Important Update: Upcoming Changes to Microsoft Intune Network
Scheduled Maintenance
Report for Prisma SASE
Completed
The scheduled maintenance has been completed.
In progress
Scheduled maintenance is currently in progress. We will provide updates as necessary.
Scheduled
Dear Prisma Access Customers,
Palo Alto Networks would like to inform you about the upcoming Microsoft Intune change. On December 2, 2025, Microsoft Intune cloud service network endpoints will change to the IP address range (ref: https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip-upcoming-microsoft-intune-network-changes/4452738). Intune endpoints will use the Azure Front Door (https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview) service for communicating with the Intune service; that is, Front Door will serve as the frontend to the Intune service.
What this means for you:
If your network is currently set up only to allow traffic to the older Intune IP addresses, your devices will no longer be able to connect to Intune. To prevent this, update your firewall rules with the new addresses before December 2, 2025.
Which Palo Alto Networks Products are affected?
The changes to the IP address range of the Microsoft Intune cloud service will impact Palo Alto Networks products and services that use allow/deny network access control policies using Intune IP addresses:
Hardware and software NGFWs (PA-Series hardware, VM-Series, and CN-Series)
Prisma Access
What you need to do:
Customers should follow Microsoft’s recommendation (https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip-upcoming-microsoft-intune-network-changes/4452738) by December 2nd, 2025. Details regarding steps to be followed are listed in Live Community Article (https://live.paloaltonetworks.com/t5/customer-advisories/microsoft-intune-changes-what-palo-alto-networks-users-need-to/ta-p/1239015#:~:text=What%20steps%20can%20I%20take%20to%20prevent%20a%20service%20disruption%20with%20Microsoft%20Intune%3F).
If you have any further questions or require assistance, please don't hesitate to contact your Palo Alto Networks representatives.
Thanks
Prisma Access SRE Team
Palo Alto Networks would like to inform you about the upcoming Microsoft Intune change. On December 2, 2025, Microsoft Intune cloud service network endpoints will change to the IP address range (ref: https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip-upcoming-microsoft-intune-network-changes/4452738). Intune endpoints will use the Azure Front Door (https://learn.microsoft.com/en-us/azure/frontdoor/front-door-overview) service for communicating with the Intune service; that is, Front Door will serve as the frontend to the Intune service.
What this means for you:
If your network is currently set up only to allow traffic to the older Intune IP addresses, your devices will no longer be able to connect to Intune. To prevent this, update your firewall rules with the new addresses before December 2, 2025.
Which Palo Alto Networks Products are affected?
The changes to the IP address range of the Microsoft Intune cloud service will impact Palo Alto Networks products and services that use allow/deny network access control policies using Intune IP addresses:
Hardware and software NGFWs (PA-Series hardware, VM-Series, and CN-Series)
Prisma Access
What you need to do:
Customers should follow Microsoft’s recommendation (https://techcommunity.microsoft.com/blog/intunecustomersuccess/support-tip-upcoming-microsoft-intune-network-changes/4452738) by December 2nd, 2025. Details regarding steps to be followed are listed in Live Community Article (https://live.paloaltonetworks.com/t5/customer-advisories/microsoft-intune-changes-what-palo-alto-networks-users-need-to/ta-p/1239015#:~:text=What%20steps%20can%20I%20take%20to%20prevent%20a%20service%20disruption%20with%20Microsoft%20Intune%3F).
If you have any further questions or require assistance, please don't hesitate to contact your Palo Alto Networks representatives.
Thanks
Prisma Access SRE Team