Which firewall ports fix Teams media connectivity warnings?

MS-700 By islever Editorial Last updated

Plan network settings for Teams

Short answer

D Open outbound UDP ports 3478 through 3481 so Teams media can reach the relay service and clear the connectivity warning.

Question

You have a Microsoft 365 E5 subscription. You plan to use Teams. You run the Microsoft 365 network connectivity test tool and generate a report. You discover that the Microsoft Teams section of the report has a warning notification for media connectivity. You suspect a firewall issue at the test location. Which destination protocol and port range should you configure on the firewall?
  1. UDP ports 50020 through 50059
  2. TCP ports 3478 through 3481
  3. UDP ports 50000 through 50019
  4. UDP ports 3478 through 3481 Correct Answer

Key Takeaways

The question tests whether you know the transport protocol behind Teams media relay ports, and the trap is that the identical TCP port range 3478–3481 appears as a plausible distractor.

When the Microsoft 365 network connectivity test tool reports a media connectivity warning for Teams, the firewall must allow outbound UDP ports 3478 through 3481. This page explains why the UDP range — not its TCP twin — is the destination port set to configure for Teams media relay traffic.

Common mistake: Choosing TCP ports 3478 through 3481 (option B) because the same numbers look familiar — Teams media flows over UDP, and requiring TCP only forces clients into degraded TCP/443 fallback.

Expert Analysis

Why the Answer Is Correct

Teams audio, video and screen-sharing media traverse the real-time media relay endpoints on outbound UDP ports 3478 through 3481. Microsoft's network guidance lists this as the destination port set that must be open from client networks to the Microsoft 365 service, alongside TCP 443 for signalling and fallback. The Microsoft 365 network connectivity test tool flags "media connectivity" in the Teams section precisely when these UDP paths are blocked or degraded, which matches the scenario's suspected firewall problem. Because the test is a client-generated call simulation, the rule is outbound only — you do not open inbound ports on the local firewall. As the community note from Phirom puts it, "UDP for outbound:3478, 3479, 3480, 3481, TCP:443, 80. We are not open ports coming in." Option D is therefore the exact destination protocol and port range to configure.

Why the Other Options Are Wrong

Option B keeps the correct numbers but the wrong transport: TCP 3478–3481 is not the media path Teams relies on, so opening it does nothing for the reported warning. Option C (UDP 50000–50019) and option A (UDP 50020–50059) are legacy Skype for Business Online media port ranges that do not correspond to the relay range the connectivity test checks for Teams. Only one option combines the right protocol with the right range, and only that combination clears the media connectivity notification.

Community Comment Notes

Voters and commenters converge strongly on the UDP answer — maartuh9999 answered simply that "UDP is used, instead of TCP," which is the crux of distinguishing D from B. Eveready initially picked TCP but corrected themselves in the same comment thread to "100% UDP ports 3478 through 3481," a good illustration of how the mirrored TCP range lures candidates. Phirom and Aboed both reiterate the UDP 3478–3481 outbound range, and Phirom adds the useful operational point that only outbound access from the local network is required. The 80-to-20 vote split reflects exactly the protocol-vs-port-number confusion this question is designed to expose.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Whenever MS-700 shows you a duplicated port range with UDP in one option and TCP in another, decide the transport first: real-time Teams media is UDP, while TCP 443 is only the fallback. Then confirm the rule direction — client firewalls need outbound rules, not inbound.

Frequently Asked Questions

Why is TCP ports 3478 through 3481 wrong if the port numbers match?

Teams real-time media uses UDP 3478–3481; TCP 3478–3481 carries no media, so the warning persists. Clients would fall back to TCP 443 with degraded quality.

Do I need inbound rules as well for Teams media?

No. The connectivity test simulates client-to-cloud calls, so only outbound UDP 3478–3481 is required from the test location's network.

More MS-700 FAQ →

Community Votes

D
80%
B
20%

80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Phirom 👍 2
    UDP ports 3478 through 3481, UDP for outbound:3478, 3479, 3480, 3481, TCP:443, 80. We are not open ports coming in, just out to access clouds from the local.
  2. Eveready 👍 1 Answered B
    100% UDP ports 3478 through 3481
  3. maartuh9999 👍 4 Answered D
    UDP is used, instead of TCP
  4. Aboed 👍 1
    UDP ports 3478 through 3481

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Diagnose Teams Guest Invitation Failure?

S-grade

Which Teams Role Enables Reading Activity Reports with Least Privilege?

S-grade

Retain Teams Chats and Channel Files for One Year: What First?

S-grade

Teams Device Remote Restart Permissions

S-grade

Practice All MS-700 Questions

Access 88 questions with complete answers and detailed explanations.

View Full MS-700 Practice Test →

← Back to MS-700 Study Guide