Which IPs need to be allowed in event hub and key vault firewalls for it to work with change notifications

Question

I am trying to setup change notifications for my application using Microsoft Graph and Event Hubs as described here. I set up Azure Event Hubs authentication using shared access signatures (SAS) through the Azure portal.

However I am having challenges because in order for it to work, I have to set the Networking/Firewall rule to allow public access for all networks on my event hub and key vault.

Is there a way I can allow access to Microsoft Graph on my key vault and event hub without making my Firewall public?

Answer 1

Hi Favour Adesiyan,

Thanks for reaching out to Microsoft!

As per the Microsoft documentation, you can configure the firewall that protects your endpoint to allow inbound connections only from Microsoft Graph, reducing further exposure to invalid change notifications.

Note: The listed IP addresses that are used to deliver change notifications can be updated at any time without notice.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.