Study guide
3.2 Network Connectivity Insights
Microsoft 365 Administrator Expert MS-102
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide
2 Tenant Setup, Domains & Org Settings
2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile
3 Service Health, Network & Software Updates
3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates
4 Adoption, Usage & Microsoft 365 Backup
4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup
5 Users, Contacts, Groups & Shared Mailboxes
5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes
6 Licensing & Bulk User Management
6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell
7 Roles, Admin Units & Privileged Identity Management
7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM
8 Identity Synchronization with Entra Connect
8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization
9 Authentication, SSPR & Password Protection
9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues
10 Identity Protection, Conditional Access & MFA
10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access
11 Defender XDR Posture, Incidents & Threat Intelligence
11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence
12 Defender for Office 365: Policies, Alerts & Investigation
12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats
13 Attack Simulation & Restricted Entities
13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users
14 Defender for Endpoint
14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard
15 Defender for Cloud Apps
15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery
16 Purview Information Protection & Data Lifecycle
16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer
17 Purview Data Loss Prevention
17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports
18 Final Review & Exam Strategy
18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps
3.2 Network Connectivity Insights
Key Takeaways Explain This Topic AI
Microsoft 365 network design principles call for egressing user traffic to the internet as close to the user as possible rather than backhauling to a central corporate egress, and for resolving DNS names near the user
Microsoft 365 endpoints are partitioned into three categories — Optimize, Allow, and Default — each with different routing, performance, and inspection guidance
Optimize endpoints represent the most critical Microsoft 365 traffic (Exchange Online, SharePoint Online, Skype for Business Online / Teams media) and should bypass VPN split tunneling hairpins, SSL inspection, and proxy PAC logic, routing directly to the internet
The Network Connectivity insight in the Microsoft 365 admin center (Reports → Network connectivity) is derived from Windows client location-aware telemetry and produces a network performance score, network assessment, ISP, and egress location for each office location
The Microsoft 365 URL/IP web service (endpoints.office.com) publishes the current Optimize/Allow/Default endpoint list as a machine-readable REST feed so PAC files, firewalls, and SD-WANs can consume updates automatically
Last updated: August 2026
Quick Answer: Microsoft 365 performs best when user traffic egresses to the internet close to the user, DNS resolves near the user, and Optimize-category endpoints bypass VPN hairpins, SSL inspection, and proxy PAC logic. The Network Connectivity insight in the admin center (Reports → Network connectivity) shows a per-office network performance score derived from Windows client telemetry, and the Microsoft 365 URL/IP web service publishes the current endpoint list for PAC files and firewalls.
Microsoft 365 is a SaaS workload delivered from Microsoft's global cloud network. Unlike on-premises workloads where the network team controls the entire path, Microsoft 365 performance depends on how the corporate network reaches Microsoft's edge. Microsoft publishes explicit network connectivity principles for Microsoft 365, and the MS-102 administrator is expected to understand them and to use the admin center's Network Connectivity insight to identify problems.
Microsoft 365 Network Connectivity Principles
Microsoft's published guidance for Microsoft 365 network connectivity rests on a handful of principles:
Identify and differentiate Microsoft 365 traffic — know which destinations are Microsoft 365 endpoints and treat them differently from generic internet traffic.
Egress network connections locally — users should reach the internet as close to their physical location as possible. Backhauling all branch traffic through a central corporate egress adds latency and reduces performance, especially for real-time media in Teams.
Resolve DNS names locally — DNS resolution for Microsoft 365 endpoints should happen near the user so Microsoft's GeoDNS returns the closest Microsoft 365 front door.
Optimize Microsoft 365 traffic — bypass network intermediaries (proxies, SSL inspection, deep packet inspection) for the most critical endpoints, and prefer direct internet egress.
Forward traffic to Microsoft 365 front doors — route Microsoft 365 traffic to the nearest Microsoft network entry point, which GeoDNS handles when DNS resolves near the user.
Avoid hairpins — a hairpin occurs when traffic destined for a nearby Microsoft edge is routed through a distant egress (often a VPN concentrator or central proxy) before reaching Microsoft.
Network Connectivity Insight in the Admin Center
The Network Connectivity insight is under Reports → Network connectivity in the Microsoft 365 admin center. The data is derived from Windows client telemetry — specifically, location-aware network diagnostics collected by Windows devices signed in with a Microsoft 365 account — and aggregated per office location. No agent deployment is required beyond Windows itself.
