Clarification on Whitelisting IdentityServiceDNS for WNS Notifications

Question

Clarification on Whitelisting IdentityServiceDNS for WNS Notifications

Chandru Vijayan 11

We are using Windows Notification Service (WNS), and I noticed the following FQDNs listed under IdentityServiceDNS in the latest XML configuration file:

login.microsoftonline.com
login.live.com

Given that our environment does not use Microsoft services like O365, I’d like to clarify:

Are these FQDNs strictly necessary for WNS notifications, even for environments without Microsoft services?
If so, what functionality would be impacted if we do not whitelist these domains?
Can we limit whitelisting to just the top three FQDNs (*.notify.windows.com, *.wns.windows.com, and *.notify.live.net), or is full whitelisting required for proper WNS functionality?We are using Windows Notification Service (WNS), and I noticed the following FQDNs listed under IdentityServiceDNS in the latest XML configuration file:
- login.microsoftonline.com
- login.live.com

Anonymous

2025-02-21T05:38:25.4866667+00:00

Hope you've been well. Any updates about this issue?

Besides, please kindly note that the tag system has changed in Microsoft Q&A now. You could select Windows tag and then select Windows APP SDK child tag for Windows app SDK or WinUI3 questions.
Anonymous

2025-02-25T03:02:39.6333333+00:00

FQDNs like login.microsoftonline.com and login.live.com are used for the authentication process of the WNS notifications. It is recommended to keep all of the in your XML configuration file.

Besides, does my reply answer your question?
Chandru Vijayan 11 Reputation points

2025-02-25T06:36:22.61+00:00
Based on the clarification provided, we understand that the following five domains must be whitelisted for Windows Notification Service (WNS):

*.notify.windows.com

*.wns.windows.com

*.notify.live.net

login.microsoftonline.com

login.live.com

We would like to confirm whether these domains need to be whitelisted for outbound traffic only or if inbound traffic should also be allowed.

Given that our environment does not use Microsoft services like Office 365, we aim to minimize exposure while ensuring WNS functions properly. Could you please specify the required traffic direction for each of these domains?
Chandru Vijayan 11 Reputation points

2025-02-25T06:37:36.5166667+00:00

If inbound traffic is required, could you provide relevant documentation explaining the technical reasoning behind this requirement? Additionally, since our environment does not use Microsoft services like Microsoft Entra ID (formerly Azure AD) or Office 365, we would like to understand why the domain login.microsoftonline.com is necessary for WNS functionality. Any official documentation or technical references on this would be greatly appreciated.
Anonymous

2025-02-26T03:02:01.2066667+00:00

If inbound traffic is required, could you provide relevant documentation explaining the technical reasoning behind this requirement?

@Chandru Vijayan I have to say that there is no more document for that. The document shows how the WNS works and maybe it doesn't cover all the details and underlying mechanism in that process. A simple way is that you could try to monitor the inbound traffic to see if those domains are necessary in a test environment.

1 answer

Your answer

Anonymous

2025-02-21T05:38:25.4866667+00:00

Hope you've been well. Any updates about this issue?

Besides, please kindly note that the tag system has changed in Microsoft Q&A now. You could select Windows tag and then select Windows APP SDK child tag for Windows app SDK or WinUI3 questions.
Anonymous

2025-02-25T03:02:39.6333333+00:00

FQDNs like login.microsoftonline.com and login.live.com are used for the authentication process of the WNS notifications. It is recommended to keep all of the in your XML configuration file.

Besides, does my reply answer your question?
Chandru Vijayan 11 Reputation points

2025-02-25T06:36:22.61+00:00

Based on the clarification provided, we understand that the following five domains must be whitelisted for Windows Notification Service (WNS):

*.notify.windows.com

*.wns.windows.com

*.notify.live.net

login.microsoftonline.com

login.live.com

We would like to confirm whether these domains need to be whitelisted for outbound traffic only or if inbound traffic should also be allowed.

Given that our environment does not use Microsoft services like Office 365, we aim to minimize exposure while ensuring WNS functions properly. Could you please specify the required traffic direction for each of these domains?
Chandru Vijayan 11 Reputation points

2025-02-25T06:37:36.5166667+00:00

If inbound traffic is required, could you provide relevant documentation explaining the technical reasoning behind this requirement? Additionally, since our environment does not use Microsoft services like Microsoft Entra ID (formerly Azure AD) or Office 365, we would like to understand why the domain login.microsoftonline.com is necessary for WNS functionality. Any official documentation or technical references on this would be greatly appreciated.
Anonymous

2025-02-26T03:02:01.2066667+00:00

If inbound traffic is required, could you provide relevant documentation explaining the technical reasoning behind this requirement?

@Chandru Vijayan I have to say that there is no more document for that. The document shows how the WNS works and maybe it doesn't cover all the details and underlying mechanism in that process. A simple way is that you could try to monitor the inbound traffic to see if those domains are necessary in a test environment.

Answer 1

Hello,

Welcome to Microsoft Q&A!

Are these FQDNs strictly necessary for WNS notifications, even for environments without Microsoft services?

These FQDNs are necessary for WNS notifications. For example, the login.live.com is used for authenticating your cloud service. It is the very first step of the WNS process.

If so, what functionality would be impacted if we do not whitelist these domains?

You will fail to authenticate the WNS and the WNS will not work.

Can we limit whitelisting to just the top three FQDNs (*.notify.windows.com, *.wns.windows.com, and *.notify.live.net), or is full whitelisting required for proper WNS functionality?

Please follow the document and make sure all the FQDNs are whitelisted.

Thank you.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Clarification on Whitelisting IdentityServiceDNS for WNS Notifications

1 answer

Your answer