Microsoft IP Ranges for Fabric Notebooks

[DanielSDavis]

I've read through all the forums on IP Whitelisting for Microsoft Azure, and most point to this resource here: https://www.microsoft.com/en-us/download/details.aspx?id=56519.  I'm working with a vendor that requires IP Whitelisting to access their API, but they are insisting we determine WHICH tags are relevant for Microsoft Fabric since the download appears to have IP ranges for all of Azure.  Initially we provided sections around Fabric and Data Factory thinking that would suffice, but it didn't work. 
We tested a call against https://api.ipify.org?format=json using:

import requests

ip_json = requests.get("https://api.ipify.org?format=json", timeout=30).json()
print(ip_json)

This returned 20.124.34.24 which fell in the range 20.124.0.0/16 under AzureCloud.eastus.  AzureCloud seemed a bit more generic than I would have expected.

Does anybody have a more refined list of which Service Tags apply to calls from Azure Data Factory, Synapse, Fabric Pipelines, User Data Functions, and Fabric Notebooks (ie spark nodes).

For our purposes, we are using python in Fabric Notebooks to perform the API calls, but we want to ensure the whole range is provided.  For whatever reason they will not just Whitelist the entire stack from the json file.

[deborshi_nag · Accepted solution]

Hello @DanielSDavis 

The service tags associated with Microsoft Fabric is detailed here:

Service tags - Microsoft Fabric | Microsoft Learn

However, it’s important to note that Fabric Notebooks, User Defined Functions, and Data Engineering (Spark‑based) workloads do not currently have dedicated service tags.

Like you observed, you'll notice that the outbound traffic originates from Azure shared infrastructure, and points to Azurecloud.region. 

Best to call the external API using Azure Function or similar service secured behind an Azure NAT Gateway. This will give them static IP addresses. 

[v-nmadadi-msft]

Hi @DanielSDavis 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank you.

[v-aatheeque]

Hi @DanielSDavis 

Have you had a chance to look through the responses shared earlier? If anything is still unclear, we’ll be happy to provide additional support.

[lbendlin · Accepted solution]

This has been a long standing issue. Microsoft is slowly migrating to the cloud.microsoft domain to get rid of that issue some day.

Unified cloud.microsoft domain for Microsoft 365 apps - Microsoft 365 Enterprise | Microsoft Learn

[deborshi_nag · Accepted solution]

Hello @DanielSDavis 

The service tags associated with Microsoft Fabric is detailed here:

Service tags - Microsoft Fabric | Microsoft Learn

However, it’s important to note that Fabric Notebooks, User Defined Functions, and Data Engineering (Spark‑based) workloads do not currently have dedicated service tags.

Like you observed, you'll notice that the outbound traffic originates from Azure shared infrastructure, and points to Azurecloud.region. 

Best to call the external API using Azure Function or similar service secured behind an Azure NAT Gateway. This will give them static IP addresses.