Use Apple products on enterprise networks

Find out which hosts and ports are required to use your Apple products on enterprise networks.

This article is intended for enterprise and education network administrators.

Apple products require access to the internet hosts listed in this article for a variety of services. Here's how your devices connect to hosts and work with proxies:

Make sure your Apple devices can access the hosts listed below.

Find out how to troubleshoot connecting to the Apple Push Notification service (APNs). For devices that send all traffic through an HTTP proxy, you can configure the proxy either manually on the device or with Mobile Device Management (MDM). Devices can connect to APNs when configured to use the HTTP proxy with a proxy auto-config (PAC) file.

Apple devices need access to the following hosts during the setup process, or when installing, updating or restoring the operating system.

Apple devices enrolled in MDM need access to the following hosts and domains.

Administrators and managers need access to the following hosts and domains in order to administer and manage Apple Business Manager and Apple School Manager.

Employees and students using Managed Apple IDs need access to the following host in order to look up others in their business or school when composing messages or sharing documents.

Administrators and devices managed by Apple Business Essentials need access to the following hosts and domains, along with those listed above for Apple Business Manager.

Student and Teacher devices using the Classroom or Classwork apps need access to the following hosts, as well as those listed in the Apple ID and iCloud sections below.

Make sure that you can access the following ports for updating macOS, updating apps from the Mac App Store and for using content caching.

Apple devices need access to the following hosts when installing, restoring and updating iOS, iPadOS, macOS, watchOS and tvOS.

Apple devices need access to the following hosts and domains for installing and updating apps.

Mobile devices need access to the following hosts to install provider bundle updates.

A Mac that provides content caching needs access to the following hosts, as well as the hosts listed in this document that provide Apple content, such as software updates, apps and additional content.

Clients of macOS content caching need access to the following hosts.

Apple devices may need access to the following hosts to use certain app features.

App notarisation is required for apps to run on macOS 10.14 and later. Gatekeeper requires access to Apple servers to verify notarisation, unless the app developer has stapled the notarisation ticket to the app. App developers can find out more about customising the notarisation workflow.

App validation is used to certify that a valid instance of the app is running. App developers can find out more about establishing an app‘s integrity.

Apple devices need access to the following hosts to sign in to Beta Updates and report feedback using the Feedback Assistant app.

Apple devices may access the following host in order to perform diagnostics used to detect a possible hardware issue.

Encrypted Domain Name System (DNS) resolution in iOS 14, iPadOS 14, tvOS 14, and macOS Big Sur and later uses the following host.

Apple devices must be able to connect to the following hosts to validate digital certificates used by the hosts listed in this article.

Apple devices must be able to connect to the following hosts in order to authenticate an Apple ID. This is required for all services that use an Apple ID, such as iCloud, app installation and Xcode.

In addition to the Apple ID hosts listed above, Apple devices must be able to connect to hosts in the following domains to use iCloud services.

Apple devices must be able to connect to the following hosts to process Siri requests, including dictation and searching in Apple apps.

Apple devices must be able to connect to the following hosts to use Associated Domains in iOS 14, iPadOS 14, and macOS Big Sur and later. Associated Domains underpin universal links, a feature that allows an app to present content in place of all or part of its website. Handoff, App Clips and single sign-on extensions all use Associated Domains.

To use a payment app to accept contactless payments, an iPhone must be able to reach the following hosts.

Apple devices must be able to connect to the following hosts to download additional content. Some additional content may also be hosted on third-party content distribution networks.

If your firewall supports using hostnames, you may be able to use most Apple services listed above by allowing outbound connections to *.apple.com. If your firewall can only be configured with IP addresses, allow outbound connections to 17.0.0.0/8. The entire 17.0.0.0/8 address block is assigned to Apple.

You can use Apple services through a proxy if you disable packet inspection and authentication for traffic to and from the listed hosts. Exceptions to this are noted above. Attempts to perform content inspection on encrypted communications between Apple devices and services will result in a dropped connection to preserve platform security and user privacy.

Some of the hosts listed in this article may have CNAME records in DNS instead of A or AAAA records. These CNAME records may refer to other CNAME records in a chain before ultimately resolving to an IP address. This DNS resolution allows Apple to provide fast and reliable content delivery to users in all regions and is transparent to devices and proxy servers. Apple doesn't publish a list of these CNAME records because they are subject to change. You shouldn't need to configure your firewall or proxy server to allow them as long as you don't block DNS lookups and allow access to the hosts and domains named above.

July 2023: