Embedding for Customer - Is there anyway to IP restrict inbound traffic from users browser Capacity

[jkeeley]

We are using Embedded for our Customers and are wanting to be able to apply an IP restriction

Anyway to setup IP restriction for the communication between a customer's browser and the calls to power bi capacity?

[jkeeley]

Opened Ticket with MS and received confirmation.  IP Restrictions are not currently possible on Power BI Embedded Capacities

[jkeeley]

Thanks for the reply.  I'm not looking for Azure IP Ranges.  I'm looking to restrict the IP Address range that is allowed to access Our Azure Power BI Embedded Capacity.  We are using Embed for your customer and we need to ensure only our customer IP Ranges can render reports from our Power BI Capacity.  

[lbendlin]

it's the same thing .  "Our Power BI capacity" is not actually a thing. Even Premium SKUs don't have dedicated IP addresses.  The Gov Cloud might be different, but EM SKUs are all sitting in the same Azure pool.

[jkeeley]

Thanks again for the response.  Sorry if I'm not being clear in my question.  When a customer of ours logs into our web portal and views an embedded power bi report using an embed token we've generated for them, the customers browsers javascript client makes a call to the Azure Power BI Embedded Capacity to render the report (using the embed token).  I'm not looking to get an IP address for the Azure Embedded Capacity, in fact I'm not looking for an IP Address at all.  What I'm asking is there a way to Restric IP address ranges (these are IPs from our customers browsers) from making calls to Azure Embedded Capacity.  This would be very much like conditional access policies in Azure AD Premium.  The intent here is to protect our clients data even in the event of a compromised Embed Token.  So Hypothetically a hacker figures out a way to generate an embed token, currently, they could use that token to render a report from anywhere, we would like to block the use of a valid token if its coming from a non-white-listed IP Address.

[lbendlin · Accepted solution]

If they can generate/intercept embed tokens they can probably also spoof IP addresses.

You will want to ask your Microsoft contacts that question though.

[lbendlin]

There are lists on the interwebs for that but they keep changing.  Have a look at this one

Download Azure IP Ranges and Service Tags – Public Cloud from Official Microsoft Download Center