How to block Minecraft on your network, and keep Minecraft Education
Minecraft comes in several editions that share sign-in and some services. Most schools want the consumer game off their network while Minecraft Education keeps working in class. This guide shows how to draw that line.
Block
Block
Usually keep
Block
Why organisations block consumer Minecraft
Few admins object to Minecraft as such. The issue is the consumer edition on school or work devices, with open servers, chat and add-on stores that have nothing to do with the lesson.
Lesson time
Survival worlds and server minigames are a popular alternative to classwork on school laptops.
Open community servers
Public servers mix ages freely and run their own chat, with moderation that varies a lot from server to server.
Marketplace purchases
Skins, worlds and add-ons are sold for real money, and some servers sell ranks and perks.
Unofficial mods and launchers
Mods and modified launchers from unknown sites are a common way for malware to reach student and staff machines.
Local network play
Students can host worlds for each other across school Wi-Fi without touching the internet at all.
Workplace devices
On company PCs, any game is unapproved software. Minecraft is simply one of the most common.
Edition matrix: what each one uses
Each edition reaches different services. This is the table to keep open while you build rules. Hostnames change with updates, so treat the domains as the well-known starting set and confirm in your logs.
| Edition | Platforms | Sign-in | Key domains | Default server port | School action |
|---|---|---|---|---|---|
| Java Edition | Windows, Mac, Linux via the Minecraft Launcher | Microsoft account | minecraft.net, mojang.com, minecraftservices.com | TCP 25565 | Block |
| Bedrock Edition | Windows app, consoles, phones, tablets, Chromebooks | Microsoft account and Xbox network | minecraft.net, minecraft-services.net | UDP 19132 | Block by app |
| Minecraft Education | Windows, Mac, iPad, Chromebook | Microsoft 365 school account | education.minecraft.net, minecrafteduservices.com | Managed by the service | Allow |
| Browser versions | Any browser | None for the classic version | classic.minecraft.net and third-party clone sites | Web ports | Block |
Never block Microsoft sign-in. All editions sign in with Microsoft accounts, but login.live.com, login.microsoftonline.com and the Xbox network are shared with Microsoft 365, Windows and many other services. Blocking them breaks school email and documents long before it stops a game.
Check any Minecraft-related host from your logs in the domain category lookup before you add it to a rule.
The overlap problem, and how to solve it
The consumer game and Minecraft Education share a parent domain and some services. A careless rule on minecraft.net with all subdomains will block Minecraft Education as well. Sort hosts into three groups.
Group 1Block
mojang.comlauncher and session hosts for Javaminecraftservices.comJava profiles and sign-in tokenswww.minecraft.netstore and downloadsclassic.minecraft.netbrowser version- Community servers, server lists and mod sites, via the Gaming category
Group 2Shared: do not block
- Microsoft account sign-in hosts
- Xbox network services
minecraft-services.netif Minecraft Education is in use- Microsoft 365 storage used for cloud saves
Group 3Allow explicitly
education.minecraft.netminecrafteduservices.comand subdomains- Any other endpoint in Microsoft's current Minecraft Education IT admin guidance
Most filters let a more specific allow rule win over a broader block. Put education.minecraft.net in an allow list that is evaluated first, then block the rest. Test after every change, because filter products order rules differently.
Two recipes: block everything, or keep Education
Choose the recipe that matches your licence and teaching plans. Businesses usually want recipe A. Schools that teach with Minecraft Education want recipe B, which takes a little more care but avoids broken lessons.
Recipe A: block all Minecraft
Workplaces, schools not using Education- Block minecraft.net, mojang.com, minecraftservices.com and minecraft-services.net with subdomains.
- Block the Gaming category and VPN / Proxy / Anonymizers.
- Add the Minecraft application signature to firewall app control.
- Deny outbound TCP 25565 and UDP 19132 to the internet.
- Block the Minecraft Launcher, the Windows app and Minecraft Education with application control and MDM.
- Turn on client isolation on student and guest Wi-Fi.
Recipe B: block consumer, keep Education
Schools teaching with Minecraft Education- Allow education.minecraft.net and minecrafteduservices.com first, plus other endpoints in the current Education guidance.
- Block mojang.com, minecraftservices.com, www.minecraft.net and classic.minecraft.net.
- Block the Gaming category, which leaves explicit allows in place in most filters.
