IP addresses used by Azure Monitor
Azure Monitor uses a number of IP addresses. Azure Monitor is made up of core platform metrics and log in addition to Log Analytics and Application Insights. You might need to know these addresses if the app or infrastructure that you are monitoring is hosted behind a firewall.
Note
Although these addresses are static, it's possible that we will need to change them from time to time. All Application Insights traffic represents outbound traffic with the exception of availability monitoring and webhooks which require inbound firewall rules.
Tip
You can use Azure network service tags to manage access if you are using Azure Network Security Groups. If you are managing access for hybrid/on premises resources you can download the equivalent IP address lists as JSON files which are updated each week. To cover all the exceptions in this article you would need to use the service tags: ActionGroup, ApplicationInsightsAvailability, and AzureMonitor.
Alternatively, you can subscribe to this page as a RSS feed by adding https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/azure-monitor/app/ip-addresses.md to your favorite RSS/ATOM reader to get notified of the latest changes.
Outgoing ports
You need to open some outgoing ports in your server's firewall to allow the Application Insights SDK and/or Status Monitor to send data to the portal:
| Purpose | URL | IP | Ports |
|---|---|---|---|
| Telemetry | dc.applicationinsights.azure.com dc.applicationinsights.microsoft.com dc.services.visualstudio.com *.in.applicationinsights.azure.com |
443 | |
| Live Metrics Stream | live.applicationinsights.azure.com rt.applicationinsights.microsoft.com rt.services.visualstudio.com |
23.96.28.38 13.92.40.198 40.112.49.101 40.117.80.207 157.55.177.6 104.44.140.84 104.215.81.124 23.100.122.113 |
443 |
Status Monitor
Status Monitor Configuration - needed only when making changes.
| Purpose | URL | IP | Ports |
|---|---|---|---|
| Configuration | management.core.windows.net |
443 |
|
| Configuration | management.azure.com |
443 |
|
| Configuration | login.windows.net |
443 |
|
| Configuration | login.microsoftonline.com |
443 |
|
| Configuration | secure.aadcdn.microsoftonline-p.com |
443 |
|
| Configuration | auth.gfx.ms |
443 |
|
| Configuration | login.live.com |
443 |
|
| Installation | globalcdn.nuget.org, packages.nuget.org ,api.nuget.org/v3/index.json nuget.org, api.nuget.org, dc.services.vsallin.net |
443 |
Availability tests
This is the list of addresses from which availability web tests are run. If you want to run web tests on your app, but your web server is restricted to serving specific clients, then you will have to permit incoming traffic from our availability test servers.
Note
For resources located inside private virtual networks that cannot allow direct inbound communication with the availability test agents in public Azure, the only option is to create and host your own custom availability tests.
Service tag
If you are using Azure Network Security Groups, simply add an inbound port rule to allow traffic from Application Insights availability tests by selecting Service Tag as the Source and ApplicationInsightsAvailability as the Source service tag.
Open ports 80 (http) and 443 (https) for incoming traffic from these addresses (IP addresses are grouped by location):
IP Addresses
If you're looking for the actual IP addresses so you can add them to the list of allowed IP's in your firewall, please download the JSON file describing Azure IP Ranges. These files contain the most up-to-date information. For Azure public cloud, you may also look up the IP address ranges by location using the table below.
After downloading the appropriate file, open it using your favorite text editor and search for "ApplicationInsightsAvailability" to go straight to the section of the file describing the service tag for availability tests.
Note
These addresses are listed using Classless Inter-Domain Routing (CIDR) notation. This means that an entry like 51.144.56.112/28 is equivalent to 16 IPs starting at 51.144.56.112 and ending at 51.144.56.127.
Azure Public Cloud
Download Public Cloud IP addresses.
Azure US Government Cloud
Download Government Cloud IP addresses.
Azure China Cloud
Download China Cloud IP addresses.
Addresses grouped by location (Azure Public Cloud)
Australia East
20.40.124.176/28
Brazil South
191.233.26.176/28
France Central (Formerly France South)
20.40.129.96/28
France Central
20.40.129.32/28
East Asia
52.229.216.48/28
North Europe
52.158.28.64/28
Japan East
52.140.232.160/28
West Europe
51.144.56.96/28
UK South
51.105.9.128/28
UK West
20.40.104.96/28
Southeast Asia
52.139.250.96/28
West US
40.91.82.48/28
Central US
13.86.97.224/28
North Central US
23.100.224.16/28
South Central US
20.45.5.160/28
East US
20.42.35.32/28
Discovery API
You may also want to programmatically retrieve the current list of service tags together with IP address range details.
