Whitelist xbox Live from decryption policy

Hello D2023456,

Thank you for your patience as we investigated this issue for you. Unfortunately we do not publish IP ranges for Xbox services. You may be able to approximate some of the IP ranges using the publicly available list of IP ranges used by Azure: https://www.microsoft.com/en-us/download/details.aspx?id=56519. However, there is no guarantee that all of the Xbox services in question will fall within these ranges. Also, allow-listing IP ranges for Xbox will only be part of the scenario that it sounds like you’re trying to address. Games and apps running on Xbox will also typically connect to web services, which may be hosted by game studios, third party cloud providers, etc. A more feasible approach to your scenario might be to programmatically identify the Xbox consoles on your network in order to exclude them from SSL inspection.

Thank you for understanding.

Regards,

Hi

That's correct, exactly what i am trying to setup.

All the URL's mentioned in the second article have been added (and more) and it's still not working.

I need a complete list of URLs that the client uses, something similar to this:

Network ports used by the Xbox network on the Xbox console | Xbox Support

Or another example would be similar to this which has been provided for Office:

Office 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn

But for a PC using Xbox game pass.

Thanks

Hey, there!

Thank you for contacting us and welcome to the Microsoft Community.

My name is Darhyl. I'm an Independent Advisor and I will do my best to help you sort this out.

I'm sorry you are experiencing any trouble right now. No worries, I'm here to help you.

There seems to be no complete list of URLs however you might want to check what the user named Bmorris1 said in forums regarding Xbox Live & Decryption:

"Recently I have faced an issue where Xbox Live fails to connect or more specifically, fails to 'authorize' when decryption is enabled.

Looking into this further it seems that Xbox Live connects to similar services that Windows uses for Microsoft updates. It is known that in order to get microsoft updates to work when enabling decrypted, you have to exempt certain URLs as the server just rejects the connection.

Apple is also similar, described in this article: https://live.paloaltonetworks.com/t5/Management......

The same applies with Xbox Live.

The no decrypt rule will look like this:"

(The screenshot can be seen here on this link)

https://live.paloaltonetworks.com/t5/general-to...

Hi

This will be for enterprise appliance.

I can try to add that as well, didn't realize that would be needed.

If they could provide a list of the exact requirements it would be helpful.

Thanks

Hello D2023456,

Thanks for your reply.

I did not have any response from the team yet. I will post in here once I have one.

Thank you for your time and patience.

Regards,