Hello @Petr Maslak ,
at this moment, the IoT hub public address is not represented as a fixed IP Address.
Microsoft is offering lists of IP addresses used by the different Azure services and regions, called service tags.
These lists are also slowly changing. Microsoft notifies its clients in advance.
These lists can be downloaded or even disclosed using an API so you can theoretically automate updating the firewalls.
See also this blog post.