Review Required Outbound Connections To Work Wit Defender For Cloud Apps

Query

DeviceNetworkEvents
| where  ActionType !has "ConnectionSuccess" and RemotePort == 443
| where 
    ipv4_is_in_range(RemoteIP, "3.107.219.0/24") or
    ipv4_is_in_range(RemoteIP, "13.107.227.0/24") or
    ipv4_is_in_range(RemoteIP, "13.107.228.0/24") or
    ipv4_is_in_range(RemoteIP, "13.107.229.0/24") or
    ipv4_is_in_range(RemoteIP, "150.171.97.0/24") or
    RemoteIP in~ ("13.80.125.22", "40.74.1.235", "40.74.6.204", "40.81.156.154", 
                  "40.81.156.156", "51.143.58.207", "52.137.89.147", 
                  "52.183.75.62", "20.0.210.84", "20.90.9.64") or
    RemoteUrl has "cdn.cloudappsecurity.com" or
    RemoteUrl has "cdn-discovery.cloudappsecurity.com" or
    RemoteUrl has "adaproddiscovery.azureedge.net" or
    RemoteUrl has "dev.virtualearth.net" or
    RemoteUrl has "flow.microsoft.com" or
    RemoteUrl has "static2.sharepointonline.com" or
    RemoteUrl has "discoveryresources-cdn-prod.cloudappsecurity.com" or
    RemoteUrl has "discoveryresources-cdn-gov.cloudappsecurity.us" or
    RemoteUrl endswith  ".s-microsoft.com" or
    RemoteUrl endswith  ".msecnd.net" or
    RemoteUrl endswith  ".blob.core.windows.net"
| project Timestamp, DeviceName,LocalIP,Outbound_IP_connection_to= RemoteIP, RemotePort,Outbound_URL_connection_to= RemoteUrl,Result_Connection_Attempt=ActionType, Protocol
| order by Timestamp desc

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
—	Operational / enrichment query (no single ATT&CK technique)

Author: Sergio Albea (07/04/2025)

Review required outbound connections to work with Defender for Cloud Apps

Microsoft has a new requirement for Cloud Apps to ensure service quality and prevent the interruption of some services and needs immediate Action by April, 21 2025. It is related to update your firewall rules to allow outbound traffic on port 443 for the corresponding IP addresses and URLs.

Therefore, there are an important number of URLs and IPs thats needs to be allowed to establish communications from our devices to outside.

The KQL Query of this week should help you to detect if there are some issue with the listed URL's and also you can add the range of IP's that applies to your case depending on the location of your DefenderXDR Tenant. (Verify your location on System > Settings > Cloud Apps > System > About > Datacenter)

Explanation

This KQL (Kusto Query Language) query is designed to help you identify any issues with outbound network connections from your devices to specific IP addresses and URLs, particularly those required for Microsoft Defender for Cloud Apps. Here's a simplified breakdown of what the query does:

Data Source: The query examines data from DeviceNetworkEvents, which logs network activities on devices.
Filter Conditions:
- It filters out successful connections (ActionType !has "ConnectionSuccess") to focus on failed or problematic connection attempts.
- It specifically looks at connections attempting to use port 443, which is commonly used for secure web traffic (HTTPS).
IP and URL Checks:
- The query checks if the remote IP address falls within specified ranges or matches specific IP addresses. These IPs are likely associated with Microsoft services or infrastructure.
- It also checks if the remote URL contains or ends with certain strings, which are related to Microsoft services and cloud applications.
Output:
- The query projects (selects) specific fields to display: the timestamp of the event, the device name, the local IP address, the remote IP and URL being connected to, the result of the connection attempt, and the protocol used.
- The results are ordered by the timestamp in descending order, showing the most recent events first.
Purpose:
- The main goal is to ensure that your firewall rules are correctly configured to allow necessary outbound traffic for Microsoft Defender for Cloud Apps. This is crucial to prevent service interruptions and maintain service quality.

By running this query, you can quickly identify any issues with outbound connections that need to be addressed, ensuring compliance with Microsoft's requirements by the specified deadline.

Details

Sergio Albea

Released: July 21, 2026

Tables

DeviceNetworkEvents

Keywords

DeviceNetworkEventsRemoteIPURLTimestampNameLocalPortActionTypeProtocol

Operators

DeviceNetworkEventswhereActionType!hasRemotePort==ipv4_is_in_rangeorin~hasendswithprojectorder bydesc

Actions

GitHub

KQL Search