You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/logic-apps/logic-apps-limits-and-config.md
+34-38Lines changed: 34 additions & 38 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: logic-apps
5
5
ms.suite: integration
6
6
ms.reviewer: rohithah, laveeshb, rarayudu, azla
7
7
ms.topic: reference
8
-
ms.date: 01/23/2023
8
+
ms.date: 03/27/2023
9
9
---
10
10
11
11
# Limits and configuration reference for Azure Logic Apps
@@ -526,32 +526,31 @@ Before you set up your firewall with IP addresses, review these considerations:
526
526
527
527
### Inbound IP addresses
528
528
529
-
For Azure Logic Apps to receive incoming communication through your firewall, you have to allow traffic through the inbound IP addresses described in this section for your logic app's Azure region. If you're using Azure Government, see [Azure Government - Inbound IP addresses](#azure-government-inbound).
530
-
531
-
> [!TIP]
532
-
> To help reduce complexity when you create security rules, you can optionally use the [service tag](../virtual-network/service-tags-overview.md),
533
-
> **LogicAppsManagement**, rather than specify inbound Logic Apps IP address prefixes for each region.
534
-
>
535
-
> Some managed connectors make inbound webhook callbacks to the Azure Logic Apps service. For these managed connectors, you can optionally use the
536
-
> **AzureConnectors** service tag for these managed connectors, rather than specify inbound managed connector IP address prefixes for each region.
537
-
> These tags work across the regions where the Azure Logic Apps service is available.
529
+
For Azure Logic Apps to receive incoming communication through your firewall, you have to allow traffic through the inbound IP addresses described in this section for your logic app's Azure region. To help reduce complexity when you create security rules, you can optionally use the [service tag](../virtual-network/service-tags-overview.md), **LogicAppsManagement**, rather than specify the Azure Logic Apps inbound IP address prefixes for each region. If you're using Azure Government, see [Azure Government - Inbound IP addresses](#azure-government-inbound).
530
+
531
+
> [!NOTE]
532
+
>
533
+
> Some managed connectors make inbound webhook callbacks to Azure Logic Apps. If you use access control on the logic app resource,
534
+
> you must make sure that the calls from these target systems (IP addresses) have permissions to access your logic app. The following
535
+
> connectors make inbound webhook callbacks to Azure Logic Apps:
538
536
>
539
-
> The following connectors make inbound webhook callbacks to the Azure Logic Apps service:
| Brazil South | 191.235.86.199, 191.235.95.229, 191.235.94.220, 191.234.166.198, 20.201.66.147, 20.201.25.72 |
@@ -591,46 +590,46 @@ For Azure Logic Apps to receive incoming communication through your firewall, yo
591
590
| West India | 104.211.164.112, 104.211.165.81, 104.211.164.25, 104.211.157.237 |
592
591
| West US | 52.160.90.237, 138.91.188.137, 13.91.252.184, 157.56.160.212, 104.40.34.112, 52.160.68.27, 13.88.168.158, 104.42.40.164, 13.87.207.79, 13.87.204.210, 168.62.9.100 |
593
592
| West US 2 | 13.66.224.169, 52.183.30.10, 52.183.39.67, 13.66.128.68, 20.99.190.19, 20.72.244.108 |
594
-
| West US 3| 20.150.172.240, 20.150.172.242, 20.150.172.243, 20.150.172.241, 20.106.116.172, 20.106.116.225 |
595
-
|||
593
+
| West US 3 | 20.150.172.240, 20.150.172.242, 20.150.172.243, 20.150.172.241, 20.106.116.172, 20.106.116.225 |
596
594
597
595
<aname="azure-government-inbound"></a>
598
596
599
597
#### Azure Government - Inbound IP addresses
600
598
601
-
| Azure Government region | IP |
602
-
|-------------------------|----|
599
+
| Azure Government region |Azure Logic Apps IP |
600
+
|-------------------------|---------------------|
603
601
| US Gov Arizona | 52.244.67.164, 52.244.67.64, 52.244.66.82 |
604
602
| US Gov Texas | 52.238.119.104, 52.238.112.96, 52.238.119.145 |
605
603
| US Gov Virginia | 52.227.159.157, 52.227.152.90, 23.97.4.36 |
606
604
| US DoD Central | 52.182.49.204, 52.182.52.106 |
607
-
|||
608
605
609
606
<aname="outbound"></a>
610
607
611
608
### Outbound IP addresses
612
609
613
610
For Azure Logic Apps to send outgoing communication through your firewall, you have to allow traffic in your logic app's Azure region for *all the outbound IP addresses* described in this section. If you're using Azure Government, see [Azure Government - Outbound IP addresses](#azure-government-outbound).
