Azure-devops-docs: Microsoft hosted agents - what are the IP address ranges

[kinseymd]

Your section above provides the link to download all the IP ranges for Azure hosted services. No where in this json file is the word DevOps or agents.
Specific section in this article: https://docs.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url?view=azure-devops#using-microsoft-hosted-agents
Linked resource: https://www.microsoft.com/en-us/download/details.aspx?id=56519

There is a separate article which actually lists the IP ranges for Azure DevOps. I don't know if this includes Microsoft hosted build agents or not. When I search for specific ranges listed in the article (linked just below), I also see no results in the JSON file. What are the IP ranges for Microsoft hosted build agents? As many customers implement firewall rules to protect their resources in Azure, we need this information to whitelist Azure DevOps build agents (specifically Microsoft hosted)
https://docs.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url?view=azure-devops#azure-devops-ip-addresses

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: dc5a4cfa-aa84-9f0f-55f4-71ec4861c070
• Version Independent ID: d621620a-c924-03b1-8b43-f99c33e58bb8
• Content: Add IP addresses and URLs to allow list - Azure DevOps
• Content Source: docs/organizations/security/allow-list-ip-url.md
• Product: devops
• Technology: devops-security
• GitHub Login: @chcomley
• Microsoft Alias: jominana

[chcomley]

Hi @kinseymd, Thanks for reaching out. I'm following up on this and will be in touch.

[chcomley]

Hi @kinseymd, Our team is working on this and we'll update the article accordingly. In the meantime, please follow these instructions.

There aren't specific ranges for hosted agents since the're dynamic and can change. You need to whitelist the IP address range in the entire geography. We know this isn't ideal - another workaround would be to use self-hosted agents if security is a concern.

I'll be closing this issue, however do let us know if you have any other questions. Thanks!

[Damag3d]

So what do we need to search for in JSON file - can you, please, answer more specifically?

[pjirsa]

Search for the AzureCloud.<regionname> sections. those are the IPs you need to whitelist.

[baoduy]

I think this is a problem as we need to be whitelist the IP of the entire region. The Microsoft Host Agent should be run under a smaller IP Range. Could you please provide the range of Azure DevOps only?