Front Door IP

Question

Is possible to ask Microsoft to give us a range of the IP's for Front Door?

We have some issues with firewalls don't support URL

Microsoft Q&A i found on web :

"Does the anycast IP of my Front Door remain the same throughout its lifetime?

The IP address of your Front Door's frontend anycast is fixed and might not change as long as you use the Front Door. However, the fixed IP address of your Front Door's frontend anycast isn't a guarantee. Avoid relying on the IP directly"

Answer 1

Hello @Solonas Andreou ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to get a range of the IP addresses for Azure Front Door to whitelist them in your Firewall.

As you correctly mentioned,

The IP address of your Front Door's frontend anycast is fixed and might not change as long as you use the Front Door. However, the fixed IP address of your Front Door's frontend anycast isn't a guarantee. Avoid relying on the IP directly.

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq#does-the-anycast-ip-of-my-front-door-remain-the-same-throughout-its-lifetime-

However, you can use the IP address ranges from the Azure Front Door service tags.

Azure Front Door uses three service tags to manage the traffic between your clients and your origins:

• The AzureFrontDoor.Backend service tag contains the IP addresses that Front Door uses to access your origins.
• The AzureFrontDoor.Frontend service tag contains the IP addresses that clients use to reach Front Door. You can apply the AzureFrontDoor.Frontend service tag when you want to control the outbound traffic that can connect to services behind Azure Front Door.
• The AzureFrontDoor.FirstParty service tag is for internal use within Azure.

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq#what-are-the-network-service-tags-that-front-door-supports-

You can use the IP address ranges from AzureFrontDoor.Frontend service tag to whitelist Azure Front Door traffic.

You can download the file containing Azure IP Ranges and Service Tags from the below link:

https://www.microsoft.com/en-us/download/details.aspx?id=56519

NOTE: This file is updated weekly. New ranges appearing in the file will not be used in Azure for at least one week. Please download the new json file every week and perform the necessary changes at your site to correctly identify services running in Azure.

So, you can download the JSON file containing the IP ranges/service tags and search for the service tag named AzureFrontDoor.Frontend to find the IP ranges. But remember to download this file every week and check for any changes in the IP ranges and update them accordingly.

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.