Microsoft IPs detected as vulnerability scanner by Defender for App service

Question

Microsoft IPs detected as vulnerability scanner by Defender for App service

Ed Haynes 20

We are seeing lots of "Vulnerability Scanner Detected" alerts in Defender for Cloud for App service. Most of them are from Microsoft IPs according to the alert details.

Is this expected as part of some Microsoft scanning process or are these likely to be malicious actors using Azure VMs, etc?

Anonymous

2025-04-14T11:22:53.4666667+00:00

Hi Ed Haynes
Use Microsoft's IP Lookup Tool to verify it against the Microsoft IP range to check whether the IPS is actually related to Microsoft and which field/service they are related to.
https://www.microsoft.com/en-us/download/details.aspx?id=56519

Alternatively, defenders for cloud alerts usually show whose information of source IP.

Enable Microsoft defender for app service (if not already), This helps reduce false positivity and provides enlarged danger intelligence information.

Check the frequency, source IPS and type check in alert metadata.

If you watch frequent scanning from IPS that are not part of the internal services of Microsoft, they can occur from external actors.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
if you have any further concerns or queries, please feel free to reach out to us.
Anonymous

2025-04-15T08:58:49.1066667+00:00

Hi Ed Haynes,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ed Haynes 20 Reputation points

2025-04-15T10:49:01.3566667+00:00

Hi @Anonymous ,

Thanks for this, we have Defender for App service enabled and that's where this info is actually coming from, as an example:

Look at the ip range json file it seems to be in the AzureCloud.eastus2 group - which I guess includes customer address space?

Is there anyway for confirm this is an Azure customer or whether it's from Microsoft themselves? Is it safe to block without impacting Azure functionality?
Anonymous

2025-04-15T11:17:48.77+00:00

Hi Ed Haynes,
The IP address is 128.24.45.91 Microsoft Corporation, and Boydton, associated with ASN 8075, resolves Virginia, which is owned by Microsoft.

While checking the Microsoft's IP range JSON (Microsoft IP Ranges and Service Tags - Public Cloud), it belongs to the IP azureCloud.eastus2 tag.

This indicates that IP azure is part of the infrastructure, but it can be used by Microsoft azure customer, not necessarily Microsoft. The defender for app service is correctly picking it up, and it is the expected behavior.

Blocking these IP addresses without proper verification can affect azure functionality, as some of these addresses may be necessary to operate properly for the azure services. To confirm the nature of these IP addresses before taking any action, it is appropriate to consult with azure support or refer to the official Azure documentation.
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/faqs-web-app-security#faqs
https://learn.microsoft.com/en-us/azure/defender-for-cloud/detect-exposed-ip-addresses

if you have any further concerns or queries, please feel free to reach out to us.
Ed Haynes 20 Reputation points

2025-04-15T17:21:55.21+00:00

Hi @Anonymous ,

I can't see any reference in the documentation to Microsoft running vulnerability scans on customer web apps.

Most of the alerts seem to be of type "AppServices_WpScanner" which is scanning for Wordpress pages (these are not Wordpress sites)

Is it safe to assume these are not initiated by Microsoft / Azure itself?

Answer accepted by question author

0 additional answers

Your answer

Anonymous

2025-04-14T11:22:53.4666667+00:00

Hi Ed Haynes
Use Microsoft's IP Lookup Tool to verify it against the Microsoft IP range to check whether the IPS is actually related to Microsoft and which field/service they are related to.
https://www.microsoft.com/en-us/download/details.aspx?id=56519

Alternatively, defenders for cloud alerts usually show whose information of source IP.

Enable Microsoft defender for app service (if not already), This helps reduce false positivity and provides enlarged danger intelligence information.

Check the frequency, source IPS and type check in alert metadata.

If you watch frequent scanning from IPS that are not part of the internal services of Microsoft, they can occur from external actors.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
if you have any further concerns or queries, please feel free to reach out to us.
Anonymous

2025-04-15T08:58:49.1066667+00:00

Hi Ed Haynes,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ed Haynes 20 Reputation points

2025-04-15T10:49:01.3566667+00:00

Hi @Anonymous ,

Thanks for this, we have Defender for App service enabled and that's where this info is actually coming from, as an example:

Look at the ip range json file it seems to be in the AzureCloud.eastus2 group - which I guess includes customer address space?

Is there anyway for confirm this is an Azure customer or whether it's from Microsoft themselves? Is it safe to block without impacting Azure functionality?
Anonymous

2025-04-15T11:17:48.77+00:00

Hi Ed Haynes,
The IP address is 128.24.45.91 Microsoft Corporation, and Boydton, associated with ASN 8075, resolves Virginia, which is owned by Microsoft.

While checking the Microsoft's IP range JSON (Microsoft IP Ranges and Service Tags - Public Cloud), it belongs to the IP azureCloud.eastus2 tag.

This indicates that IP azure is part of the infrastructure, but it can be used by Microsoft azure customer, not necessarily Microsoft. The defender for app service is correctly picking it up, and it is the expected behavior.

Blocking these IP addresses without proper verification can affect azure functionality, as some of these addresses may be necessary to operate properly for the azure services. To confirm the nature of these IP addresses before taking any action, it is appropriate to consult with azure support or refer to the official Azure documentation.
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/faqs-web-app-security#faqs
https://learn.microsoft.com/en-us/azure/defender-for-cloud/detect-exposed-ip-addresses

if you have any further concerns or queries, please feel free to reach out to us.
Ed Haynes 20 Reputation points

2025-04-15T17:21:55.21+00:00

Hi @Anonymous ,

I can't see any reference in the documentation to Microsoft running vulnerability scans on customer web apps.

Most of the alerts seem to be of type "AppServices_WpScanner" which is scanning for Wordpress pages (these are not Wordpress sites)

Is it safe to assume these are not initiated by Microsoft / Azure itself?

Answer 1

Anonymous

Hi Ed Haynes,

These are not part of the essential service closing points of IP Azure (eg Azure Monitor, Key Vault, or Storage)
Blocking it does not affect your own azure functionality until you are to communicate with that specific customer (which is not possible)
They said, because Azure IP is shared, the same IP can be recycled for another customer in the future - so blocking by IP leads to some risk of collateral effect over time.
Block aggressive IP (s) using Firewall or Web App Firewall (WAF) is safe if you believe that IPS engage in malicious/reconnaissance behavior.
If Azure (WAF) is used, consider a custom rule for path scanning efforts (eg, blocking the requests targeting wp-clogin.php, xmlrpc.php, etc.).
Keep a list of scanning IP to seek criminals again and again.
If you have space, automated detection + blocking using defender for cloud or watchdog.
If you want, you can report abuse from Azure-host IPS
https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest

Anonymous

2025-04-17T08:51:58.83+00:00

Hi Ed Haynes,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Ed Haynes 20 Reputation points

2025-04-17T15:23:32.62+00:00

Thanks @Anonymous , that's answered my question.
Anonymous

2025-04-18T08:33:57.07+00:00

Hi Ed Haynes
If the answer is helpful, please click Accept Answer so that other people who faces similar issue may get benefitted from it.

Let me know if you have any further Queries.