Dockli reaches a small, fixed set of hosts. Every connection is outbound HTTPS on port 443 — there are no inbound connections and no other ports. This page lists every host so your firewall or web proxy team can allowlist exactly what’s needed. For performance and proxy guidance, see Performance and network.
Outbound HTTPS/443 only
Dockli makes only outbound TLS connections on port 443. It never opens inbound ports. localhost:5050 is used strictly on-device between Dockli’s components and never leaves the machine.
Minimum for Essential
These hosts are required for the core Dockli experience — sign-in, browsing Microsoft 365, editing metadata, updates and diagnostics. Essential needs only these.
| Host | Purpose | Plan |
|---|---|---|
login.microsoftonline.com | Microsoft Entra ID sign-in and token acquisition | All |
graph.microsoft.com | Microsoft Graph — files, sites, metadata, version history | All |
*.sharepoint.com (your tenant hosts) | SharePoint / OneDrive content for your tenant | All |
portal.tinytugboat.com | Diagnostics | All |
| Dockli licensing host (Azure App Service) | Per-seat entitlement and licensing checks | All |
stgdocklireleases.blob.core.windows.net | Application updates | All |
Additional for Spark
These hosts are only used by Spark, for Ask Dockli’s AI and voice dictation. If you run Essential only, you don’t need to allowlist them.
| Host | Purpose | Plan |
|---|---|---|
dockli-api-gateway.azure-api.net | Azure OpenAI via API Management (APIM) — Ask Dockli chat, search, diff | Spark only |
eastus.api.cognitive.microsoft.com | Azure Speech — voice dictation | Spark only |
*.stt.speech.microsoft.com | Azure Speech speech-to-text — voice dictation | Spark only |
Complete host reference
| Host | Purpose | Spark-only? |
|---|---|---|
login.microsoftonline.com | Entra ID sign-in / tokens | No |
graph.microsoft.com | Microsoft Graph (files, sites, metadata) | No |
*.sharepoint.com | Your tenant’s SharePoint / OneDrive content | No |
portal.tinytugboat.com | Diagnostics | No |
| Dockli licensing host (Azure App Service) | Per-seat entitlement / licensing | No |
stgdocklireleases.blob.core.windows.net | Application updates | No |
dockli-api-gateway.azure-api.net | Azure OpenAI via APIM (Ask Dockli) | Yes |
eastus.api.cognitive.microsoft.com | Azure Speech (dictation) | Yes |
*.stt.speech.microsoft.com | Azure Speech speech-to-text (dictation) | Yes |
Your SharePoint hosts
*.sharepoint.com covers your tenant’s SharePoint and OneDrive hosts (for example contoso.sharepoint.com and contoso-my.sharepoint.com). Scope the wildcard to your own tenant hosts if your proxy supports it.
Don't block updates or licensing
Blocking stgdocklireleases.blob.core.windows.net stops Dockli receiving updates, and blocking the licensing host prevents entitlement checks. Keep both on the allowlist even for an Essential-only deployment.
Where to go next
- Proxy, latency and performance guidance → Performance and network
- Security model and data flows → Security architecture
- Rolling out to your tenant → Deployment overview