614
611
615
-
Also, if your workflow also uses any [managed connectors](../connectors/managed.md), such as the Office 365 Outlook connector or SQL connector, or uses any [custom connectors](/connectors/custom-connectors/), your firewall has to allow traffic in your logic app's Azure region for [*all the managed connector outbound IP addresses*](/connectors/common/outbound-ip-addresses/#azure-logic-apps). If your workflow uses custom connectors that access on-premises resources through the [on-premises data gateway resource in Azure](logic-apps-gateway-connection.md), you need to set up the gateway installation to allow access for the corresponding [*managed connector* outbound IP addresses](/connectors/common/outbound-ip-addresses#azure-logic-apps). For more information about setting up communication settings on the gateway, review these topics:
612
+
> [!TIP]
613
+
>
614
+
> To help reduce complexity when you create security rules, you can optionally use the [service tag](../virtual-network/service-tags-overview.md),
615
+
> **LogicApps**, rather than specify the Azure Logic Apps outbound IP address prefixes for each region. Optionally, you can also use the
616
+
> **AzureConnectors** service tag for managed connectors that make outbound calls to their respective services, such as Azure Storage or
617
+
> Azure Event Hubs, rather than specify the outbound managed connector IP address prefixes for each region. These tags work across the
618
+
> regions where Azure Logic Apps is available.
619
+
620
+
If your workflow also uses any [managed connectors](../connectors/managed.md), such as the Office 365 Outlook connector or SQL connector, or uses any [custom connectors](/connectors/custom-connectors/), your firewall has to allow traffic in your logic app's Azure region for [*all the managed connector outbound IP addresses*](/connectors/common/outbound-ip-addresses/#azure-logic-apps). If your workflow uses custom connectors that access on-premises resources through the [on-premises data gateway resource in Azure](logic-apps-gateway-connection.md), you need to set up the gateway installation to allow access for the corresponding [*managed connector* outbound IP addresses](/connectors/common/outbound-ip-addresses#azure-logic-apps). For more information about setting up communication settings on the gateway, review these topics:
616
621
617
622
*[Adjust communication settings for the on-premises data gateway](/data-integration/gateway/service-gateway-communication)
618
623
*[Configure proxy settings for the on-premises data gateway](/data-integration/gateway/service-gateway-proxy)
619
624
620
-
> [!TIP]
621
-
> To help reduce complexity when you create security rules, you can optionally use the [service tag](../virtual-network/service-tags-overview.md),
622
-
> **LogicApps**, rather than specify outbound Logic Apps IP address prefixes for each region. Optionally, you can also use the **AzureConnectors**
623
-
> service tag for managed connectors that make outbound calls to their respective services, such as Azure Storage or Azure Event Hubs, rather than
624
-
> specify outbound managed connector IP address prefixes for each region. These tags work across the regions where the Azure Logic Apps service is available.
625
-
626
625
<aname="multi-tenant-outbound"></a>
627
626
628
627
#### Multi-tenant - Outbound IP addresses
629
628
630
629
This section lists the outbound IP addresses that Azure Logic Apps requires in your logic app's Azure region to communicate through your firewall. Also, if your workflow uses any managed connectors or custom connectors, your firewall has to allow traffic in your logic app's Azure region for [*all the managed connectors' outbound IP addresses*](/connectors/common/outbound-ip-addresses/#azure-logic-apps). If you have custom connectors that access on-premises resources through the on-premises data gateway resource in Azure, set up your *gateway installation* to allow access for the corresponding managed connector outbound IP addresses.
631
630
632
-
| Region | Logic Apps IP |
633
-
|--------|---------------|
631
+
| Region |Azure Logic Apps IP |
632
+
|--------|---------------------|
634
633
| Australia East | 13.75.149.4, 104.210.91.55, 104.210.90.241, 52.187.227.245, 52.187.226.96, 52.187.231.184, 52.187.229.130, 52.187.226.139, 20.53.93.188, 20.53.72.170, 20.53.107.208, 20.53.106.182 |
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments