Note : Cet article a été publié à l’origine en 2013 and has been updated to reflect current Microsoft 365 and Microsoft Entra ID (formerly Azure AD) terminology and architecture. The endpoint remains in use for backward compatibility.

If you have examined your organization’s firewall logs, proxy server logs, or DNS query records, you may have noticed traffic directed to adminwebservice.microsoftonline.com. This endpoint is a core part of Microsoft’s cloud administration infrastructure, used by Office 365 (now Microsoft 365) and Azure Active Directory (now Microsoft Entra ID) for tenant management and directory synchronization operations. This guide explains what it is, why it appears in your network traffic, and how to handle it in your security and firewall configurations.

What Is adminwebservice.microsoftonline.com?

The URL adminwebservice.microsoftonline.com is a SOAP/REST web service endpoint operated by Microsoft that provides administrative functions for Microsoft 365 tenants. It serves as the backend API for several Microsoft administration tools and services.

Core Functions

FunctionDescription
Tenant AdministrationCreate, modify, and delete user accounts, groups, and organizational settings in a Microsoft 365 tenant
Directory SynchronizationSync on-premises Active Directory objects to Microsoft Entra ID (Azure AD)
License ManagementAssign and remove Microsoft 365 licenses programmatically
Password OperationsPassword synchronization, reset, and policy enforcement
Domain ManagementVerify and configure custom domains for the tenant
Service ConfigurationConfigure Exchange Online, SharePoint Online, and other service-specific settings

How It Fits in the Microsoft 365 Architecture

On-Premises Environment              Microsoft Cloud
+-------------------------+          +----------------------------------+
|                         |          |                                  |
| Active Directory        |          |  Microsoft Entra ID              |
| Domain Controller       |  HTTPS   |  (Azure Active Directory)        |
|          |              +--------->|          |                       |
|          v              |   443    |          v                       |
| Azure AD Connect        |          |  adminwebservice                 |
| (DirSync / AAD Sync)    +--------->|  .microsoftonline.com            |
|                         |          |          |                       |
+-------------------------+          |          v                       |
                                     |  Microsoft 365 Services          |
+-------------------------+          |  - Exchange Online               |
| Admin Workstation       |  HTTPS   |  - SharePoint Online             |
|                         +--------->|  - Teams                         |
| - Microsoft 365 Admin   |   443    |  - Intune                        |
|   Center (browser)      |          |                                  |
| - MSOnline PowerShell   |          +----------------------------------+
| - Azure AD PowerShell   |
+-------------------------+

Which Tools and Services Use This Endpoint

1. Azure AD Connect (Formerly DirSync and AAD Sync)

Azure AD Connect is the most common source of traffic to this endpoint. It synchronizes your on-premises Active Directory users, groups, and contacts to Microsoft Entra ID.

During a sync cycle, Azure AD Connect:

  1. Reads changes from your on-premises AD
  2. Applies filtering and transformation rules
  3. Connects to adminwebservice.microsoftonline.com via HTTPS
  4. Pushes created, updated, or deleted objects to the cloud directory
  5. Pulls back any cloud-originated changes (writeback scenarios)

The sync cycle runs every 30 minutes by default. You can trigger a manual sync with PowerShell:

# Trigger a delta (incremental) sync
Start-ADSyncSyncCycle -PolicyType Delta

# Trigger a full sync (use sparingly)
Start-ADSyncSyncCycle -PolicyType Initial

2. MSOnline PowerShell Module

The legacy MSOnline PowerShell module (also called the Azure AD v1 module) communicates directly with this endpoint:

# Connect to Microsoft Online
Connect-MsolService

# Example operations that use adminwebservice.microsoftonline.com
Get-MsolUser -All
Set-MsolUser -UserPrincipalName user@contoso.com -DisplayName "New Name"
Get-MsolAccountSku
Set-MsolUserLicense -UserPrincipalName user@contoso.com -AddLicenses "contoso:ENTERPRISEPACK"

When you run Connect-MsolService, the module authenticates against login.microsoftonline.com and then uses adminwebservice.microsoftonline.com for all subsequent administrative API calls.

3. Microsoft 365 Admin Center

When administrators access the Microsoft 365 Admin Center through a web browser at admin.microsoft.com, the browser makes background API calls to adminwebservice.microsoftonline.com to retrieve and modify tenant data. You will see these requests in your browser’s Network tab (DevTools) or in your proxy logs.

