Used Ports

The following table lists required ports that must be opened for inbound/outbound requests in Veeam Backup for Microsoft 365. For more information about Microsoft 365 URLs and IP address ranges, see this Microsoft article.

Note

Data communication between Microsoft 365 organizations and Veeam Backup for Microsoft 365 is performed through an SSL connection.

 

From

To

Protocol

Port

Description

Veeam Backup for Microsoft 365 Server

Microsoft Exchange Online

TCP

443

Required to connect to Microsoft Exchange Online organizations.

The endpoints are: outlook.office365.com and autodiscover-s.outlook.com.

Microsoft SharePoint Online

TCP

443

Required to connect to Microsoft SharePoint Online organizations.

The endpoints are: <tenant>.sharepoint.com, <tenant>-my.sharepoint.com and <tenant>-admin.sharepoint.com.

On-premises Microsoft SharePoint Server

HTTP (HTTPS)

5985 (5986 — used by default)

Required to connect to on-premises Microsoft SharePoint organizations through the WinRM port.

On-premises Microsoft Exchange Server

TCP

80 or 443

Required to connect to on-premises Microsoft Exchange organizations.

Backup Proxy Server

TCP

9193 (used by default)

Required to manage inbound/outbound traffic when interacting with the Veeam Backup for Microsoft 365 server.

Make sure to open this port on a backup proxy server.

TCP

445

This port is used to:

  • Install and manage the Veeam.Archiver.Proxy service on a target proxy machine.
  • Perform RPC requests.

Veeam Auto-update Server

HTTPS

443

Required to access the auto-update server and licensing server. For more information, see Updating Veeam Backup for Microsoft 365 and Installing and Updating License.

The endpoints are: https://vbo.butler.veeam.com and download2.veeam.com.

S3 Compatible object storage

TCP

443

Required to work with any of the object storage repositories.

The endpoint is <account>.blob.core.windows.net.

Amazon S3 object storage / IBM Cloud Object Storage

Azure Blob storage

Microsoft 365

TCP

443

Required to connect to Microsoft 365.

The endpoints are: graph.microsoft.com, graph.windows.net and login.microsoftonline.com.

SMTP Server

TCP

25 or 465 or 587

Required to send email notifications using an SMTP server.

The endpoint is smtp.office365.com.

Veeam Backup for Microsoft 365 components

Veeam Backup for Microsoft 365 Server

TCP

9191

Required to manage inbound/outbound traffic when interacting with the following components:

  • REST API
  • PowerShell
  • Veeam.Archiver.Shell (UI)
  • [Optionally] A remote management server (if any)

Make sure to open port on the Veeam Backup for Microsoft 365 server.

Veeam Explorer for Microsoft Exchange

Veeam Backup for Microsoft 365 Server

TCP

9194

Required to manage inbound/outbound traffic when interacting with Veeam Explorer for Microsoft Exchange.

Make sure to open this port on the Veeam Backup for Microsoft 365 server.

Microsoft Exchange Online

TCP

443

Required to restore Microsoft Exchange data.

SMTP Server

TCP

25 or 465 or 587

Required to send email notifications using an SMTP server.

The endpoint is smtp.office365.com.

Veeam Explorer for Microsoft SharePoint (including Veeam Explorer for Microsoft OneDrive for Business)

Veeam Backup for Microsoft 365 Server

TCP

9194

Required to manage inbound/outbound traffic when interacting with Veeam Explorer for Microsoft SharePoint.

Make sure to open this port on the Veeam Backup for Microsoft 365 server.

Microsoft SharePoint Online

TCP

443

Required to restore Microsoft SharePoint data.

SMTP Server

TCP

25 or 465 or 587

Required to send email notifications using an SMTP server.

The endpoint is smtp.office365.com.

Veeam Explorer for Microsoft Teams

Veeam Backup for Microsoft 365 Server

TCP

9194

Required to manage inbound/outbound traffic when interacting with Veeam Explorer for Microsoft Teams.

Make sure to open this port on the Veeam Backup for Microsoft 365 server.

Microsoft Teams Online

TCP

443

Required to restore Microsoft Teams data.

The endpoint is developer.microsoft.com.

SMTP Server

TCP

25 or 465 or 587

Required to send email notifications using an SMTP server.

The endpoint is smtp.office365.com.

Backup Proxy Server

Veeam Backup for Microsoft 365 Server

TCP

9191

Required to manage inbound/outbound traffic when interacting with backup proxy servers.

Make sure to open this port on the Veeam Backup for Microsoft 365 server.

You can also change this port. For more information, see Editing Backup Proxy Server.

Microsoft Exchange Online

TCP

443

Required to connect to Microsoft Exchange Online through EWS (Exchange Web Services).

The endpoints are: outlook.office365.com and autodiscover-s.outlook.com.

On-premises Microsoft SharePoint

HTTP (HTTPS)

5985 (5986)

Required to connect to on-premises Microsoft SharePoint organizations through the WinRM port.

On-premises Microsoft Exchange Server

TCP

80 or 443

Required to connect to on-premises Microsoft Exchange organizations.

S3 Compatible object storage

TCP

443

Required to work with any of the object storage repositories.

The endpoint is <account>.blob.core.windows.net.

Amazon S3 object storage / IBM Cloud Object Storage

Azure Blob storage

Microsoft 365

TCP

443

Required to connect to Microsoft 365.

The endpoints are: graph.microsoft.com, graph.windows.net and login.microsoftonline.com.

SMTP Server

TCP

25 or 465 or 587

Required to send email notifications using an SMTP server.

The endpoint is smtp.office365.com.

Cloud Gateway

Server that hosts Veeam Backup & Replication and Veeam Backup for Microsoft 365

TCP

9194

Required to maintain inbound/outbound traffic.

Web Browser

Veeam Backup for Microsoft 365 REST API

HTTPS

4443 (used by default)

Required to connect to Restore Portal. You can also use different port.

Host Machine with REST API

Veeam Backup for Microsoft 365 Server

TCP

9194

Required for Restore Portal to work.

Microsoft 365

TCP

443

Required for user login to Restore Portal.

The endpoint is login.microsoftonline.com (depends on a Microsoft Azure region).