How to find Microsoft Purview Autoresolved IR Public IP

Question

I'm trying to use Microsoft Purview's Autoresolved Integration Runtime (IR) to connect to and scan AWS Redshift.

To do this, I need to allow the IP address of the Autoresolved IR in the inbound rules of the Redshift security group on AWS.

I came across this Microsoft article: [https://learn.microsoft.com/en-us/answers/questions/630319/how-can-i-find-my-purviews-public-ip-address(maybe](https://learn.microsoft.com/en-us/answers/questions/630319/how-can-i-find-my-purviews-public-ip-address(maybe)

It suggests using IP ranges from specific service tags.

So I tried allowing the following IP ranges of these service tags in my Redshift security group:

DataFactory.{region}

AzureConnectors.{region}

MicrosoftPurviewPolicyDistribution

However, Purview still can't connect to Redshift using this configuration.

Note: If I temporarily allow all IP addresses, Purview can successfully connect to Redshift. So the issue seems to be that I'm not using the correct public IP(s) for the Autoresolved IR.

My question is:

How can I find the actual public IP addresses used by Microsoft Purview’s Autoresolved IR when it connects to AWS Redshift?

Answer 1

Hi @Chan Ratiyaponpun
Thank you for confirming the steps and sharing your Azure region (Southeast Asia) .

You're absolutely right: currently, Microsoft Purview’s AutoResolve Integration Runtime (IR) does not fall under service tags like DataFactory, AzureConnectors, or MicrosoftPurviewPolicyDistribution. These tags do not cover all outbound traffic used by Purview when connecting to external sources like AWS Redshift.

To securely connect Purview to Redshift without allowing all IPs, the recommended approach is to:

1. Deploy a Self-Hosted Integration Runtime (SHIR)
2. Host it in your own Azure Virtual Network (in Southeast Asia).
3. Route outbound traffic through a NAT Gateway or assign a static public IP.
4. Add that public IP to your AWS Redshift security group (port 5439).
5. This gives you predictable IP control, which is not possible with AutoResolve IR since it's managed and shared across Microsoft tenants.

Further Information:

• Microsoft does not publish a dedicated IP list for Purview AutoResolve IR.
• If you still prefer to use IP whitelisting with AutoResolve IR, you could extract all CIDRs from the Azure IP Ranges JSON for the Southeast Asia region, but this list can change weekly and may still not fully resolve the issue.

References:

https://learn.microsoft.com/en-us/purview/legacy/concept-best-practices-network
https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview

If this is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.

Let me know if you have any further Queries.