IP Address whitelisting in Azure Analysis Services for ADF SSIS-IR

Subash Basnayake 61 Reputation points
2023-04-25T09:57:50.5333333+00:00

We have the following simplified resources setup in Azure. There are SSIS pkgs which deploys and processes tabular models .bim files as XMLA scripts to AAS. The Firewall has been enabled in the AAS and the IP address of the SSIS IR is whitelisted.   However the IP address of SSIS IR node accessing the AAS changes frequently and we would like to know how we can white list the range of possible IP addresses, so we don’t have to keep changing the firewall rules. User's image

When the IP address changes we get this error: 2023-03-30T10:17:20.200: Start processing of model 2023-03-30T10:17:20.440: SSIS Error Code DTS_E_OLEDBERROR.  An OLE DB error has occurred. Error code: 0x80004005. An OLE DB record is available.  Source: "Microsoft OLE DB Provider for Analysis Services."  Hresult: 0x80004005  Description: "Resolution of actual cluster endpoint of Azure Analysis Server: 'asazure://northeurope.asazure.windows.net/xxxxxxxx' failed. Response from server: Cannot connect to server 'xxxxxxxx'. Client with IP Address '<ip>xx.xxx.xx.xx</ip>' is not allowed to access the server. To enable access, use the Firewall settings in Azure Management Portal. We checked the ServiceTags_Public20230410.json file also but it doesn't look like the IP we see in the error message belongs to the IP ranges mentioned in this.

"name": "DataFactory.NorthEurope",
      "id": "DataFactory.NorthEurope",
      "properties": {
        "changeNumber": 5,
        "region": "northeurope",
        "regionId": 17,
        "platform": "Azure",
        "systemService": "DataFactory",
        "addressPrefixes": [
          "13.69.230.96/28",
          "13.74.108.224/28",
          "20.38.80.192/26",
          "20.38.82.0/23",
          "20.50.68.56/29",
          "20.223.64.60/32",
          "20.223.65.144/29",
          "52.138.229.32/28",
Azure Analysis Services
Azure Analysis Services
An Azure service that provides an enterprise-grade analytics engine.
439 questions
Azure Data Factory
Azure Data Factory
An Azure service for ingesting, preparing, and transforming data at scale.
9,601 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. BhargavaGunnam-MSFT 26,306 Reputation points Microsoft Employee
    2023-05-02T21:34:05.9+00:00

    Hello Subash Basnayake,

    To whitelist the range of possible IP addresses for your Azure-SSIS IR, you can consider joining your Azure-SSIS IR to a virtual network subnet and then adding the private IP address range of that subnet to the firewall's allowlist for your data source.

    (or) configure a self-hosted IR as a proxy for your Azure-SSIS IR. You can then add the static public IP address of the machine that hosts your self-hosted IR to the firewall's allowlist for your data source.

    https://learn.microsoft.com/en-us/azure/data-factory/self-hosted-integration-runtime-proxy-ssis

    I hope this helps. Please let us know if you have any further questions.

    0 comments