IP addresses used by Azure Monitor

Azure Monitor uses a number of IP addresses. Azure Monitor is made up of core platform metrics and log in addition to Log Analytics and Application Insights. You might need to know these addresses if the app or infrastructure that you are monitoring is hosted behind a firewall.

Note

Although these addresses are static, it's possible that we will need to change them from time to time. All Application Insights traffic represents outbound traffic with the exception of availability monitoring and webhooks which require inbound firewall rules.

Tip

You can use Azure network service tags to manage access if you are using Azure Network Security Groups. If you are managing access for hybrid/on premises resources you can download the equivalent IP address lists as JSON files which are updated each week: . To cover all the exceptions in this article you would need to use the service tags: ActionGroup, ApplicationInsightsAvailability, and AzureMonitor.

Alternatively, you can subscribe to this page as a RSS feed by adding https://github.com/MicrosoftDocs/azure-docs/commits/master/articles/azure-monitor/app/ip-addresses.md.atom to your favorite RSS/ATOM reader to get notified of the latest changes.

Outgoing ports

You need to open some outgoing ports in your server's firewall to allow the Application Insights SDK and/or Status Monitor to send data to the portal:

Purpose URL IP Ports
Telemetry dc.applicationinsights.azure.com
dc.applicationinsights.microsoft.com
dc.services.visualstudio.com
*.in.applicationinsights.azure.com
40.114.241.141
104.45.136.42
40.84.189.107
168.63.242.221
52.167.221.184
52.169.64.244
40.85.218.175
104.211.92.54
52.175.198.74
51.140.6.23
40.71.12.231
13.69.65.22
13.78.108.165
13.70.72.233
20.44.8.7
13.86.218.248
40.79.138.41
52.231.18.241
13.75.38.7
102.133.155.50
52.162.110.67
191.233.204.248
13.69.66.140
13.77.52.29
51.107.59.180
40.71.12.235
20.44.8.10
40.71.13.169
13.66.141.156
40.71.13.170
13.69.65.23
20.44.17.0
20.36.114.207
51.116.155.246
51.107.155.178
51.140.212.64
13.86.218.255
20.37.74.240
65.52.250.236
13.69.229.240
52.236.186.210
52.167.107.65
40.71.12.237
40.78.229.32
40.78.229.33
51.105.67.161
40.124.64.192
20.44.12.194
20.189.172.0
13.69.106.208
40.78.253.199
40.78.253.198
40.78.243.19
443
Live Metrics Stream live.applicationinsights.azure.com
rt.applicationinsights.microsoft.com
rt.services.visualstudio.com
23.96.28.38
13.92.40.198
40.112.49.101
40.117.80.207
157.55.177.6
104.44.140.84
104.215.81.124
23.100.122.113
443

Status Monitor

Status Monitor Configuration - needed only when making changes.

Purpose URL IP Ports
Configuration management.core.windows.net 443
Configuration management.azure.com 443
Configuration login.windows.net 443
Configuration login.microsoftonline.com 443
Configuration secure.aadcdn.microsoftonline-p.com 443
Configuration auth.gfx.ms 443
Configuration login.live.com 443
Installation globalcdn.nuget.org, packages.nuget.org ,api.nuget.org/v3/index.json nuget.org, api.nuget.org, dc.services.vsallin.net 443

Availability tests

This is the list of addresses from which availability web tests are run. If you want to run web tests on your app, but your web server is restricted to serving specific clients, then you will have to permit incoming traffic from our availability test servers.

Note

For resources located inside private virtual networks that cannot allow direct inbound communication with the availability test agents in public Azure, the only option is to create and host your own custom availability tests.

Service tag

If you are using Azure Network Security Groups, simply add an inbound port rule to allow traffic from Application Insights availability tests by selecting Service Tag as the Source and ApplicationInsightsAvailability as the Source service tag.

Under settings select Inbound security rules and then select add at the top of the tab

Add inbound security rule tab

Open ports 80 (http) and 443 (https) for incoming traffic from these addresses (IP addresses are grouped by location):

IP Addresses

If you're looking for the actual IP addresses so you can add them to the list of allowed IP's in your firewall, please download the JSON file describing Azure IP Ranges. These files contain the most up-to-date information. For Azure public cloud, you may also look up the IP address ranges by location using the table below.

