Storage of PNG template images. |
https://store.office.com/ |
WXP |
CS |
Store configuration for Office apps. |
https://odc.officeapps.live.com/ |
WXPN |
CS |
Office Document Integration Services Catalog (list of services and endpoints) and Home Realm Discovery. |
https://cdn.odc.officeapps.live.com/ |
WXPON |
CS |
Resources for Home Realm Discovery v2 (15.40 and later) |
https://officecdn.microsoft.com/ |
WXPON |
ST |
Microsoft AutoUpdate Manifests - checks to see if there are updates available |
https://ajax.aspnetcdn.com/ |
WXPO |
SS |
Microsoft Ajax JavaScript Library |
https://wikipedia.firstpartyapps.oaspapps.com/ |
W |
SS |
Wikipedia app for Office configuration and resources. |
https://excelbingmap.firstpartyapps.oaspapps.com/ |
X |
SS |
Bing Map app for Office configuration and resources. |
https://peoplegraph.firstpartyapps.oaspapps.com/ |
X |
SS |
People Graph app for Office configuration and resources. |
https://www.onenote.com/ |
N |
ST |
What's New content for OneNote. |
https://site-cdn.onenote.net/ |
N |
ST |
New content for OneNote. |
https://site-cdn.onenote.net/ |
N |
SS |
What's New images for OneNote. |
https://acompli.helpshift.com/ |
O |
ST |
In-app Support Service. |
https://prod-global-autodetect.acompli.net/ |
O |
ST |
Email Account Detection Service. |
https://autodiscover-s.outlook.com/ |
WXPO |
ST |
Outlook AutoDiscovery |
https://outlook.office365.com/ |
WXPO |
ST |
Outlook endpoint for Microsoft 365 service. |
https://r1.res.office365.com/ |
O |
ST |
Icons for Outlook add-ins. |
Note
The Office Configuration Service acts as an auto-discovery service for all Microsoft Office clients, not just for Mac. The endpoints returned in the response are semi-static in that change is very infrequent, but still possible.
Sign-in
The following network endpoints are contacted when signing in to cloud-based storage. Depending on your account type, different services may be contacted. For example:
MSA: Microsoft Account - typically used for consumer and retail scenarios
OrgID: Organization Account - typically used for commercial scenarios
| URL | Apps | Type | Description |
|---|---|---|---|
https://login.windows.net/ |
WXPON |
ST |
Windows Authorization Service |
https://login.microsoftonline.com/ |
WXPON |
ST |
Microsoft 365 Login Service (OrgID) |
https://login.live.com/ |
WXPON |
ST |
Microsoft Account Login Service (MSA) |
https://auth.gfx.ms/ |
WXPON |
CS |
Microsoft Account Login Service Helper (MSA) |
https://secure.aadcdn.microsoftonline-p.com/ |
WXPON |
SS |
Microsoft 365 Login Branding (OrgID) |
https://ocws.officeapps.live.com/ |
WXPN |
CS |
Document and Places Storage Locator |
https://roaming.officeapps.live.com/ |
WXPN |
CS |
Most Recently Used (MRU) document service |
Note
For subscription-based and retail licenses, signing in both activates the product, and enables access to cloud resources such as OneDrive. For Volume License installations, users are still prompted to sign-in (by default), but that is only required for access to cloud resources, as the product is already activated.
Product activation
The following network endpoints apply to Microsoft 365 Subscription and Retail License activations. Specifically, this does NOT apply to Volume License installations.
| URL | Apps | Type | Description |
|---|---|---|---|
https://ols.officeapps.live.com/ |
WXPON |
CS |
Office Licensing Service |
What's New content
The following network endpoints apply to Microsoft 365 Subscription only.
| URL | Apps | Type | Description |
|---|---|---|---|
https://contentstorage.osi.office.net/ |
WXPO |
SS |
What's New JSON page content. |
Researcher
The following network endpoints apply to Microsoft 365 Subscription only.
| URL | Apps | Type | Description |
|---|---|---|---|
https://entity.osi.office.net/ |
W |
CS |
Researcher Web Service |
https://cdn.entity.osi.office.net/ |
W |
CS |
Researcher Static Content |
https://www.bing.com/ |
W |
CS |
Researcher Content Provider |
Smart Lookup
The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.
| URL | Apps | Type | Description |
|---|---|---|---|
https://uci.officeapps.live.com/ |
WXPN |
CS |
Insights Web Service |
https://ajax.googleapis.com/ |
WXPN |
CS |
JQuery Library |
https://cdnjs.cloudflare.com/ |
WXPN |
CS |
Supporting JavaScript Library |
https://www.bing.com/ |
WXPN |
CS |
Insights Content Provider |
https://tse1.mm.bing.net/ |
WXPN |
CS |
Insights Content Provider |
PowerPoint Designer
The following network endpoints apply to Microsoft 365 Subscription only.
