Which firewall ports fix Teams media connectivity warnings?
You have a Microsoft 365 E5 subscription. You plan to use Teams. You run the Microsoft 365 network connectivity test tool and generate a report. You discover that the Microsoft Teams section of the report has a warning notification for media connectivity. You suspect a firewall issue at the test location. Which destination protocol and port range should you configure on the firewall?
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests whether you know the transport protocol behind Teams media relay ports, and the trap is that the identical TCP port range 3478–3481 appears as a plausible distractor.
When the Microsoft 365 network connectivity test tool reports a media connectivity warning for Teams, the firewall must allow outbound UDP ports 3478 through 3481. This page explains why the UDP range — not its TCP twin — is the destination port set to configure for Teams media relay traffic.
Choosing TCP ports 3478 through 3481 (option B) because the same numbers look familiar — Teams media flows over UDP, and requiring TCP only forces clients into degraded TCP/443 fallback.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Teams audio, video and screen-sharing media traverse the real-time media relay endpoints on outbound UDP ports 3478 through 3481. Microsoft's network guidance lists this as the destination port set that must be open from client networks to the Microsoft 365 service, alongside TCP 443 for signalling and fallback. The Microsoft 365 network connectivity test tool flags "media connectivity" in the Teams section precisely when these UDP paths are blocked or degraded, which matches the scenario's suspected firewall problem. Because the test is a client-generated call simulation, the rule is outbound only — you do not open inbound ports on the local firewall. As the community note from Phirom puts it, "UDP for outbound:3478, 3479, 3480, 3481, TCP:443, 80. We are not open ports coming in." Option D is therefore the exact destination protocol and port range to configure.Why the Other Options Are Wrong
Option B keeps the correct numbers but the wrong transport: TCP 3478–3481 is not the media path Teams relies on, so opening it does nothing for the reported warning. Option C (UDP 50000–50019) and option A (UDP 50020–50059) are legacy Skype for Business Online media port ranges that do not correspond to the relay range the connectivity test checks for Teams. Only one option combines the right protocol with the right range, and only that combination clears the media connectivity notification.Community Comment Notes
Voters and commenters converge strongly on the UDP answer — maartuh9999 answered simply that "UDP is used, instead of TCP," which is the crux of distinguishing D from B. Eveready initially picked TCP but corrected themselves in the same comment thread to "100% UDP ports 3478 through 3481," a good illustration of how the mirrored TCP range lures candidates. Phirom and Aboed both reiterate the UDP 3478–3481 outbound range, and Phirom adds the useful operational point that only outbound access from the local network is required. The 80-to-20 vote split reflects exactly the protocol-vs-port-number confusion this question is designed to expose.Official Reference
Exam Strategy
Whenever MS-700 shows you a duplicated port range with UDP in one option and TCP in another, decide the transport first: real-time Teams media is UDP, while TCP 443 is only the fallback. Then confirm the rule direction — client firewalls need outbound rules, not inbound.
Frequently Asked Questions
Why is TCP ports 3478 through 3481 wrong if the port numbers match?
Teams real-time media uses UDP 3478–3481; TCP 3478–3481 carries no media, so the warning persists. Clients would fall back to TCP 443 with degraded quality.
Do I need inbound rules as well for Teams media?
No. The connectivity test simulates client-to-cloud calls, so only outbound UDP 3478–3481 is required from the test location's network.
Related Analysis
Practice All MS-700 Questions
Access 88 questions with complete answers and detailed explanations.
View Full MS-700 Practice Test →