After downloading the appropriate file, open it using your favorite text editor and search for "ApplicationInsightsAvailability" to go straight to the section of the file describing the service tag for availability tests.

Note

These addresses are listed using Classless Inter-Domain Routing (CIDR) notation. This means that an entry like 51.144.56.112/28 is equivalent to 16 IPs starting at 51.144.56.112 and ending at 51.144.56.127.

Azure Public Cloud

Download Public Cloud IP addresses.

Azure US Government Cloud

Download Government Cloud IP addresses.

Azure China Cloud

Download China Cloud IP addresses.

Addresses grouped by location (Azure Public Cloud)

Australia East
20.40.124.176/28
20.40.124.240/28
20.40.125.80/28

Brazil South
191.233.26.176/28
191.233.26.128/28
191.233.26.64/28

France Central (Formerly France South)
20.40.129.96/28
20.40.129.112/28
20.40.129.128/28
20.40.129.144/28

France Central
20.40.129.32/28
20.40.129.48/28
20.40.129.64/28
20.40.129.80/28

East Asia
52.229.216.48/28
52.229.216.64/28
52.229.216.80/28

North Europe
52.158.28.64/28
52.158.28.80/28
52.158.28.96/28
52.158.28.112/28

Japan East
52.140.232.160/28
52.140.232.176/28
52.140.232.192/28

West Europe
51.144.56.96/28
51.144.56.112/28
51.144.56.128/28
51.144.56.144/28
51.144.56.160/28
51.144.56.176/28

UK South
51.105.9.128/28
51.105.9.144/28
51.105.9.160/28

UK West
20.40.104.96/28
20.40.104.112/28
20.40.104.128/28
20.40.104.144/28

Southeast Asia
52.139.250.96/28
52.139.250.112/28
52.139.250.128/28
52.139.250.144/28

West US
40.91.82.48/28
40.91.82.64/28
40.91.82.80/28
40.91.82.96/28
40.91.82.112/28
40.91.82.128/28

Central US
13.86.97.224/28
13.86.97.240/28
13.86.98.48/28
13.86.98.0/28
13.86.98.16/28
13.86.98.64/28

North Central US
23.100.224.16/28
23.100.224.32/28
23.100.224.48/28
23.100.224.64/28
23.100.224.80/28
23.100.224.96/28
23.100.224.112/28
23.100.225.0/28

South Central US
20.45.5.160/28
20.45.5.176/28
20.45.5.192/28
20.45.5.208/28
20.45.5.224/28
20.45.5.240/28

East US
20.42.35.32/28
20.42.35.64/28
20.42.35.80/28
20.42.35.96/28
20.42.35.112/28
20.42.35.128/28

Discovery API

You may also want to programmatically retrieve the current list of service tags together with IP address range details.

Application Insights & Log Analytics APIs

Purpose URI IP Ports
API api.applicationinsights.io
api1.applicationinsights.io
api2.applicationinsights.io
api3.applicationinsights.io
api4.applicationinsights.io
api5.applicationinsights.io
dev.applicationinsights.io
dev.applicationinsights.microsoft.com
dev.aisvc.visualstudio.com
www.applicationinsights.io
www.applicationinsights.microsoft.com
www.aisvc.visualstudio.com
api.loganalytics.io
*.api.loganalytics.io
dev.loganalytics.io
docs.loganalytics.io
www.loganalytics.io
20.37.52.188
20.37.53.231
20.36.47.130
20.40.124.0
20.43.99.158
20.43.98.234
13.70.127.61
40.81.58.225
20.40.160.120
23.101.225.155
52.139.8.32
13.88.230.43
52.230.224.237
52.242.230.209
52.173.249.138
52.229.218.221
52.229.225.6
23.100.94.221
52.188.179.229
52.226.151.250
52.150.36.187
40.121.135.131
20.44.73.196
20.41.49.208
40.70.23.205
20.40.137.91
20.40.140.212
40.89.189.61
52.155.118.97
52.156.40.142
23.102.66.132
52.231.111.52
52.231.108.46
52.231.64.72
52.162.87.50
23.100.228.32
40.127.144.141
52.155.162.238
137.116.226.81
52.185.215.171
40.119.4.128
52.171.56.178
20.43.152.45
20.44.192.217
13.67.77.233
51.104.255.249
51.104.252.13
51.143.165.22
13.78.151.158
51.105.248.23
40.74.36.208
40.74.59.40
13.93.233.49
52.247.202.90
80,443
Azure Pipeline annotations extension aigs1.aisvc.visualstudio.com dynamic 443

