Need documentation for windows update domains or IP addresses without wildcards

Question

I want to accurately filter traffic for ms-updates in a business firewall. Microsoft only provides lists of domains with wildcards but many firewall appliances will not match wildcard addresses.

I have read through several similar threads and I fully understand the complexity of Microsoft's dns configuration and the fact that the addresses are subject to change. Telling me this will not fix the problem.

If I have a reliable source of windows update ip addresses or fqdns involving subdomains, I can easily automate a solution that will give me the information I need for whitelisting. This isn't a question about WSUS and suggesting that I use WSUS is not a solution.

I've read through the following thread:

https://learn.microsoft.com/en-us/answers/questions/457840/what-are-the-ip-ranges-for-microsofty-windows-upda

This thread suggests: "Instead, we suggest either allowing all outbound connections to http & https ports or defining the DNS addresses as permitted destinations for traffic via the firewall."

Allowing all outbound http and https ports leaves my organization less secure and defining DNS addresses with wildcards is impossible with many firewalls. This is not a solution.

Many threads link to this page about wsus:

https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#211-configure-your-firewall-to-allow-your-first-wsus-server-to-connect-to-microsoft-domains-on-the-internet

However, this is not a solution either as it requires wildcard masks.

Other threads have suggested using the MSFT ip address list found here:

https://www.microsoft.com/en-us/download/details.aspx?id=53602

However, I do not want to whitelist a bunch of azure webhosts that Microsoft has rented out to potentially malicious actors. This is not a solution either.

---

It's easy to find others complaining about this problem but not finding solutions. At least one of the threads I've read suggests that Microsoft does not publish this information for 'security reasons'. Microsoft insisting on using these wildcard masks without providing a means to get the data without wildcards shows that Microsoft is valuing it's own flexibility rather than the security needs of its customers as it results in environments either having faulty update traffic or allowing unwanted traffic.

Can anyone provide a way to find this information/

Answer 1

I'm pretty confident you will never get the list - partly due to the fact they can change at will as part of the balancing and scaling abilities that is required to serve the global community for updates. This is why wildcard DNS is used in the documentation.