Firewall rules and encryption (KMM)
Managed Android devices
Outbound rules from the network the devices are on. Devices run Google's Android Device Policy for enrollment and policy, and the KMM client application for files, APK installs, screenshots and task reporting.
|
Address |
Protocol |
Port |
Purpose |
|
mdm.kuori.com |
TCP |
443 |
HTTPS REST calls from the KMM client (files, APK downloads, screenshots, token refresh, location reports) |
|
mdm.kuori.com (path /ws) |
TCP |
443 |
WebSocket (WSS) from the KMM client for task delivery, heartbeat, connection quality and location requests |
|
Google Android Enterprise endpoints |
TCP |
443, 5228–5230 |
Android Device Policy, Google Play, Firebase Cloud Messaging, device provisioning, OTA updates. See the Google document linked below. |
|
DNS servers |
UDP/TCP |
53 |
Name resolution |
|
NTP servers (time.google.com) |
UDP |
123 |
Time synchronization |
Staging and development environments use mdm-stage.kuori.com and mdm-dev.kuori.com with the same ports.
Google's own network requirements for Android Enterprise devices:
Network whitelisting limitation (Android devices)
IP address–based whitelisting is not a viable approach for this solution.
The devices in scope run Android and rely on Google Play, Android Device Policy, Firebase Cloud Messaging and other Google-managed infrastructure. These services do not use fixed IP addresses; they operate on large, dynamic, globally distributed cloud networks, so the addresses change frequently and cannot be reliably predicted or restricted to a fixed range.
-
IP-based whitelisting would be unreliable and may cause service disruptions.
-
Essential functionality (policy delivery, app installs and updates, authentication) could fail if traffic is blocked due to changing IPs.
-
Maintaining an up-to-date allowlist of IP ranges is not practical or sustainable.
The Kuori hostnames above are stable and can be allowed by name. Google traffic requires general outbound internet access, and any restrictive filtering approach may lead to unintended loss of functionality.
External applications and network requirements
Applications distributed to the devices through KMM, whether from managed Google Play or as custom APKs, may have their own network requirements, including ports and endpoints. These should be reviewed and approved individually before deployment. Relying on IP-based whitelisting for these applications is not recommended, as many cloud services use dynamic addresses that frequently change. Allow only the outbound connections each application needs.