If Teams cannot detect your emergency location after a network firewall change, your calls to 911 or local emergency services may route to the wrong dispatch center. This problem usually appears when the firewall blocks the specific endpoints Teams uses for location discovery. This article explains why the firewall blocks location detection, how to verify the network path, and how to restore emergency location services.
Teams relies on a network-based emergency location service that queries a Microsoft endpoint. When a firewall change blocks that endpoint, the client falls back to a default location or shows no location at all. You will fix this by checking the required URLs, updating firewall rules, and testing the location detection in the Teams client.
Key Takeaways: Restore Teams Emergency Location After Firewall Changes
- Teams admin center > Locations > Emergency locations: Shows the configured locations and their associated network identifiers.
- Microsoft 365 URLs and IP address ranges: Lists the exact endpoints Teams needs for emergency location discovery.
- Test call in Teams: Verifies that the client can reach the location service after firewall changes.
Why a Firewall Change Breaks Emergency Location Detection
Teams uses a network-based emergency location service. When a user signs in, the client sends a request to a Microsoft endpoint to resolve the current network identifier and match it to a configured emergency location. This endpoint is part of the Microsoft 365 network infrastructure. If a firewall rule blocks the HTTPS traffic to that endpoint, the request fails silently. The client then displays the default location or no location at all.
Firewall changes often affect this process because administrators add or modify rules without checking the full list of required URLs. For example, a rule that restricts outbound traffic to a specific IP range may exclude the Teams location service subnet. The firewall may also block the TLS handshake if it inspects certificates and does not trust the Microsoft certificate chain.
The location discovery process uses a specific set of endpoints. These endpoints are documented in the Microsoft 365 network endpoints list. The key endpoint for emergency location is location.osi.office.net. This hostname resolves to multiple IP addresses, and the firewall must allow HTTPS on port 443 to all of them.
Steps to Diagnose and Fix Teams Emergency Location Detection
Follow these steps in order. Each step verifies a different part of the network path. Stop when the issue is resolved.
- Check the current emergency location settings
Open the Teams admin center at admin.teams.microsoft.com. Go to Locations > Emergency locations. Confirm that the location you expect is listed and has a valid network identifier. If the location is missing, the problem may be configuration, not the firewall. - Verify the required endpoints in the Microsoft 365 list
Open the Microsoft 365 network endpoints documentation. Find the section for Teams. Look for the entry labeled location.osi.office.net. Note the IP ranges and port requirements. The service uses HTTPS on port 443 only. - Test connectivity to the location service
On a machine affected by the issue, open a command prompt. Run nslookup location.osi.office.net to confirm DNS resolution. Then run Test-NetConnection location.osi.office.net -Port 443 in PowerShell. If the test fails, the firewall is blocking the connection. - Update the firewall rules
Log in to your firewall management console. Locate the outbound rule that restricts HTTPS traffic. Add an allow rule for the IP ranges associated with location.osi.office.net. Ensure that the rule applies to all users and all networks where Teams is used. - Refresh the Teams client
After updating the firewall, close Teams completely. Right-click the Teams icon in the system tray and select Quit. Restart Teams and sign in again. The client will reattempt the location discovery request. - Run a test call to verify emergency location
In Teams, click your profile picture and select Settings > Devices. Under Make a test call, click Make a test call. During the call, check the emergency location shown in the call window. If the correct location appears, the fix worked.
If Teams Still Cannot Detect the Emergency Location
The main fix covers most firewall-related issues. If the problem persists, check these additional failure patterns.
Teams Shows the Default Location on a Wired Network
The location service may fall back to a default because the network identifier does not match any configured location. Verify that the subnet or network identifier in the emergency location matches the actual network. In the Teams admin center, edit the location and confirm the network identifier is correct.
DNS Resolution Fails for location.osi.office.net
If nslookup returns no result, your internal DNS server may not forward external queries. Check the DNS forwarder settings. If you use a split-horizon DNS, add a forward zone for office.net to the public DNS.
Proxy Server Intercepts the Location Request
Some proxy servers intercept HTTPS traffic and block unknown hostnames. Add location.osi.office.net to the proxy bypass list. Also ensure that the proxy does not strip the TLS Server Name Indication header, which Teams requires for routing.
Teams Emergency Location Detection: Desktop vs Web Client
| Item | Teams Desktop App | Teams on the Web |
|---|---|---|
| Location discovery method | Uses local network adapter and OS location services | Uses browser geolocation API |
| Firewall endpoint | location.osi.office.net | location.osi.office.net plus browser-specific endpoints |
| Fallback behavior | Shows default location or no location | Shows default location or prompts for manual location |
| Best for emergency calls | Yes, because it uses network identifier | No, because browser permission may block detection |
The desktop app is the preferred client for emergency calling because it uses the network identifier. The web client relies on browser permissions and may not work in an emergency. Always use the desktop app for users who make emergency calls.
After you update the firewall rules and verify the endpoint is reachable, Teams will detect the emergency location again. Run a test call to confirm. If you manage multiple sites, review the network identifiers in the Teams admin center to ensure each site has a matching location.
For advanced troubleshooting, enable the Teams client log and search for location.osi entries. This log shows the exact HTTP response from the location service. Use the Teams admin center to export the current emergency call policies and verify that the assigned policy allows location detection.