Others

Why Microsoft 365 Email Uses IP Addresses in Ireland & How to Fix Alerts

Rana Garcia Oct 10, 2026 869 views

Question details

Users need to understand why Microsoft 365 traffic appears to originate from foreign countries like Ireland and how to handle resulting security alerts.

Why Microsoft 365 Email Uses IP Addresses in Ireland

Product: Microsoft 365
Device & OS: not provided
Scenario: Reviewing security logs or SIEM alerts and noticing employee sign-ins or email traffic routed through foreign IP addresses.
Observed behavior: Even when users are located in the U.S. (e.g., New York), system logs indicate they are attempting to sign in or connect from IP addresses located in Ireland.

Before you start

Ensure you have administrative privileges to access your organization's SIEM system, firewall console, or Microsoft 365 admin center to review and adjust network security rules.

Solution 1Recommended

Configure SIEM Allowlisting using Microsoft Endpoints

Update your security monitoring tools to recognize and allowlist Microsoft's official global datacenter IP ranges to prevent false positive alerts.

Microsoft 365 operates on a globally distributed network designed for high availability. Consequently, email and authentication traffic may frequently be routed through global datacenters, such as those in Ireland, even if your primary tenant is located in the Central US.

To prevent your security tools from flagging these legitimate routing events as suspicious foreign sign-ins, you must synchronize your systems with Microsoft's published IP endpoints.

Access Microsoft 365 Endpoints Documentation

Open a web browser and navigate to the official Microsoft 365 URLs and IP address ranges documentation page.

Fetch Current IP Ranges

Utilize the Microsoft 365 endpoint web service to identify the most current IP addresses associated with global authentication and email routing.

Export the Authorized IPs

Download the JSON or CSV file containing the valid Microsoft IP subnets, specifically noting the ranges designated for global routing and Azure Active Directory.

Update Your SIEM Allowlist

Log in to your SIEM or firewall administration console, navigate to your network access or alert rules, and add the fetched Microsoft IP ranges to your trusted allowlist.

Configure SIEM Allowlisting using Microsoft Endpoints

Automate Endpoint Updates: Because Microsoft frequently updates its IP addresses and endpoints, it is highly recommended to use a script or API integration to automatically fetch and apply these changes to your SIEM configuration.

Free Microsoft Office alternative

Looking for a Secure, Locally-Managed Alternative to Microsoft 365?

Managing complex global network routing, SIEM integrations, and cloud architectures can be challenging and resource-intensive. If your organization prefers a lightweight, robust, and highly secure office suite without relying heavily on global cloud transit, WPS Office provides an outstanding free alternative. Enjoy complete control over your files with seamless local performance and extensive compatibility.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Software: Run the setup file and follow the standard on-screen prompts to complete the offline installation.
3. Start Creating Securely: Launch WPS Office and immediately begin working on your documents, spreadsheets, and presentations without worrying about unexpected foreign IP routing.

Fully compatible with Microsoft Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) formatsNo complex global IP routing or cloud-based SIEM allowlisting required for core document editingLightweight standalone installation that keeps your sensitive data securely on local devicesFree to use with a familiar, easy-to-learn tabbed user interface

microsoft office alternative - wps office

Frequently Asked Questions

Is it a security breach if my Microsoft 365 logs show sign-ins from Ireland?

Not necessarily. Microsoft 365 frequently routes authentication and transit traffic through its global datacenters, including Ireland, for redundancy and load balancing. You should verify the IP address against Microsoft's official endpoint list before treating it as a breach.

How often do Microsoft 365 IP addresses change?

Microsoft typically updates its IP addresses and URLs at the end of each month. Administrators should subscribe to endpoint update notifications or use the Microsoft 365 endpoint web service to automate updates to their security tools.

Can I force Microsoft 365 to only use U.S. datacenters for my traffic?

While your core data at rest is stored in your designated geographic region according to Data Residency commitments, transit traffic, telemetry, and some global services (like Azure AD) may still route globally. You cannot completely restrict transit traffic to a single country.

Office Quick Solutions