FAQ: IT Admin Guide

This guide answers many of the common questions IT Administrators have about deploying and managing Minecraft Education in their school(s) such as URLs that need to be allow listed through enterprise firewalls and content filters, ports, minimum required specs, install & update info, and student data. 

Important Links:

• URLs that need to be allow listed
• Will allowing these URLs open my network to unwanted activity?
• Do I need to forward any Ports for Minecraft Education?
• What are the minimum required specs for devices to run Minecraft Education?
• How do I install Minecraft Education?
• How do I update Minecraft Education?
• Does Minecraft Education collect or store student data?

Why should I allow students to play Minecraft at school?

Minecraft Education is a game-based learning platform that offers educators a transformative way to engage students and ignite their passion for learning. The platform contains controls not found in the Consumer editions of Minecraft - which allow instructors oversight into the activities of their students. Educators in grades K-12 are using Minecraft Education to teach a range of subjects, from history and chemistry to sustainability and foreign languages, and can map lessons directly to specific learning outcomes and curriculum standards.  Through these project-based lessons, students build critical 21st century skills like collaboration, creative problem solving and digital citizenship.

Why do I need to allow network access to URLs?

Minecraft Education is more than just a game—it’s a connected platform that uses cloud services to deliver interactive learning tools. To ensure students can access all available features, school IT networks need to allow communication with specific online services. Without this access, key functionality may be blocked.

Here’s why network access is essential:

• Minecraft Education relies on a services-based architecture, meaning it connects to the internet to access essential features.
• External communication is required to enable tools like Immersive Reader (https://edusupport.minecraft.net/hc/en-us/articles/360061503031-Accessibility-Features), lesson content, and coding platforms.
• To enable these features, school networks must allow traffic between Minecraft Education and a predefined list of service endpoints.
• Allowlisting the below URLs ensures full access to services that are embedded in the Minecraft Education experience.

List of all URLs used by Minecraft Education

This is the list of all the URLs used by Minecraft Education.

Note that as of v1.21.91, https://www.tynker.com no long needs to be allow listed as we no longer utilize the services from this URL. 

Additional URLs for Microsoft auth & Azure services:

• Office 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn
  • See "Microsoft 365 Common and Office Online" section for URLs that relate to the Microsoft login services we use. IDs 56 and 59 in this section are the most relevant to what Minecraft Education uses. Please note however that different organizations may use different URLs. If your network may be blocking our services, you can compare the URLs you're blocking to the list above to see if the URLs are ours. 

You will also need to ensure the following processes can run while logging in:

• Minecraft.AdalServer.exe  (Login)

ChromeOS & SSL Decryption

If you are using SSL Decryption on a Chromebook any URL that serves up certificates would need to be added to your bypass list. The article from Google has information here.

What is the full list of domains that are in the wildcards?

The list of domains can change without notice, and some are CDNs which may be different regionally, so while we will attempt to keep this list up to date and complete, if possible, we recommend you use the wildcards (*) above instead of managing specific sub-domains.

Can we reduce the number of “game” related domains in the allow-list?

The Minecraft Education library uses the Microsoft owned services PlayFab and XForge to deliver library content. While we recommend allowing all xboxlive.com subdomains to help protect against future architecture changes such as additional authentication calls or the introduction of new CDNs, it is possible to limit the number of *.xboxlive.com services to just those currently used by XForge:

• https://xforge.xboxlive.com/
• https://xforgeassets001.xboxlive.com/
• https://xforgeassets002.xboxlive.com/

Will allowing these URLs open my network to unwanted activity?

Minecraft Education only uses services from reputable sources that have been audited for compliance with all relevant security and privacy standards.  The communications between Minecraft Education and these service endpoints is limited to data sharing between the application and the service and the services we use are generally not available for web traffic.  

The xboxlive.com and playfabapi.com services connect Minecraft Education to our content hosting service which allows for much quicker access to our instructional content.  Opening your network to these URLs will allow authenticated communication to all Xbox services hosted on xboxlive.com but does not allow access to public websites like xbox.com. If you are concerned about exposing too many services from xboxlive.com, it is possible to only allow XForge by following the previous questions' instructions.

Do I need to forward any Ports for Minecraft Education?

Minecraft Education uses a WebRTC signaling service to establish peer-to-peer connections between clients for multiplayer. The establishment of the multiplayer session occurs over web sockets and UDP ports and then the actual peer-to-peer connection occurs over ephemeral ports. Most networks should not need any configuration to support this multiplayer environment but if you do need to configure ports and firewalls, the following information should be helpful:

• The signaling connections use wss://signal.franchise.minecraft-services.net
• The STUN and TURN connections use turn.azure.com / world.relay.skype.com on the 20.202.0.0 / 16 IP range using remote TCP port 443 and remote UDP ports 3478-3481
• The peer-to-peer connections between host and joining client use local ephemeral UDP ports specified by the host client (the local port range is defined by the OS) and sent to the joining client via the signaling service

What are the minimum required specs for devices to run Minecraft Education?

For the latest information on system requirements, visit this article. 

How do I install Minecraft Education?

Visit these Help Center pages for information about installation:

• The Minecraft Education download page contains links to versions for each supported device. See OS specific guides below:
  • Windows Installation Guide
  • Chromebook Installation Guide
  • Mac Installation Guide
  • iPad Installation Guide
• Deploying and Updating Minecraft Education describes how to deploy the application manually or using system management software
  • You can deploy using Intune to Macs with the script located here.
• Use this link to get the Minecraft Education installer package

How do I update Minecraft Education?

View our Update to a New Version of Minecraft Education Edition article for information about how Minecraft Education Edition updates and also how IT Admins can block these updates for greater control.

Does Minecraft Education collect or store student data?

Minecraft Education uses Office 365 services for authentication, and does not collect or store any personal information within the application.  The Office 365 platform is in full compliance with COPPA, CIPA, and FERPA. View our User Privacy and Minecraft Education article for more information about. 

You can also visit the Microsoft Trust Center for more information about privacy and security in Microsoft applications.