Ports and Protocols requirement for the Hybrid Cloud Search Service Application

  • Article

In response to a number of requests for this information we are posting the Ports and Protocols requirements for the Cloud Search Service Application.

Generally we assume outbound internet access is granted to all network resources but of course this is not always true and rarely true for server based applications in corporate datacenters.

The hybrid cloud search service application has five main connection points required for outbound internet access, all operate on HTTPS on Port 443.

The first url is to the provisioning api which is called only when establishing the configuration and deployment of the Cloud SSA for the first time. This endpoint is accessible via public internet as well as Express Route with Microsoft peering.

The second is the tenant url for connecting to the Office 365 tenancy.This endpoint is accessible via public internet as well as Express Route with Microsoft peering.

The third is the Azure ACS (Azure Access Control Services) endpoint to proxy the S2S trust between the on premises farm and Office 365. This endpoint is accessible only via public internet .

Fourth,  and the less well known requirement.  You need to establish connectivity to the regional Search Content Service (SCS) for pushing the parsed content batches to the Office 365 Search Service. These endpoints are accessible via public internet as well as Express Route with Azure public peering.

  • *.search.production.us.trafficmanager.net
  • *.search.production.emea.trafficmanager.net
  • *.search.production.apac.trafficmanager.net

You only need to provide access to the SCS endpoints in your region as high availability is provided within the same region just as we do with your content.

The final connection point is only needed when providing outbound hybrid search query federation from the on premises farm to Office 365. In this case you need to allow the servers in the farm that host Query Processing components the ability to connect to the url of your root site in SharePoint Online. Typically this is https://tenantname.sharepoint.com. These endpoints are accessible via public internet as well as Express Route with Azure public peering

Note: For more information regarding the different types of peering mentioned above take a look at this article.

Comments

  • Anonymous
    September 07, 2016
    Article provides information about wat external connectivity is needed. I would advise to incorperate information about the situation where express route is in place.
    • Anonymous
      September 15, 2016
      Hi Ewald, thanks for the request. We have updated the article to include the Azure/Microsoft peering options with Express Route for Cloud SSA.
  • Anonymous
    April 05, 2017
    Does this cover requirements for the other SP hybrid features? Ex: Hybrid Sites
    • Anonymous
      April 24, 2017
      Hi LC, yes although for Sites you do not need the Search Specific configurations, you only need https to the tenant and ACS