4. Azure AD PowerShell Module (v2)

The newer AzureAD PowerShell module also communicates with this endpoint for certain legacy operations:

# Connect to Azure AD
Connect-AzureAD

# Operations that may use the admin web service
Get-AzureADUser -All $true
New-AzureADUser -DisplayName "Test User" -PasswordProfile $passwordProfile `
    -UserPrincipalName "testuser@contoso.com" -AccountEnabled $true `
    -MailNickName "testuser"

5. Microsoft Graph PowerShell SDK (Modern Replacement)

Microsoft is migrating administrative operations to the Microsoft Graph API (graph.microsoft.com). The Graph PowerShell SDK uses different endpoints:

# Modern approach using Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Operations use graph.microsoft.com instead
Get-MgUser -All
New-MgUser -DisplayName "Test User" -MailNickname "testuser" `
    -UserPrincipalName "testuser@contoso.com" `
    -PasswordProfile @{ Password = "TempPass123!" } `
    -AccountEnabled

Network and Firewall Configuration

Required Firewall Rules

For Microsoft 365 administration tools to function, your firewall must allow outbound traffic to the following endpoints:

EndpointPortProtocolPurpose
adminwebservice.microsoftonline.com443HTTPSTenant admin API
login.microsoftonline.com443HTTPSAuthentication
login.microsoft.com443HTTPSAuthentication (newer)
graph.microsoft.com443HTTPSMicrosoft Graph API
graph.windows.net443HTTPSAzure AD Graph (legacy)
provisioningapi.microsoftonline.com443HTTPSProvisioning
management.azure.com443HTTPSAzure management

Proxy Server Configuration

If your organization uses a web proxy, ensure:

  1. The proxy allows HTTPS traffic to *.microsoftonline.com
  2. SSL inspection (if enabled) does not break certificate pinning used by Azure AD Connect
  3. Authentication to the proxy does not interfere with the service account used by Azure AD Connect

Microsoft recommends bypassing proxy authentication for Azure AD Connect traffic. In many proxy solutions, you can configure this with a PAC file:

function FindProxyForURL(url, host) {
    // Bypass proxy for Microsoft 365 admin endpoints
    if (shExpMatch(host, "*.microsoftonline.com") ||
        shExpMatch(host, "*.microsoft.com") ||
        shExpMatch(host, "graph.microsoft.com")) {
        return "DIRECT";
    }
    return "PROXY proxy.contoso.com:8080";
}

Sécurité Considerations

Monitoring Traffic to This Endpoint

While adminwebservice.microsoftonline.com is a legitimate Microsoft endpoint, you should monitor traffic to it because:

  • Compromised admin credentials could be used to make unauthorized changes through this endpoint
  • Unusual volume of requests may indicate a misconfigured sync tool or an automated attack
  • Requests from unexpected sources (non-admin workstations or unknown servers) may indicate credential theft

Conditional Access Policies

Protect administrative operations by configuring Conditional Access policies in Microsoft Entra ID:

  1. Require multi-factor authentication (MFA) for all administrative roles
  2. Restrict admin access to compliant devices only
  3. Block admin access from untrusted locations
  4. Use Privileged Identity Management (PIM) for just-in-time admin access

Audit Logging

Microsoft 365 logs all administrative operations. Review these logs regularly:

# Search unified audit log for admin operations
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
    -RecordType AzureActiveDirectory -Operations "Add user", "Delete user", "Update user"

# Or use Microsoft Graph
$uri = "https://graph.microsoft.com/v1.0/auditLogs/directoryAudits"
Invoke-MgGraphRequest -Uri $uri -Method GET

Migration Path: MSOnline to Microsoft Graph

Microsoft has announced the deprecation of the MSOnline and AzureAD PowerShell modules. Organizations should migrate to the Microsoft Graph PowerShell SDK:

Legacy (MSOnline)Modern (Microsoft Graph)
Connect-MsolServiceConnect-MgGraph
Get-MsolUserGet-MgUser
Set-MsolUserUpdate-MgUser
Get-MsolAccountSkuGet-MgSubscribedSku
Set-MsolUserLicenseSet-MgUserLicense
Get-MsolDomainGet-MgDomain
Reset-MsolUserPasswordReset-MgUserAuthenticationMethodPassword

After migrating scripts to Microsoft Graph, the dependency on adminwebservice.microsoftonline.com is reduced (though not eliminated, as Azure AD Connect still uses it).

Dépannage Connection Issues

If Azure AD Connect or MSOnline PowerShell cannot reach this endpoint:

  1. Test connectivity:

    Test-NetConnection -ComputerName adminwebservice.microsoftonline.com -Port 443

  2. Check DNS resolution:

    Resolve-DnsName adminwebservice.microsoftonline.com

  3. Verify TLS version: Microsoft requires TLS 1.2. Ensure it is enabled:

    # Check TLS 1.2 support
[Net.ServicePointManager]::SecurityProtocol

# Enable TLS 1.2
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

  4. Check proxy settings: Azure AD Connect uses the machine’s default proxy. Verify with:

    netsh winhttp show proxy

Résumé

The endpoint adminwebservice.microsoftonline.com is a legitimate Microsoft web service used for Microsoft 365 tenant administration and Azure AD (Microsoft Entra ID) directory synchronization. It appears in network logs when tools like Azure AD Connect, the MSOnline PowerShell module, or the Microsoft 365 Admin Center communicate with the cloud. For proper operation, allow outbound HTTPS traffic to this endpoint and related Microsoft authentication URLs. Monitor traffic for anomalies as part of your security posture, and plan to migrate administrative scripts from the legacy MSOnline module to the Microsoft Graph PowerShell SDK.

Articles Connexes