Connectors outbound IP addresses

Suppose you have an environment with strict network requirements or firewalls that limit traffic to specific IP addresses. If you use managed connectors or custom connectors in Azure Logic Apps or Microsoft Power Platform, your environment or firewall must allow access for the outbound IP addresses used by these connectors in your datacenter region. Otherwise, requests sent by these connectors won't work.

When you configure firewall access rules, make sure to pay attention to the port numbers. Most connectors work on top of HTTPS protocol and use HTTPS port 443 as the default. However, some connectors might use other port numbers and protocols, such as HTTP, FTP, or SMTP. Review the following recommendations to configure firewall inbound rules as described:

• For the destination (local) port, allow the appropriate port for the network protocol.
• For the source (remote) port, allow ANY/ALL.

The preferred way to obtain the most current up-to-date lists of outbound IP addresses and service tags is to programmatically utilize the Service Tag Discovery API. Alternatively, downloadable lists are available for Azure Public, Azure US Government, Microsoft Azure operated by 21Vianet, and Azure Germany clouds.

Azure Logic Apps

Before you start configuring firewall access rules for Azure Logic Apps, review the following considerations:

• Azure Logic Apps also has inbound and outbound IP addresses that require access. For more information, review Azure Logic Apps - Firewall IP configuration considerations.

• For Azure China 21Vianet, fixed or reserved IP addresses are unavailable for managed connectors and custom connectors in China North and China East regions. However, they are available in China North 2 and China East 2 regions.

• If you have Standard workflows that run in the single-tenant Azure Logic Apps environment, you need the fully qualified domain names (FQDNs) for your connections. For more information, review the corresponding sections in the following articles:

  • Azure portal - Find domain names for firewall access in single-tenant Azure Logic Apps
  • Visual Studio Code - Find domain names for firewall access in single-tenant Azure Logic Apps

• If you create and use security rules, you can reduce complexity by using service tags instead. That way, you don't have to explicitly specify the IP address prefixes for each region. Service tags work across the regions where Azure Logic Apps is available.

• For more information about service tags, see Virtual network service tags.

  The AzureConnectors tag represents the IP address prefixes used by managed connectors to make outbound calls to their respective services. The same service tag also represents IP address prefixes used by some managed connectors to make inbound webhook callbacks to Azure Logic Apps. Each region also has their own AzureConnectors.[region] service tag. You can use the same service tag to include all the IP address prefixes used by managed connectors.

  For example, the following managed connectors make inbound webhook callbacks to Azure Logic Apps: Adobe Creative Cloud, Adobe Sign, Adobe Sign Demo, Adobe Sign Preview, Adobe Sign Stage, Azure Sentinel, Business Central, Calendly, Common Data Service, DocuSign, DocuSign Demo, Dynamics 365 for Fin & Ops, LiveChat, Office 365 Outlook, Outlook.com, Parserr, SAP*, Shifts for Microsoft Teams, Teamwork Projects, and Typeform.

Power Platform

Requests from Power Platform use IP addresses or service tags that depend on the region and the environment in which the app or flow is located. To facilitate Power Platform requests, add the designated IP addresses or service tags in your allow list. For more information about service tags, see Virtual network service tags.