Azure AD SCIM provisioning calls not made from documented CIDR range IP addresses

Question

Our SCIM server is deployed in an environment which is not exposed to public internet (SCIM APIs only accessible internally via company VPN if IPs not whitelisted). For Azure AD SCIM provisioning to work, we have whitelisted the Microsoft Azure CIDR ranges so that calls originating from these IPs will be able to access our SCIM endpoints.

We have picked the CIDR blocks to whitelist from https://learn.microsoft.com/en-us/azure/databricks/administration-guide/users-groups/scim/aad#azure-active-directory-provisioning-service-ip-range-not-accessible

But, we see that calls are made from different IPs which are not in the CIDR range documented (IPs with which calls were made by Azure AD SCIM provisioning are listed below). Due to this, provisioning is failing.

20.190.151.34
20.190.153.36
20.190.155.25
40.126.2.43
40.126.27.34
40.126.4.45

Answer 1

The IP addresses ranges that can be used change over time, and the documentation is updated ahead of time to include those new ranges. In the current JSON file I see the ranges 40.126.0.0/18 and 20.190.128.0/18 in the AzureActiveDirectory tag, and those ranges combined cover all of the IP addresses you listed above.