25,191 questions
This doc is the one I would use:
https://www.microsoft.com/en-us/download/details.aspx?id=56519
Establish external/outbound IP address for enterprise app provisioning
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 36%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
JJ Millen
20
Reputation points
I have an enterprise app for which I would like to configure automatic provisioning. The SaaS target (Oracle Fusion ERP) has IP restrictions, so I need to know the outbound IP address (or range) that the enterprise application uses to make the SCIM RestAPI calls so that I can add it to the whitelist.
Unfortunately, RestAPI access logs kept/visible on the SaaS side, so I cannot establish what IP is attempting to connect.
Any advice would be very welcome.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Accepted answer
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator2023-05-31T16:11:57.1233333+00:00 -
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator2023-06-01T18:26:23.6666667+00:00 I wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
-
JJ Millen 20 Reputation points
2023-06-02T10:58:13.2366667+00:00 Thanks for the update @Andy David - MVP . That list is very helpful, but quite long and if I whitelist the whole range, it opens up potential attack vectors.
Is it possible to force an enterprise application to use a static IP address, or to force it to use a private IP address? -
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2023-06-02T11:01:31.5833333+00:00 Not that I am aware of since we have no control where that app lives.
-
JJ Millen 20 Reputation points
2023-06-02T11:43:09.31+00:00 Hi @Andy David - MVP many thanks for your help, I've accepted your answer
Would you know which of the sections in the document you provided relates to Enterprise Apps? I presume it would be the AzureAd section?
ie:"name": "AzureActiveDirectory", "id": "AzureActiveDirectory", "properties": { "changeNumber": 13, "region": "", "regionId": 0, "platform": "Azure", "systemService": "AzureAD", -
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2023-06-02T11:45:32.5933333+00:00 Yes ,I would start there and then monitor the app to ensure its working as expected afterwards
-
JJ Millen 20 Reputation points
2023-06-02T17:10:39.2633333+00:00 Thanks for your help, I can now confirm that the 122 IPv4 address ranges listed under AzureActiveDirectory were added to the access control lists and this enabled the Enterprise App to establish provisioning connectivity.
-
Danny Zollner 10,801 Reputation points Microsoft Employee Moderator2023-06-02T22:48:47.7433333+00:00 Keep in mind that the IP addresses in the AzureActiveDirectory group in the document mentioned here can change - we document the frequency of (potential) updates to the list somewhere. Make sure you're keeping watch on that and update the IP address ranges if needed.
Sign in to comment -