Used Ports

In this article

    The following table lists required ports that must be opened for inbound/outbound requests in Veeam Backup for Microsoft 365. For more information about Microsoft 365 URLs and IP address ranges, see this Microsoft article.

    Note

    Data communication between Microsoft 365 organizations and Veeam Backup for Microsoft 365 is performed through an SSL connection.

     

    From

    To

    Protocol

    Port

    Description

    Veeam Backup for Microsoft 365 Server

    Microsoft Exchange Online

    TCP

    443

    Required to connect to Microsoft Exchange Online organizations.

    The endpoints are: outlook.office365.com and autodiscover-s.outlook.com.

    Microsoft SharePoint Online

    TCP

    443

    Required to connect to Microsoft SharePoint Online organizations.

    The endpoints are: <tenant>.sharepoint.com, <tenant>-my.sharepoint.com and <tenant>-admin.sharepoint.com.

    On-premises Microsoft SharePoint Server

    HTTP (HTTPS)

    5985 (5986 — used by default)

    Required to connect to on-premises Microsoft SharePoint organizations through the WinRM port.

    On-premises Microsoft Exchange Server

    TCP

    80 or 443

    Required to connect to on-premises Microsoft Exchange organizations.

    Backup Proxy Server

    TCP

    9193 (used by default)

    Required to manage inbound/outbound traffic when interacting with the Veeam Backup for Microsoft 365 server.

    Make sure to open this port on a backup proxy server.

    TCP

    445

    This port is used to:

    • Install and manage the Veeam.Archiver.Proxy service on a target proxy machine.
    • Perform RPC requests.

    Veeam Auto-update Server

    HTTPS

    443

    Required to access the auto-update server and licensing server. For more information, see Updating Veeam Backup for Microsoft 365 and Installing and Updating License.

    The endpoints are: https://vbo.butler.veeam.com and download2.veeam.com.

    S3 Compatible object storage

    TCP

    443

    Required to work with any of the object storage repositories.

    The endpoint is <account>.blob.core.windows.net.

    Amazon S3 object storage / IBM Cloud Object Storage

    Azure Blob storage

    Microsoft 365

    TCP

    443

    Required to connect to Microsoft 365.

    The endpoints are: graph.microsoft.com, graph.windows.net and login.microsoftonline.com.

    SMTP Server

    TCP

    25 or 465 or 587

    Required to send email notifications using an SMTP server.

    The endpoint is smtp.office365.com.

    Veeam Backup for Microsoft 365 components

    Veeam Backup for Microsoft 365 Server

    TCP

    9191

    Required to manage inbound/outbound traffic when interacting with the following components:

    • REST API
    • PowerShell
    • Veeam.Archiver.Shell (UI)
    • [Optionally] A remote management server (if any)

    Make sure to open port on the Veeam Backup for Microsoft 365 server.

    Veeam Explorer for Microsoft Exchange

    Veeam Backup for Microsoft 365 Server

    TCP

    9194

    Required to manage inbound/outbound traffic when interacting with Veeam Explorer for Microsoft Exchange.

    Make sure to open this port on the Veeam Backup for Microsoft 365 server.

    Microsoft Exchange Online

    TCP

    443

    Required to restore Microsoft Exchange data.

    SMTP Server

    TCP

    25 or 465 or 587

    Required to send email notifications using an SMTP server.

    The endpoint is smtp.office365.com.

    Veeam Explorer for Microsoft SharePoint (including Veeam Explorer for Microsoft OneDrive for Business)

    Veeam Backup for Microsoft 365 Server

    TCP

    9194

    Required to manage inbound/outbound traffic when interacting with Veeam Explorer for Microsoft SharePoint.

    Make sure to open this port on the Veeam Backup for Microsoft 365 server.

    Microsoft SharePoint Online

    TCP

    443

    Required to restore Microsoft SharePoint data.

    SMTP Server

    TCP

    25 or 465 or 587

    Required to send email notifications using an SMTP server.

    The endpoint is smtp.office365.com.

    Veeam Explorer for Microsoft Teams

    Veeam Backup for Microsoft 365 Server

    TCP

    9194

    Required to manage inbound/outbound traffic when interacting with Veeam Explorer for Microsoft Teams.

    Make sure to open this port on the Veeam Backup for Microsoft 365 server.

    Microsoft Teams Online

    TCP

    443

    Required to restore Microsoft Teams data.

    The endpoint is developer.microsoft.com.

    SMTP Server

    TCP

    25 or 465 or 587

    Required to send email notifications using an SMTP server.

    The endpoint is smtp.office365.com.

    Backup Proxy Server

    Veeam Backup for Microsoft 365 Server

    TCP

    9191

    Required to manage inbound/outbound traffic when interacting with backup proxy servers.

    Make sure to open this port on the Veeam Backup for Microsoft 365 server.

    You can also change this port. For more information, see Editing Backup Proxy Server.

    Microsoft Exchange Online

    TCP

    443

    Required to connect to Microsoft Exchange Online through EWS (Exchange Web Services).

    The endpoints are: outlook.office365.com and autodiscover-s.outlook.com.

    On-premises Microsoft SharePoint

    HTTP (HTTPS)

    5985 (5986)

    Required to connect to on-premises Microsoft SharePoint organizations through the WinRM port.

    On-premises Microsoft Exchange Server

    TCP

    80 or 443

    Required to connect to on-premises Microsoft Exchange organizations.

    S3 Compatible object storage

    TCP

    443

    Required to work with any of the object storage repositories.

    The endpoint is <account>.blob.core.windows.net.

    Amazon S3 object storage / IBM Cloud Object Storage

    Azure Blob storage

    Microsoft 365

    TCP

    443

    Required to connect to Microsoft 365.

    The endpoints are: graph.microsoft.com, graph.windows.net and login.microsoftonline.com.

    SMTP Server

    TCP

    25 or 465 or 587

    Required to send email notifications using an SMTP server.

    The endpoint is smtp.office365.com.

    Cloud Gateway

    Server that hosts Veeam Backup & Replication and Veeam Backup for Microsoft 365

    TCP

    9194

    Required to maintain inbound/outbound traffic.

    Web Browser

    Veeam Backup for Microsoft 365 REST API

    HTTPS

    4443 (used by default)

    Required to connect to Restore Portal. You can also use different port.

    Host with REST API

    Veeam Backup for Microsoft 365 Server

    TCP

    9194

    Required for Restore Portal to work.