| URL | Apps | Type | Description |
|---|---|---|---|
https://pptsgs.officeapps.live.com/ |
P |
CS |
PowerPoint Designer web service |
PowerPoint QuickStarter
The following network endpoints apply to Microsoft 365 Subscription only.
| URL | Apps | Type | Description |
|---|---|---|---|
https://pptcts.officeapps.live.com/ |
P |
CS |
PowerPoint QuickStarter web service |
Send a Smile/Frown
The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.
| URL | Apps | Type | Description |
|---|---|---|---|
https://sas.office.microsoft.com/ |
WXPON |
CS |
Send a Smile Service |
Contact Support
The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.
| URL | Apps | Type | Description |
|---|---|---|---|
https://powerlift-frontdesk.acompli.net/ |
O |
CS |
Contact Support Service |
https://acompli.helpshift.com/ |
O |
CS |
In-app Support Service |
Save As PDF
The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations.
| URL | Apps | Type | Description |
|---|---|---|---|
https://wordcs.officeapps.live.com/ |
W |
CS |
Word document conversion service (PDF) |
Office Apps (aka add-ins)
The following network endpoints apply to both Microsoft 365 Subscription and Retail/Volume License activations when Office App add-ins are trusted.
| URL | Apps | Type | Description |
|---|---|---|---|
https://store.office.com/ |
WXPO |
CS |
Office app store configuration |
https://wikipedia.firstpartyapps.oaspapps.com/ |
W |
SS |
Wikipedia app resources |
https://excelbingmap.firstpartyapps.oaspapps.com/ |
X |
SS |
Bing Map app resources |
https://peoplegraph.firstpartyapps.oaspapps.com |
X |
SS |
People Graph app resources |
https://o15.officeredir.microsoft.com/ |
WPX |
SS |
Office Redirection Service |
https://appsforoffice.microsoft.com/ |
WXP |
SS |
Office JavaScript Libraries |
https://telemetry.firstpartyapps.oaspapps.com/ |
WX |
SS |
Telemetry and Reporting Service for Office apps |
https://ajax.microsoft.com/ |
W |
SS |
Microsoft Ajax JavaScript Library |
https://ajax.aspnetcdn.com/ |
X |
SS |
Microsoft Ajax JavaScript Library |
https://c.microsoft.com/ |
WPXO |
SS |
Office JavaScript Libraries |
https://c1.microsoft.com/ |
WPXO |
SS |
Support resources |
https://cs.microsoft.com/ |
WPXO |
SS |
Support resources |
https://c.bing.com/ |
WPXO |
SS |
Support resources |
https://*.cdn.optimizely.com/ |
WPXO |
SS |
JavaScript library |
https://errors.client.optimizely.com/ |
WPX |
SS |
Error reporting |
https://*-contentstorage.osi.office.net/ |
WPXO |
SS |
Font resources |
https://nexus.ensighten.com/ |
WPXO |
SS |
Telemetry Service |
https://browser.pipe.aria.microsoft.com/ |
WPXO |
SS |
Telemetry Reporting |
https://*.vo.msecnd.net/ |
WPXO |
SS |
Microsoft Store Asset Library |
https://*.wikipedia.org/ |
W |
SS |
Wikipedia page resources |
https://upload.wikimedia.org/ |
W |
SS |
Wikipedia media resources |
https://wikipedia.firstpartyappssandbox.oappseperate.com/ |
W |
SS |
Wikipedia sandbox frame |
https://*.virtualearth.net/ |
X |
SS |
Map templates |
Safe Links
The following network endpoint applies to all Office applications for Microsoft 365 Subscription only.
| URL | Type | Description |
|---|---|---|
https://*.oscs.protection.outlook.com/ |
CS |
Microsoft Safe Link Service |
Crash reporting
The following network endpoint applies to all Office applications for both Microsoft 365 Subscription and Retail/Volume License activations. When a process unexpectedly crashes, a report is generated and sent to the Watson service.
| URL | Type | Description |
|---|---|---|
https://watson.microsoft.com/ |
ST |
Microsoft Error Reporting Service |
https://officeci.azurewebsites.net/ |
ST |
Office Collaborative Insights Service |
Options for reducing network requests and traffic
The default configuration of Office for Mac provides the best user experience, both in terms of functionality and keeping the machine up to date. In some scenarios, you may wish to prevent applications from contacting network endpoints. This section discusses options for doing so.