For each detected office location the dashboard shows:
Network performance score — a relative indicator of how that location's Microsoft 365 connectivity compares to other enterprises.
Microsoft 365 network assessment — a per-location assessment (better than, average, worse than) derived from latency, TCP latency, download bandwidth, and HTTP latency to the Microsoft 365 service front door.
ISP — the internet service provider observed for the location's egress.
Egress location — the geographic location where traffic leaves the corporate network for the internet, which may differ from the user's office.
Better-than / average / worse-than comparison — a benchmark against other enterprise customers in the same metro.
When the egress location is far from the user location, or when latency to the Microsoft 365 service front door is high, the insight surfaces a recommendation (for example, "Provide network egress closer to your users" or "Avoid SSL inspection on Microsoft 365 traffic"). These recommendations map directly to the published principles above.
Prerequisites and Privacy
Network Connectivity insights require Windows client devices running supported Windows versions with location services enabled and the device opted in to send diagnostic data. Microsoft 365 Apps health and network connectivity data is processed in a way that does not expose individual user identity in the dashboard. Admins can disable the collection through policy if organizational privacy rules forbid it, at the cost of losing the insight.
Microsoft 365 Endpoint Categories
Microsoft publishes the Microsoft 365 endpoints as a categorized list. Every endpoint falls into one of three categories, each with different routing guidance. The MS-102 exam expects you to know which category matters most and why.
Category What it covers Routing guidance Inspection
Optimize The most critical, high-volume, low-latency Microsoft 365 traffic: Exchange Online, SharePoint Online, Skype for Business Online, and Microsoft Teams real-time media Route directly to the internet, bypass VPN hairpins, bypass proxies where possible, prefer shortest path to the nearest Microsoft 365 front door Bypass SSL inspection and deep packet inspection; allow directly
Allow Less sensitive but still Microsoft 365-specific traffic: some SharePoint Online URLs, Office 365 video portal, Microsoft 365 Common and Office Online services, and a small set of auxiliary URLs May traverse a proxy; still benefits from direct egress; no SSL bypass required but allowed SSL inspection tolerable but not required; allowed through perimeter
Default Everything else Microsoft 365-related that can be treated like normal internet traffic: telemetry, portal sign-in, CDN, and miscellaneous endpoints that do not need special handling Route like any other internet destination; proxies, SSL inspection, and standard perimeter inspection are acceptable Standard perimeter inspection acceptable
The Optimize category is small — only a few dozen FQDNs and IP prefixes — and accounts for the majority of Microsoft 365 bandwidth and latency sensitivity. The single most impactful network change an enterprise can make for Microsoft 365 is to configure VPN split tunneling so Optimize traffic bypasses the VPN tunnel and egresses directly.
Microsoft 365 URL/IP Web Service
The endpoint list changes over time as Microsoft adds services and IP ranges. To keep PAC files, firewalls, and SD-WAN policies current, Microsoft publishes the Microsoft 365 URL/IP web service (also called the Office 365 IP Address and URL Web Service) at https://endpoints.office.com . The service returns JSON describing each endpoint's category, required FQDNs, IP prefixes, ports, and an expressRoute flag, plus a clientRequestId and version metadata so callers can poll for changes.
A typical PAC file generator script calls the web service, filters to the Optimize (and optionally Allow) categories, and emits a PAC file that sends those destinations direct while proxying the rest. Many SD-WAN vendors and next-gen firewall platforms consume the same feed natively. Best practice is to poll at least daily; Microsoft publishes a recommended polling cadence and supports a versioned change feed so callers can fetch only deltas.
Network Recommendations the Insight Surfaces
The Network Connectivity insight produces specific recommendations, including:
Provide network egress closer to your users — egress location is distant from the user location; add local internet breakouts.
Avoid SSL inspection on Microsoft 365 traffic — SSL inspection detected on Optimize endpoints; remove it for that category.
Improve DNS resolution for Microsoft 365 traffic — DNS is being resolved at a central location rather than near the user; configure regional DNS resolvers.
Avoid network hairpins — traffic is being routed through a distant egress or proxy before reaching Microsoft.
Each recommendation is actionable and ties back to a published principle. The MS-102 administrator's job is to recognize the recommendation, route it to the network team, and verify the change improves the network assessment over time.