Application Insights Analytics

Purpose URI IP Ports
Analytics Portal analytics.applicationinsights.io dynamic 80,443
CDN applicationanalytics.azureedge.net dynamic 80,443
Media CDN applicationanalyticsmedia.azureedge.net dynamic 80,443

Note: *.applicationinsights.io domain is owned by Application Insights team.

Log Analytics Portal

Purpose URI IP Ports
Portal portal.loganalytics.io dynamic 80,443
CDN applicationanalytics.azureedge.net dynamic 80,443

Note: *.loganalytics.io domain is owned by the Log Analytics team.

Application Insights Azure portal Extension

Purpose URI IP Ports
Application Insights Extension stamp2.app.insightsportal.visualstudio.com dynamic 80,443
Application Insights Extension CDN insightsportal-prod2-cdn.aisvc.visualstudio.com
insightsportal-prod2-asiae-cdn.aisvc.visualstudio.com
insightsportal-cdn-aimon.applicationinsights.io
dynamic 80,443

Application Insights SDKs

Purpose URI IP Ports
Application Insights JS SDK CDN az416426.vo.msecnd.net
js.monitor.azure.com
dynamic 80,443

Action Group webhooks

You can query the list of IP addresses used by Action Groups using the Get-AzNetworkServiceTag PowerShell command.

Action Groups Service Tag

Managing changes to Source IP addresses can be quite time consuming. Using Service Tags eliminates the need to update your configuration. A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the IP addresses and automatically updates the service tag as addresses change, eliminating the need to update network security rules for an Action Group.

  1. In the Azure portal under Azure Services search for Network Security Group.

  2. Click on Add and create a Network Security Group.

    1. Add the Resource Group Name and then enter Instance Details.
    2. Click on Review + Create and then click Create.

    Example on how to create a Network Security Group.

  3. Go to Resource Group and then click on Network Security Group you have created.

    1. Select Inbound Security Rules.
    2. Click on Add.

    Example on how to add a service tag.

  4. A new window will open in right pane.

    1. Select Source: Service Tag
    2. Source Service Tag: ActionGroup
    3. Click Add.

    Example on how to add service tag.

Profiler

Purpose URI IP Ports
Agent agent.azureserviceprofiler.net
*.agent.azureserviceprofiler.net
20.190.60.38
20.190.60.32
52.173.196.230
52.173.196.209
23.102.44.211
23.102.45.216
13.69.51.218
13.69.51.175
138.91.32.98
138.91.37.93
40.121.61.208
40.121.57.2
51.140.60.235
51.140.180.52
52.138.31.112
52.138.31.127
104.211.90.234
104.211.91.254
13.70.124.27
13.75.195.15
52.185.132.101
52.185.132.170
20.188.36.28
40.89.153.171
52.141.22.239
52.141.22.149
102.133.162.233
102.133.161.73
191.232.214.6
191.232.213.239
443
Portal gateway.azureserviceprofiler.net dynamic 443
Storage *.core.windows.net dynamic 443

Snapshot Debugger

Note

Profiler and Snapshot Debugger share the same set of IP addresses.

Purpose URI IP Ports
Agent agent.azureserviceprofiler.net
*.agent.azureserviceprofiler.net
20.190.60.38
20.190.60.32
52.173.196.230
52.173.196.209
23.102.44.211
23.102.45.216
13.69.51.218
13.69.51.175
138.91.32.98
138.91.37.93
40.121.61.208
40.121.57.2
51.140.60.235
51.140.180.52
52.138.31.112
52.138.31.127
104.211.90.234
104.211.91.254
13.70.124.27
13.75.195.15
52.185.132.101
52.185.132.170
20.188.36.28
40.89.153.171
52.141.22.239
52.141.22.149
102.133.162.233
102.133.161.73
191.232.214.6
191.232.213.239
443
Portal gateway.azureserviceprofiler.net dynamic 443
Storage *.core.windows.net dynamic 443