Application Insights & Log Analytics APIs
| Purpose | URI | IP | Ports |
|---|---|---|---|
| API | api.applicationinsights.ioapi1.applicationinsights.ioapi2.applicationinsights.ioapi3.applicationinsights.ioapi4.applicationinsights.ioapi5.applicationinsights.iodev.applicationinsights.iodev.applicationinsights.microsoft.comdev.aisvc.visualstudio.comwww.applicationinsights.iowww.applicationinsights.microsoft.comwww.aisvc.visualstudio.comapi.loganalytics.io*.api.loganalytics.iodev.loganalytics.iodocs.loganalytics.iowww.loganalytics.io |
20.37.52.188 20.37.53.231 20.36.47.130 20.40.124.0 20.43.99.158 20.43.98.234 13.70.127.61 40.81.58.225 20.40.160.120 23.101.225.155 52.139.8.32 13.88.230.43 52.230.224.237 52.242.230.209 52.173.249.138 52.229.218.221 52.229.225.6 23.100.94.221 52.188.179.229 52.226.151.250 52.150.36.187 40.121.135.131 20.44.73.196 20.41.49.208 40.70.23.205 20.40.137.91 20.40.140.212 40.89.189.61 52.155.118.97 52.156.40.142 23.102.66.132 52.231.111.52 52.231.108.46 52.231.64.72 52.162.87.50 23.100.228.32 40.127.144.141 52.155.162.238 137.116.226.81 52.185.215.171 40.119.4.128 52.171.56.178 20.43.152.45 20.44.192.217 13.67.77.233 51.104.255.249 51.104.252.13 51.143.165.22 13.78.151.158 51.105.248.23 40.74.36.208 40.74.59.40 13.93.233.49 52.247.202.90 |
80,443 |
| Azure Pipeline annotations extension | aigs1.aisvc.visualstudio.com | dynamic | 443 |
Application Insights Analytics
| Purpose | URI | IP | Ports |
|---|---|---|---|
| Analytics Portal | analytics.applicationinsights.io | dynamic | 80,443 |
| CDN | applicationanalytics.azureedge.net | dynamic | 80,443 |
| Media CDN | applicationanalyticsmedia.azureedge.net | dynamic | 80,443 |
Note: *.applicationinsights.io domain is owned by Application Insights team.
Log Analytics Portal
| Purpose | URI | IP | Ports |
|---|---|---|---|
| Portal | portal.loganalytics.io | dynamic | 80,443 |
| CDN | applicationanalytics.azureedge.net | dynamic | 80,443 |
Note: *.loganalytics.io domain is owned by the Log Analytics team.
Application Insights Azure portal Extension
| Purpose | URI | IP | Ports |
|---|---|---|---|
| Application Insights Extension | stamp2.app.insightsportal.visualstudio.com | dynamic | 80,443 |
| Application Insights Extension CDN | insightsportal-prod2-cdn.aisvc.visualstudio.com insightsportal-prod2-asiae-cdn.aisvc.visualstudio.com insightsportal-cdn-aimon.applicationinsights.io |
dynamic | 80,443 |
Application Insights SDKs
| Purpose | URI | IP | Ports |
|---|---|---|---|
| Application Insights JS SDK CDN | az416426.vo.msecnd.net js.monitor.azure.com |
dynamic | 80,443 |
Action Group webhooks
You can query the list of IP addresses used by Action Groups using the Get-AzNetworkServiceTag PowerShell command.
Action Groups Service Tag
Managing changes to Source IP addresses can be quite time consuming. Using Service Tags eliminates the need to update your configuration. A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the IP addresses and automatically updates the service tag as addresses change, eliminating the need to update network security rules for an Action Group.
In the Azure portal under Azure Services search for Network Security Group.
Click on Add and create a Network Security Group.
- Add the Resource Group Name and then enter Instance Details.
- Click on Review + Create and then click Create.
Go to Resource Group and then click on Network Security Group you have created.
- Select Inbound Security Rules.
- Click on Add.
A new window will open in right pane.
- Select Source: Service Tag
- Source Service Tag: ActionGroup
- Click Add.
Profiler
| Purpose | URI | IP | Ports |
|---|---|---|---|
| Agent | agent.azureserviceprofiler.net *.agent.azureserviceprofiler.net |
20.190.60.38 20.190.60.32 52.173.196.230 52.173.196.209 23.102.44.211 23.102.45.216 13.69.51.218 13.69.51.175 138.91.32.98 138.91.37.93 40.121.61.208 40.121.57.2 51.140.60.235 51.140.180.52 52.138.31.112 52.138.31.127 104.211.90.234 104.211.91.254 13.70.124.27 13.75.195.15 52.185.132.101 52.185.132.170 20.188.36.28 40.89.153.171 52.141.22.239 52.141.22.149 102.133.162.233 102.133.161.73 191.232.214.6 191.232.213.239 |
443 |
| Portal | gateway.azureserviceprofiler.net | dynamic | 443 |
| Storage | *.core.windows.net | dynamic | 443 |
Snapshot Debugger
Note
Profiler and Snapshot Debugger share the same set of IP addresses.
| Purpose | URI | IP | Ports |
|---|---|---|---|
| Agent | agent.azureserviceprofiler.net *.agent.azureserviceprofiler.net |
20.190.60.38 20.190.60.32 52.173.196.230 52.173.196.209 23.102.44.211 23.102.45.216 13.69.51.218 13.69.51.175 138.91.32.98 138.91.37.93 40.121.61.208 40.121.57.2 51.140.60.235 51.140.180.52 52.138.31.112 52.138.31.127 104.211.90.234 104.211.91.254 13.70.124.27 13.75.195.15 52.185.132.101 52.185.132.170 20.188.36.28 40.89.153.171 52.141.22.239 52.141.22.149 102.133.162.233 102.133.161.73 191.232.214.6 191.232.213.239 |
443 |
| Portal | gateway.azureserviceprofiler.net | dynamic | 443 |
| Storage | *.core.windows.net | dynamic | 443 |
Povratne informacije
Pošalјite i prikažite povratne informacije za