3.2 Network Connectivity Insights

Quick Answer: Microsoft 365 performs best when user traffic egresses to the internet close to the user, DNS resolves near the user, and Optimize-category endpoints bypass VPN hairpins, SSL inspection, and proxy PAC logic. The Network Connectivity insight in the admin center (Reports → Network connectivity) shows a per-office network performance score derived from Windows client telemetry, and the Microsoft 365 URL/IP web service publishes the current endpoint list for PAC files and firewalls.

Microsoft 365 is a SaaS workload delivered from Microsoft's global cloud network. Unlike on-premises workloads where the network team controls the entire path, Microsoft 365 performance depends on how the corporate network reaches Microsoft's edge. Microsoft publishes explicit network connectivity principles for Microsoft 365, and the MS-102 administrator is expected to understand them and to use the admin center's Network Connectivity insight to identify problems.

Microsoft 365 Network Connectivity Principles

Microsoft's published guidance for Microsoft 365 network connectivity rests on a handful of principles:

• Identify and differentiate Microsoft 365 traffic — know which destinations are Microsoft 365 endpoints and treat them differently from generic internet traffic.
• Egress network connections locally — users should reach the internet as close to their physical location as possible. Backhauling all branch traffic through a central corporate egress adds latency and reduces performance, especially for real-time media in Teams.
• Resolve DNS names locally — DNS resolution for Microsoft 365 endpoints should happen near the user so Microsoft's GeoDNS returns the closest Microsoft 365 front door.
• Optimize Microsoft 365 traffic — bypass network intermediaries (proxies, SSL inspection, deep packet inspection) for the most critical endpoints, and prefer direct internet egress.
• Forward traffic to Microsoft 365 front doors — route Microsoft 365 traffic to the nearest Microsoft network entry point, which GeoDNS handles when DNS resolves near the user.
• Avoid hairpins — a hairpin occurs when traffic destined for a nearby Microsoft edge is routed through a distant egress (often a VPN concentrator or central proxy) before reaching Microsoft.

Network Connectivity Insight in the Admin Center

The Network Connectivity insight is under Reports → Network connectivity in the Microsoft 365 admin center. The data is derived from Windows client telemetry — specifically, location-aware network diagnostics collected by Windows devices signed in with a Microsoft 365 account — and aggregated per office location. No agent deployment is required beyond Windows itself.

For each detected office location the dashboard shows:

• Network performance score — a relative indicator of how that location's Microsoft 365 connectivity compares to other enterprises.
• Microsoft 365 network assessment — a per-location assessment (better than, average, worse than) derived from latency, TCP latency, download bandwidth, and HTTP latency to the Microsoft 365 service front door.
• ISP — the internet service provider observed for the location's egress.
• Egress location — the geographic location where traffic leaves the corporate network for the internet, which may differ from the user's office.
• Better-than / average / worse-than comparison — a benchmark against other enterprise customers in the same metro.

When the egress location is far from the user location, or when latency to the Microsoft 365 service front door is high, the insight surfaces a recommendation (for example, "Provide network egress closer to your users" or "Avoid SSL inspection on Microsoft 365 traffic"). These recommendations map directly to the published principles above.

Prerequisites and Privacy

Network Connectivity insights require Windows client devices running supported Windows versions with location services enabled and the device opted in to send diagnostic data. Microsoft 365 Apps health and network connectivity data is processed in a way that does not expose individual user identity in the dashboard. Admins can disable the collection through policy if organizational privacy rules forbid it, at the cost of losing the insight.

Microsoft 365 Endpoint Categories

Microsoft publishes the Microsoft 365 endpoints as a categorized list. Every endpoint falls into one of three categories, each with different routing guidance. The MS-102 exam expects you to know which category matters most and why.

The Optimize category is small — only a few dozen FQDNs and IP prefixes — and accounts for the majority of Microsoft 365 bandwidth and latency sensitivity. The single most impactful network change an enterprise can make for Microsoft 365 is to configure VPN split tunneling so Optimize traffic bypasses the VPN tunnel and egresses directly.

Microsoft 365 URL/IP Web Service

The endpoint list changes over time as Microsoft adds services and IP ranges. To keep PAC files, firewalls, and SD-WAN policies current, Microsoft publishes the Microsoft 365 URL/IP web service (also called the Office 365 IP Address and URL Web Service) at https://endpoints.office.com. The service returns JSON describing each endpoint's category, required FQDNs, IP prefixes, ports, and an expressRoute flag, plus a clientRequestId and version metadata so callers can poll for changes.

A typical PAC file generator script calls the web service, filters to the Optimize (and optionally Allow) categories, and emits a PAC file that sends those destinations direct while proxying the rest. Many SD-WAN vendors and next-gen firewall platforms consume the same feed natively. Best practice is to poll at least daily; Microsoft publishes a recommended polling cadence and supports a versioned change feed so callers can fetch only deltas.

Network Recommendations the Insight Surfaces

The Network Connectivity insight produces specific recommendations, including:

• Provide network egress closer to your users — egress location is distant from the user location; add local internet breakouts.
• Avoid SSL inspection on Microsoft 365 traffic — SSL inspection detected on Optimize endpoints; remove it for that category.
• Improve DNS resolution for Microsoft 365 traffic — DNS is being resolved at a central location rather than near the user; configure regional DNS resolvers.
• Avoid network hairpins — traffic is being routed through a distant egress or proxy before reaching Microsoft.

Each recommendation is actionable and ties back to a published principle. The MS-102 administrator's job is to recognize the recommendation, route it to the network team, and verify the change improves the network assessment over time.