Office 365 updatable objects question

[the_rock]

Hey guys,

I was wondering if someone might be able to confirm this for me, since I did not want to open TAC case for it as of yet, figured someone here would know for sure. When adding anything that comes up when searching for office 365 in updatable objects in smart dashboard, link that shows up as reference is below:

https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service

Im trying to confirm if above link would cover EVERYTHING listed in below link:

https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-world...

Thats it : - ). My logical assumption is that it does cover it, but want to be 100% sure.

Cheers,

Andy

[Kaspars_Zibarts · Accepted solution]

Yes it does. We have not had any issues accessing O365 after updatable objects were introduced and we could skip scripting it ourselves 

[the_rock]

Tx a lot!!

[the_rock]

Thanks lots @Kaspars_Zibarts . One more question I have...did you have to make any nat rules modifications? Im thinking not since all those ranges are external, but they dont need to translate to any internal IP?

[Kaspars_Zibarts]

No nothing special with using updatable objects. But we do use multiple NAT IPs for O365. From memory, o365/ms did not like too many users behind the same single IP. I might be lying now, but I think it was 2000 per IP

[the_rock]

Thanks @Kaspars_Zibarts ! This was what customer indicated to me...now the thing is users are everywhere behind the firewall, office 365 online communicate with the users directly not the exchange server. So, in that case, not sure how NAT would be configured or if its even needed.

[Kaspars_Zibarts]

O365 connections always originate from inside/client. Never from O365 to client

[the_rock]

Ok, so Im little confused...so can you give me example of what nat looks like on your end if you dont mind?

Andy

[the_rock]

@Kaspars_Zibarts  Or, I assume you are referring to source NAT here and NOT destination NAT?

[Kaspars_Zibarts]

Correct. 

[the_rock]

@Kaspars_Zibarts  thanks! Well, they have option to hide internal networks behind fw checked on cluster properties, so I guess thats good enough? No need to change any inbound nat? 

[Kaspars_Zibarts]

That's correct. There's no need for any inbound NAT. As for outbound - as long as you have you need to make sure that you are not NATing too many users behind one IP:

https://docs.microsoft.com/en-us/microsoft-365/enterprise/nat-support-with-microsoft-365?view=o365-w... 

[the_rock]

• Thanks @Kaspars_Zibarts . This customer has about 1000 employees, so I think it should be good.