Every address Offision connects to
Allow Offision through a proxy or firewall — every hostname and port a device or app opens, for both the Japan and Hong Kong data centres, and the ones Offision never needs. Outbound on 443 only, no inbound rule; what a proxy, TLS inspection, DNS and NTP need to let through.
Allow these outbound, from the network your devices and computers are on. Your account lives in one data centre — take that column, and see Where your data is hosted if you are not sure which.
If your proxy asks for a URL allowlist, these hostnames are it — Offision opens no other URLs. Nothing here needs an inbound rule. See Put Offision devices on a locked-down network.
Always
Every device and every app needs all four of these.
| What | Japan | Hong Kong | Port |
|---|---|---|---|
| App, admin, player and signage | app.offision.com | app-hk.offision.com | 443 |
| Live updates | app-signal.offision.com | app-hk-signal.offision.com | 443 |
| Uploaded files and screen media | offisionappjp.blob.core.windows.net | offisionapphk.blob.core.windows.net | 443 |
And two that are the same whichever region you are on:
| What | Host | Port |
|---|---|---|
| Pairing a new device | registration.offision.com | 443 |
| Fonts on signage screens | fonts.googleapis.com, fonts.gstatic.com | 443 |
Blocking the font hosts is not fatal: a screen falls back to whatever font the device already has, which looks wrong rather than broken. The other four are not optional.
Desktop app and control processor updates
Only needed where one of these is installed. Both check for their own updates.
| What | Host | Port |
|---|---|---|
| Desktop app, desktop player, Windows control-processor agent | offisioninstallers.blob.core.windows.net | 443 |
Only if you use it
| What | Japan | Hong Kong | Port |
|---|---|---|---|
| Door locks, relays and IoT sensors | offision-jp.azure-devices.net | offision-hk.azure-devices.net | 8883 |
| Remote screen view and video calls | stun.l.google.com, stun1.l.google.com | same | 19302 UDP |
| A signage screen playing a YouTube video | www.youtube.com, www.youtube-nocookie.com, i.ytimg.com | same | 443 |
A plain booking panel or signage screen needs none of these rows. The first is for hardware that opens a door or reports occupancy, the second for watching a player’s screen from the console and for calls placed from the app or a board, and the third only where a screen shows the YouTube content widget.
Sensors and on-site equipment
Sensors reach Offision in one of three ways, and only one of them needs a route out of the network the sensor sits on. This is what decides whether a segmented plant or lab network has to allow anything at all.
| How it reports | What needs egress | Allow |
|---|---|---|
| Offision reads it from the vendor’s own cloud | Nothing on your network. Offision talks to the vendor, not to the device | — |
| A gateway on your network collects the sensors and posts readings to Offision | the gateway only, outbound | the Always hosts above |
| The device connects to Offision itself | the device, outbound | the IoT Hub row above |
So a cloud-read sensor works on a network with no outbound route at all, because nothing on your side ever calls out. A gateway or a directly-connected device needs the one egress point, and nothing more.
A control processor follows the third shape and is often the tidiest answer on a segmented network: it sits on the equipment’s own subnet, reaches the local equipment there, and dials out itself — so one box holds the only route out.
Which shape a given sensor uses is on its own page: Neat Pulse, Cisco Webex Control Hub and Logitech Sync are read from the vendor’s cloud; Milesight sensors report through a gateway on your network; an AXIS door lock relay connects to Offision itself.
What Offision never needs
- No inbound firewall rule. Ever, for any device or app.
- No port forwarding, and no NAT rule pointing at a device.
- No VPN, and no site-to-site tunnel.
- No static or public IP for any device on your side.
- No open ports on the devices themselves.
- No on-premises server. Offision runs only in the data centres above.
Addresses not to allow
These look like Offision and are not part of a production deployment. Allowing them grants access nothing needs.
offision-dev.azurewebsites.net,offision-staging.azurewebsites.netandoffision-staging2.azurewebsites.net— development and staging only.offisioninstallers.z23.web.core.windows.net— a disabled endpoint that answers every request with an error. Use the installer host above instead.