Forum Discussion

ELIU's avatar
ELIU
Helper II
5 months ago
Solved

Whitelist IP ranges

I have two questions related to connecting our Power BI (either desktop or Service) to two distince applications. We are on Power BI Gov Tenant.  1, The first app is on-prem and does not host any pu...
Need Help
  • v-sgandrathi's avatar
    v-sgandrathi
    5 months ago

    Hi ELIU,

     

    For a Power BI Government tenant, the IP whitelisting method depends on whether the data source is on-premises or in the cloud. If the application is on-premises, Power BI Service does not connect directly to it; instead, connections are made through the On-premises Data Gateway, which sends outbound traffic to Azure Government services. This means you do not need to whitelist Power BI or Azure Government public IPs on the on-premises app. The key requirement is that the gateway machine has proper outbound internet access to Azure Government endpoints.

    For cloud-based applications, Power BI Service connects directly over the internet, so the application needs to whitelist Azure Government Power BI public IP ranges. These IP ranges can change, so it’s best to use Azure Service Tags if possible or regularly update the IP whitelist using Microsoft’s published list. Once the correct IP ranges are whitelisted, Power BI Service should be able to connect to the cloud application.

     

    Thank you,
    CST Member.

v-sgandrathi's avatar
v-sgandrathi
Community Support
4 months ago

Hi ELIU,

 

You’re correct, the downloadable file includes all Azure IP ranges, which can make it difficult to determine which ones are specific to Microsoft Fabric.

For Fabric (including Power BI workloads), you don’t need to use the entire list. Instead, focus on the relevant Service Tags in the file, such as:
PowerBI / PowerPlatformPlex – covers Fabric and Power BI service traffic
AzureCloud.<region> (for example, Azure Government regions for government tenants)
Gateway/Data movement-related tags – if you use On-premises Data Gateway


These tags represent the subsets of IPs that Fabric actually uses. Since Fabric doesn’t have a separate IP range list and relies on Azure infrastructure, all ranges are included in one download.

Recommendation:
Whenever possible, use Service Tags instead of static IP ranges, as Microsoft updates them automatically. If you need to whitelist IPs, filter the file for the relevant service tags and update it regularly.

 

Thank you.