Skip to main content

​
Firewall and proxy requirements

Allow outbound HTTPS on port 443 to the required Grunt service endpoints.

​
Current endpoints

Add these domains to your network allowlist:
  • api.grunt.io
  • cdn.grunt.io

​
Legacy endpoints during transition

Keep these existing domains on your network allowlist during the transition:
  • api.grunt.pro
  • api.altua.no
  • files.altua.no
  • app.grunt.pro
Do not remove the legacy domains yet. Grunt supports both endpoint sets during the transition. The legacy domains will eventually be discontinued. We will notify you before you can remove them from your network configuration. If users are behind a proxy, make sure proxy policy allows Grunt API communication. In affected environments, users may also need to enable Use default proxy for API communication in Grunt.

​
Enable proxy mode during silent install

You can enable Use default proxy for API communication as part of a silent deployment by setting the Grunt proxy preference in the Windows registry. Run the registry step in the Windows user context for each user who will run PowerPoint. The setting uses HKEY_CURRENT_USER, so a script running as SYSTEM or as an administrator sets the preference for that account only. For current builds, set:
For compatibility with older builds, you can also set the legacy path:
You can also deploy the same values with a .reg file:
Apply this before the user’s first Grunt launch, or before you ask the user to retry network, sign-in, license, or template operations. For Microsoft sign-in, SSO, and SharePoint-backed Excel refresh, also allow outbound HTTPS on port 443 to Microsoft services:
  • login.microsoftonline.com
  • graph.microsoft.com
SharePoint-backed Excel refresh uses Microsoft Graph from the local PowerPoint add-in. The add-in requests delegated Files.Read access so it can read the selected workbook range with the signed-in user’s Microsoft permissions.
Grunt uses a local browser redirect during Microsoft authentication. Security software should allow loopback traffic to http://localhost:12345 for the sign-in flow.

​
Endpoint allowlisting

Use your organization’s standard allowlist process for all Grunt domains listed above. Allow both the current and legacy Grunt endpoints during the transition. When troubleshooting blocked license checks, sign-in, templates, SharePoint Excel refresh, or updates, start by testing endpoint reachability from affected devices.

​
Endpoint protection considerations

Some endpoint security tools can block Grunt binaries during installation or startup. For the default per-user install, consider adding Windows Defender exclusions for the main Grunt binaries:
  • %USERPROFILE%\AppData\Local\Programs\Grunt\<version>\PowerPoint\Grunt.PowerPoint.ComAddinNE.dll
  • %USERPROFILE%\AppData\Local\Programs\Grunt\Updates\bin\Grunt.PowerPoint.Runner.exe
  • %USERPROFILE%\AppData\Local\Programs\Grunt\Updates\bin\Grunt.PowerPoint.Updater.exe
  • %USERPROFILE%\AppData\Local\Programs\Grunt\Updates\bin\Grunt.PowerPoint.Restarter.exe
If needed, add targeted exclusions for approved Grunt install paths and executables according to your internal security process.
Apply exclusions narrowly and only after internal security review.

​
Office add-in trust and certificates

Grunt registers as a COM add-in. If install or first startup fails because the Grunt certificate is not trusted, import the installer’s signer certificate for Altua As into Trusted Publishers for the affected user or machine. If Office Group Policy blocks COM add-ins, ensure the Grunt ProgID (Grunt) or CLSID ({AAF65EB4-AFBA-4B65-98AD-381C670B6461}) is not on the block list.