- Deny outbound TCP 25565 and UDP 19132 to the internet.
- On devices, block the consumer apps and deploy Minecraft Education as the only Minecraft app.
- Exclude Education endpoints from TLS inspection if multiplayer lessons fail.
Order matters. Add the Education allow rules first, then deploy the device policies, then switch on the network blocks. Run a Minecraft Education lesson check with one teacher before term starts, so the first failure does not happen in front of a full class.
Before you switch the block on
Ask teachers
Find out which classes use Minecraft Education and when, so you can test with real lessons.
Check licences
Confirm students and staff have Minecraft Education licences assigned in your Microsoft 365 tenant.
Tell families
Explain that the consumer game is blocked on school devices and Minecraft Education remains for lessons.
Device policies, platform by platform
Network rules decide what Minecraft can reach. Device rules decide which Minecraft can run. On school devices, the device layer is the cleanest way to separate the consumer game from Minecraft Education.
Windows with Intune
- Block the Minecraft Launcher and the Minecraft Windows app with an application control policy; allow the Minecraft Education app.
- Push mojang.com and minecraftservices.com to the browser URL block list, and keep the Education endpoints on the allow list.
Chromebooks with Google Admin
- Block the consumer Minecraft app from Google Play for student units.
- Force-install or allow the Minecraft Education app.
- Add classic.minecraft.net, mojang.com and www.minecraft.net to Chrome URL blocking.
- Restrict Chrome extensions to an approved list.
iPads with MDM
- Block or hide the consumer Minecraft app on supervised iPads.
- Deploy Minecraft Education through your volume purchase account.
- Add the consumer domains to a web content filter payload deny list.
Macs
- Block the Minecraft Launcher through your MDM's restricted software settings.
- Deploy Minecraft Education where needed.
- Apply a device-level filter profile so rules hold off the school network.
Firewall and DNS filter
- Put the Education allow rule at the top of the policy.
- Block the games category, the consumer domains and the Minecraft app signature.
- Deny the default server ports outbound and block QUIC.
- Force DNS to your resolver and drop DNS over TLS.
Most next-generation firewalls identify Minecraft traffic. For DNS options, read DNS filtering vs web filtering.
Servers, ports and local play
Consumer Minecraft multiplayer happens on servers run by anyone, at any domain. That makes ports and local network settings more useful here than for most games, as long as you treat them as one layer among several.
Community servers
Large public servers have their own domains, and server list sites index thousands more. The Gaming category covers both as they are categorized.
Local network worlds
A student can open a world to others on the same network. Client isolation on student Wi-Fi stops devices talking directly to each other.
Wired labs
On wired labs, use private VLANs or port isolation for student machines, or block the game client with application control.
Safe exceptions: clubs, coding classes and school servers
Some teachers want more than Minecraft Education offers, for example a coding club that writes plugins for a Java server. You can support that without opening the consumer game to everyone.
Option 1School-hosted server
- Run a Java or Bedrock server inside the school network.
- Allow the server port only between the club VLAN and that server.
- Keep internet server ports blocked for everyone.
- Whitelist student accounts on the server itself.
Option 2Club exception group
- Create a directory group or VLAN for club machines.
- Allow the consumer domains and Gaming for that group only.
- Limit it to club hours with a schedule.
- Give the exception an end date and an owner.
AvoidUnblocking for all
- Turning the block off for one lesson tends to become permanent.
- Students share the moment it is off.
- Logs lose their value as evidence.
- Use options 1 or 2 instead.
Minecraft outside schools
Offices
Follow recipe A. Application control on managed PCs does most of the work; the network rules catch personal devices on staff Wi-Fi.
Public libraries
Many libraries allow games on guest Wi-Fi but block them on public PCs, so the machines stay free for study and job searches.
Youth centres and camps
Some run supervised Minecraft sessions on a local server, using option 1 above, and block public servers.
Hospitals and clinics
Patient Wi-Fi often allows games for long stays, with downloads throttled. Clinical networks block them.
App vs browser, and the usual bypass routes
The installed clients matter most, but browser versions and clones are what students reach for on locked-down devices. Plan for both, then close the common workarounds.
Installed apps
Stopped by application control and MDM on managed devices, and by domain, signature and port rules on the network.
Official browser version
Runs at classic.minecraft.net. Block that host by name, since it sits under minecraft.net.
