MDE infrastructure change might require changes in firewall and Proxy setting

On May 15th, 2021 we will conduct a change in our backend networking infrastructure. This change will result in changes to public IPs of Defender for Endpoint Command and control communication.

Key Points

• Timing: May 15, 2021
• Action: review and update URLs as appropriate

How this affects your organization

We strongly recommend allowing Command and Control Service URLs in your network as follow.

Europe Region

• winatp-gw-weu.microsoft.com
• winatp-gw-neu.microsoft.com

UK Region

• winatp-gw-uks.microsoft.com
• winatp-gw-ukw.microsoft.com

US Region

• winatp-gw-eus.microsoft.com
• winatp-gw-cus.microsoft.com

What you need to do to prepare:

Review your URLs and make changes as appropriate for your organization.

You can see the full list of Service URLs in the following documentation: Configure device proxy and Internet connectivity settings

In case specific IPs are allowed in your network, instead of endpoint URLs you will have to change the IPs. For more information, please open a support case with the title “Configuration update is required to enable Command and Control communication before May 15th, 2021”