Disabling Cloud Sign-In and Office Add-Ins
Volume License customers may have strict policies about saving documents to cloud-based storage. The following per-application preference can be set to disable MSA/OrgID Sign in, and access to Office Add-ins.
defaults write com.microsoft.Word UseOnlineContent -integer 0defaults write com.microsoft.Excel UseOnlineContent -integer 0defaults write com.microsoft.Powerpoint UseOnlineContent -integer 0
If users try to access the Sign-In function, they will see an error that a network connection is not present. Because this preference also blocks online product activation, it should only be used for Volume License installations. Specifically, using this preference will prevent Office applications from accessing the following endpoints:
https://odc.officeapps.live.comhttps://*.firstpartyapps.oaspapps.comAll endpoints listed in the 'Sign In' section above.
All endpoints listed in the 'Smart Lookup' section above.
All endpoints listed in the 'Product Activation' section above.
All endpoints listed in the 'Office Apps (aka add-ins)' section above.
To re-establish full functionality for the user, either set the preference to '2' or remove it.
Note
This preference requires Office for Mac build 15.25 [160726] or later.
Telemetry
Office for Mac sends telemetry information back to Microsoft at regular intervals. Data is uploaded to the 'Nexus' endpoint. The telemetry data helps the engineering team assess the health and any unexpected behaviors of each Office app. There are two categories of telemetry:
Heartbeat contains version and license information. This data is sent immediately upon app launch.
Usage contains information about how apps are being used and non-fatal errors. This data is sent every 60 minutes.
Microsoft takes your privacy very seriously. You can read about Microsoft's data collection policy at https://privacy.microsoft.com. To prevent applications from sending 'Usage' telemetry, the SendAllTelemetryEnabled preference can be adjusted. The preference is per-application, and can be set via macOS Configuration Profiles, or manually from Terminal:
defaults write com.microsoft.Word SendAllTelemetryEnabled -bool FALSE
defaults write com.microsoft.Excel SendAllTelemetryEnabled -bool FALSE
defaults write com.microsoft.Powerpoint SendAllTelemetryEnabled -bool FALSE
defaults write com.microsoft.Outlook SendAllTelemetryEnabled -bool FALSE
defaults write com.microsoft.onenote.mac SendAllTelemetryEnabled -bool FALSE
defaults write com.microsoft.autoupdate2 SendAllTelemetryEnabled -bool FALSE
defaults write com.microsoft.Office365ServiceV2 SendAllTelemetryEnabled -bool FALSE
Heartbeat telemetry is always sent and cannot be disabled.
Crash reporting
When a fatal application error occurs, the application will unexpectedly terminate and upload a crash report to the 'Watson' service. The crash report consists of a call-stack, which is the list of steps the application was processing leading up to the crash. These steps help the engineering team identify the exact function that failed and why.
In some cases, the contents of a document will cause the application to crash. If the app identifies the document as the cause, it will ask the user if it's okay to also send the document along with the call-stack. Users can make an informed choice to this question. IT administrators may have strict requirements about the transmission of documents and make the decision on behalf of the user to never send documents. The following preference can be set to prevent documents from being sent, and to suppress the prompt to the user:
defaults write com.microsoft.errorreporting IsAttachFilesEnabled -bool FALSE
Note
If SendAllTelemetryEnabled is set to FALSE, all crash reporting for that process is disabled. To enable crash reporting without sending usage telemetry, the following preference can be set: defaults write com.microsoft.errorreporting IsMerpEnabled -bool TRUE
Updates
Microsoft releases Office for Mac updates at regular intervals (typically once a month). We strongly encourage users and IT administrators to keep machines up to date to ensure the latest security fixes are installed. In cases where IT administrators want to closely control and manage machine updates, the following preference can be set to prevent the AutoUpdate process from automatically detecting and offering product updates:
defaults write com.microsoft.autoupdate2 HowToCheck -string 'Manual'
Blocking Requests with a Firewall/Proxy
If your organization blocks requests to URLs via a firewall or proxy server be sure to configure the URLs listed in this document as either allowed, or block listed with a 40X response (e.g. 403 or 404). A 40X response will allow the Office applications to gracefully accept the inability to access the resource, and will provide a faster user experience, than simply dropping the connection, which in turn will cause the client to retry.
If your proxy server requires authentication, a 407 response will be returned to the client. For the best experience, ensure that you're using Office for Mac builds 15.27 or later, as they include specific fixes for working with NTLM and Kerberos servers.