By Andrew Armstrong 
Configuration Manager OSD task sequences that fail specifically at the Windows/Office activation step are frequently a proxy problem, not a licensing one — the activation servers are being blocked before the request ever reaches Microsoft.
Windows Activation Endpoints
Add the following to your proxy whitelist to allow activation traffic through:
activation.sls.microsoft.com activation-v2.sls.microsoft.com crl.microsoft.com mscrl.microsoft.com displaycatalog.md.mp.microsoft.com displaycatalog.mp.microsoft.com go.microsoft.com licensing.md.mp.microsoft.com licensing.mp.microsoft.com login.live.com purchase.md.mp.microsoft.com purchase.mp.microsoft.com sls.microsoft.com validation.sls.microsoft.com validation-v2.sls.microsoft.com www.microsoft.com
Office Activation Endpoints
productactivation.one.microsoft.com go.microsoft.com odc.officeapps.live.com officeimg.vo.msecnd.net
KMS Endpoints (if you run your own KMS host or use Azure-hosted KMS)
kms.core.windows.net azkms.core.windows.net
These use TCP port 1688 by default rather than 443/80 — if your proxy/firewall rule is scoped by port as well as hostname, make sure 1688 is open between the client and your KMS host for volume-licensed machines that activate against KMS rather than MAK/digital licence.
Why CRL access matters more than it looks like it should
It’s easy to skip crl.microsoft.com and mscrl.microsoft.com when whitelisting, since they don’t look activation-related by name — but they’re actually one of the most common causes of activation failures that otherwise look inexplicable. Windows needs to check the Certificate Revocation List to verify the TLS certificate presented by the activation servers; if that check can’t complete, the whole connection is torn down before any activation data is exchanged, and the error you see rarely points back to a CRL problem. If activation is failing despite every other endpoint above being whitelisted, check CRL access first.
These are worth adding as a permanent exception on any web filtering or proxy appliance sitting between your client network and the internet, not just during OSD — ongoing licence validation and reactivation after hardware changes rely on the same endpoints. Where your proxy supports wildcard rules, *.sls.microsoft.com and *.mp.microsoft.com are worth using instead of the individual hostnames above, since Microsoft serves these from CDN infrastructure with IPs that change and subdomains that occasionally shift — a wildcard rule is far less likely to silently break after a backend change on Microsoft’s side.
Resources
Gear We Recommend
A few general tech accessories worth having alongside this.
Browse our General Tech Accessories picks on Amazon
As an Amazon Associate, TechyGeeksHome earns from qualifying purchases.
Discover more from TechyGeeksHome
Subscribe to get the latest posts sent to your email.
