Microsoft is moving OneDrive for work and school from tenant-specific SharePoint addresses, such as contoso-my.sharepoint.com, to the onedrive.cloud.microsoft address. This article answers the questions that Nerdio Manager for Enterprise customers ask most, particularly if your AVD session hosts reach the internet through a firewall, proxy, or web filter.
Microsoft began rolling out the change at the end of July 2026, so you may already be seeing it in your environment. For the addresses that session hosts must be able to reach, see Required outbound internet access from AVD session host VMs, which is the reference for this topic.
What is changing?
The address that users see in the browser when they open OneDrive on the web. Instead of their tenant-specific SharePoint address, they see onedrive.cloud.microsoft. The change is part of Microsoft's wider move of user-facing Microsoft 365 apps to the cloud.microsoft domain, a domain that only Microsoft can register.
Where are we in the rollout?
Microsoft began the rollout at the end of July 2026. It is progressive, so users in the same organization, or even the same host pool, can see the new address at different times. For the current schedule, see Microsoft 365 Message Center post MC1392563.
Do existing links, bookmarks, and file access still work?
Yes. The old and new addresses work in parallel, and Microsoft does not redirect the old one. File access, sharing, and permissions do not change. The SharePoint addresses that OneDrive uses for file storage and APIs also stay the same, and Microsoft Graph and other official APIs are not affected.
Does this change personal OneDrive?
No. Microsoft has said that personal OneDrive stays on the live.com domain for now.
Do I need to do anything?
Microsoft says that no immediate action is required. However, if your session hosts reach the internet only through addresses that you have explicitly allowed, allow *.cloud.microsoft so that users can open OneDrive on the web from within their sessions. Keep any existing rules for the SharePoint addresses that OneDrive uses for storage and sync.
Which addresses must my session hosts be able to reach?
See Required outbound internet access from AVD session host VMs. That article is the single reference for the addresses that session hosts need. For OneDrive, it lists *.cloud.microsoft for the OneDrive web experience and *.sfx.ms for OneDrive client updates.
Should I allow only onedrive.cloud.microsoft, or the whole cloud.microsoft domain?
Allow *.cloud.microsoft. This is the range that Microsoft recommends in its notice for this change, and Microsoft has included it in its Microsoft 365 network guidance since 2023. If you build your firewall or proxy rules from Microsoft's published Microsoft 365 endpoint list or its endpoint web service, you might already allow it, but check instead of assuming.
What happens if the new address is blocked?
The change affects the web address that users see, not where their files are stored, so a blocked address is a network problem, not a OneDrive outage. When the browser starts using the new address, users might see blocked pages, repeated sign-in prompts, or previews that do not load. Check your firewall, proxy, and web filter logs for blocks on cloud.microsoft before you investigate OneDrive itself.
Which settings and tools should I review?
Search your rules, policies, and code for the old OneDrive address pattern, for example *-my.sharepoint.com. In particular, review:
-
Firewall, proxy, DNS filtering, and SSL inspection rules, which are the most likely to treat the new address as unknown.
-
Secure web gateway and cloud access security broker tools, whose URL categories and Microsoft 365 app definitions might not include the new address yet.
-
Microsoft Edge URL allow and block lists that you push with Intune.
-
Conditional Access policies and session controls, and Defender for Cloud Apps session policies, that depend on URL patterns.
-
Tenant Restrictions v2, if you use it.
-
Data loss prevention rules that restrict browser uploads and downloads.
-
Scripts, scripted actions, Power Automate flows, and other custom tools that parse or hardcode OneDrive web addresses. Use Microsoft Graph instead of parsing browser addresses.
Does this affect FSLogix, Office containers, or Known Folder Move?
FSLogix is unlikely to be affected directly, because profile containers and Office containers do not change. If your users sync OneDrive or use Known Folder Move in their sessions, include sign-in and folder redirection in your testing.
Does this affect Nerdio Manager itself?
Nerdio Manager does not depend on SharePoint addresses for its core functionality, so the change does not affect how it manages your environment. It can affect your own scripts, including scripted actions, that contain hardcoded SharePoint or OneDrive web addresses. Search your scripts for sharepoint.com.
How do I test that session hosts can reach the new address?
To test access from a session host:
-
Sign in to a session host as a test user.
-
In the browser, open
onedrive.cloud.microsoftand sign in. -
Open an existing link to a OneDrive file that uses the old SharePoint address, and confirm that it still opens.
-
If you use OneDrive sync or Known Folder Move, confirm that sync status and folder redirection still work.
-
Review your firewall and proxy logs for blocks on
cloud.microsoft.
What should I tell my users and helpdesk?
Tell them that onedrive.cloud.microsoft is a genuine Microsoft address, that their existing links still work, and that they might see a globe icon when they open content that is stored in another geography. Update your helpdesk and security-awareness material so that staff do not report the new address as suspicious, while still reminding users to check the full address for lookalike domains.
-
Unified cloud.microsoft domain for Microsoft 365 apps (Microsoft Learn)
-
Microsoft 365 URLs and IP address ranges (Microsoft Learn)
-
Configure Tenant Restrictions v2 (Microsoft Learn)
-
Microsoft 365 Message Center post
MC1392563, OneDrive transitions to the cloud.microsoft domain.
For the addresses that session hosts need, see Required outbound internet access from AVD session host VMs.
Comments (0 comments)