Whitelist IP ranges

[ELIU]

I have two questions related to connecting our Power BI (either desktop or Service) to two distince applications. We are on Power BI Gov Tenant. 

1, The first app is on-prem and does not host any publicly facing servers. They need the Power BI IPs from within the organization network from which either Power BI desktop or Power BI service will access the data.

My questions: we will need to connect to the on-prem source via Power BI desktop and then publish the report to the service. We will also need to set up a gateway on the Service for the on-prem source. What kind of IP ranges do we need to provide to the app? Do we also need to provide the AzureGov for PowerBI IP ranges (public) as gateway will be involved?

2, The second app is on cloud and they need to whitelist our public IP ranges. Should I provide the AzureGov for PowerBI IP ranges (public) to the app and if I do that I should be able to connect to the app in Power BI Service, correct? If so, are these IP ranges static or dynamic?

Any inputs will be much appreciated.

[v-sgandrathi]

Hi @ELIU,

You’re correct, the downloadable file includes all Azure IP ranges, which can make it difficult to determine which ones are specific to Microsoft Fabric.

For Fabric (including Power BI workloads), you don’t need to use the entire list. Instead, focus on the relevant Service Tags in the file, such as:
PowerBI / PowerPlatformPlex – covers Fabric and Power BI service traffic
AzureCloud.<region> (for example, Azure Government regions for government tenants)
Gateway/Data movement-related tags – if you use On-premises Data Gateway

These tags represent the subsets of IPs that Fabric actually uses. Since Fabric doesn’t have a separate IP range list and relies on Azure infrastructure, all ranges are included in one download.

Recommendation:
Whenever possible, use Service Tags instead of static IP ranges, as Microsoft updates them automatically. If you need to whitelist IPs, filter the file for the relevant service tags and update it regularly.

Thank you.

[DanielSDavis]

Has anyone learned which sections actually apply to Microsoft Fabric?  It seems like the available download is just the entirety of IPs for Azure.

[ibarrau]

Hi. Here you can find the IP list that v-sgandrathi is talking about:

https://www.microsoft.com/en-us/download/details.aspx?id=56519

It might be a solution around vnet gateway and NAT, or private link, but I'm not quite sure about the whole picture yet. You can take a look.

I hope that helps,

[v-sgandrathi · Accepted solution]

Hi @ELIU,

For a Power BI Government tenant, the IP whitelisting method depends on whether the data source is on-premises or in the cloud. If the application is on-premises, Power BI Service does not connect directly to it; instead, connections are made through the On-premises Data Gateway, which sends outbound traffic to Azure Government services. This means you do not need to whitelist Power BI or Azure Government public IPs on the on-premises app. The key requirement is that the gateway machine has proper outbound internet access to Azure Government endpoints.

For cloud-based applications, Power BI Service connects directly over the internet, so the application needs to whitelist Azure Government Power BI public IP ranges. These IP ranges can change, so it’s best to use Azure Service Tags if possible or regularly update the IP whitelist using Microsoft’s published list. Once the correct IP ranges are whitelisted, Power BI Service should be able to connect to the cloud application.

Thank you,
CST Member.