Firewall and Proxy Server Settings for Client Computers - The Windows Intune Team Blog - Site Home

Those of you out there with firewalls may have run into issues with the Windows Intune clients having difficulty communicating with the service. The excerpt below provides detailed information on how to set up your firewall for a successful Windows Implementation. Thanks goes to our awesome documentation team for putting this together, and to the Windows Intune client team for doing the research and testing.

If you want to use Windows Intune™ to manage client computers that exist behind firewalls or proxy servers, you must configure the firewall or proxy server to allow Windows Intune to communicate with the client computers.

Required firewall configuration

If the client computers exist behind a firewall, you must configure the firewall to allow communications with the domains through the specified ports that are listed in the following tables.

Required domains for documentation, online Help, and support

Domain	Ports
*.livemeeting.com	80 and 443
*.microsoftonline.com	80
onlinehelp.microsoft.com	80
*.social.technet.microsoft.com	80
blogs.technet.com	80
go.microsoft.com	80
www.microsoft.com	80

Required domains for Microsoft Update Services

Domain	Ports
*.update.microsoft.com	80 and 443
download.microsoft.com	80 and 443
update.microsoft.com	80 and 443

Depending on the firewall and how it processes DNS lookup requests, you might also need to allow access to the domain manage.microsoft.com.nsatc.net on port 80.

Required domains for Windows Intune and related services

Domain	Ports
*.manage.microsoft.com	80 and 443
*.spynet2.microsoft.com	443
manage.microsoft.com	80 and 443
wustat.microsoft.com	80 and 443

Required domains for Windows Update Services

Domain	Ports
*.download.windowsupdate.com	80 and 443
*.windowsupdate.com	80 and 443
download.windowsupdate.com	80 and 443
ntservicepack.microsoft.com	80 and 443
windowsupdate.microsoft.com	80 and 443

Required proxy server configuration

If the client computers exist behind a proxy server, you must configure the proxy server as follows:

Windows Intune communicates with client computers by using both the HTTP and HTTPS protocols. Confirm that the proxy server supports HTTP and HTTPS.
Windows Intune supports the Non-auth and Negotiate (Kerberos) authentication methods. If the proxy server uses the Negotiate (Kerberos) authentication method, the proxy server must allow computer accounts (instead of domain user accounts) to be enrolled in the service because the client software enrollment package runs as user LocalSystem.

You can modify proxy server settings on individual client computers, or you can use Group Policy to change settings for all client computers that exist behind a specified proxy server. Authenticated proxy servers are not supported.