Browser clones
Copies of the game on "unblocked games" sites. They are labelled Gaming in our database.
VPN and proxy
Block the VPN / Proxy / Anonymizers category and restrict VPN installs on devices.
Unofficial launchers
Modified launchers are a security risk as well as a bypass. Application control with an approved software list blocks them.
Personal hotspots
Leave your network. Device policies on school laptops and tablets still apply.
How to test: block what you meant, keep what you need
For Minecraft, testing has two sides. The consumer game must fail, and Minecraft Education must still work, including multiplayer lessons. Run the full table with a real student account on each device type you manage, and repeat it after major game or firewall updates.
| Test | How | Expected |
|---|---|---|
| Consumer DNS | nslookup sessionserver.mojang.com | Blocked |
| Education DNS | nslookup education.minecraft.net | Resolves normally |
| Launcher | Run the Minecraft Launcher as a student | Blocked by app control or cannot sign in |
| Browser version | Open classic.minecraft.net | Block page |
| Server port | Connect a test client to a public server on 25565 | Times out |
| Local world | Open a world to LAN on one student device and join from another | Not visible |
| Education sign-in | Sign in to Minecraft Education with a student account | Works |
| Education multiplayer | Host and join a class world | Works |
| Microsoft 365 | Open email and documents on the same device | Works |
Category-based blocking with our database
Minecraft's own domains are a short list. Its world is not: servers, server lists, skin sites, mod hosts, map sites and browser clones run into the thousands. A daily-updated Gaming category handles them, while your explicit Education allow stays in place.
Gaming
Consumer Minecraft, community servers, server lists and clone sites. See the Gaming category.
Education/Reference
Learning platforms and teaching resources. See the education category.
VPN / Proxy / Anonymizers
Block it wherever Gaming is blocked.
Malware / Phishing / Suspicious
Fake mod and launcher sites that carry malware.
Schools can read more on K-12 school web filtering.
Related guides: how to block Roblox at school and how to block Steam.
Minecraft blocking FAQ
Can I block Minecraft but allow Minecraft Education?
Yes. Block the consumer apps by application on managed devices, block mojang.com and minecraftservices.com and the default server ports, and allow the Minecraft Education endpoints listed in Microsoft's current IT admin guidance, such as education.minecraft.net and minecrafteduservices.com.
Will blocking minecraft.net break Minecraft Education?
It can, because education.minecraft.net is a subdomain of minecraft.net. Add an explicit allow rule for education.minecraft.net above the block, or block only the consumer hosts you see in your logs.
Which ports does Minecraft use?
Java Edition servers listen on TCP 25565 by default and Bedrock servers on UDP 19132 by default. Servers can use other ports, so a port block helps but does not replace domain, category and application rules.
Should I block login.live.com or xboxlive.com to stop Minecraft?
No. Microsoft account sign-in is shared with Microsoft 365, Windows and many other services. Blocking it breaks far more than Minecraft. Block the game by application and by its own domains instead.
How do students play Minecraft on school Wi-Fi without the internet?
Through local multiplayer, where one device hosts a world for others on the same network. Turn on client isolation on student Wi-Fi so devices cannot reach each other directly.
How does a category database help?
Thousands of community servers, server lists, mod sites and browser clones have their own domains. A Gaming category refreshed every day blocks them as they appear, which no hand-made list can do.
Do I need a separate rule for Minecraft on Chromebooks?
Yes, at the device level. On Chromebooks, consumer Minecraft and Minecraft Education are separate Android apps, so block one and allow the other in Google Admin. Network rules then apply to both in the same way as on other devices.
Will blocking Minecraft affect other Xbox or Microsoft games?
Not if you block by Minecraft's own domains and apps. Rules on shared Xbox network or Microsoft account hosts would affect other games and many non-game services, which is why this guide leaves them alone.
Can students use Minecraft Education to reach public servers?
Minecraft Education is designed for school use, with worlds hosted and joined within the education service. Keep the public server ports and Gaming category blocked so other routes stay closed, and check the current Education settings your tenant offers.
Category data for edtech and filter products
License 120 million categorized domains, updated daily, to run inside your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Minecraft, Minecraft Education, Mojang, Xbox, Microsoft, Microsoft 365 and Intune are trademarks of Microsoft Corporation. Google, Chrome, Chromebook and Google Play are trademarks of Google LLC; iPad and Mac of Apple Inc.
They are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.