Azure Data Factory - IP is not from a specified range

Question

Azure Data Factory - IP is not from a specified range

Ignacy Jakowiecki 6

Hi.

I am trying to whitelist my Azure Data Factory Azure Integration Runtime, but the IPs that it is utilizing do not come from DataFactory.WestEurope service tag, but from AzureCloud.WestEurope. The service I'm trying to connect is using IP whitelisting and the AzureCloud.WestEurope list of IPs is too broad to be whitelisted.

Is this a bug?

Thanks,

Ignacy

Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-17T18:00:00.6633333+00:00

@Ignacy Jakowiecki

Thanks for raising this, what you're experiencing is not a bug but rather a limitation of how Azure Integration Runtime works.

Explanation

When using the default Azure Integration Runtime (IR), especially with AutoResolve or region-specific settings, the outbound traffic can be routed through IP addresses associated with the broader AzureCloud.<region> service tag, rather than the more narrowly scoped DataFactory.<region> tag.

This means it's expected that you may see outbound traffic originating from IPs not covered by the DataFactory.WestEurope range.

Unfortunately, the AzureCloud.WestEurope tag includes a wide range of IPs used by many Azure services, making it less suitable for strict IP whitelisting.

Recommended solutions - To achieve deterministic and restricted IP egress for your scenario, you can consider the following options:

Option 1 - Use a Self-hosted Integration Runtime

Deploy it on-premises or on an Azure VM with a static public IP.
You will have full control over the outbound IP.
Easy to whitelist since the IP is fixed and fully under your control.

For additional information, please refer: Create and configure a self-hosted integration runtime

Option 2 - Use Azure IR with a Managed Virtual Network (Managed VNet)

You can enable a Managed Virtual Network within ADF and route the Azure IR through it.
This setup allows you to assign a static outbound public IP address.
Provides enhanced network isolation and control without managing your own infrastructure.

For additional information, please refer: Azure Data Factory managed virtual network

Conclusion

This is not a bug, but a design behavior of Azure networking. If your external service requires precise and limited IP ranges for whitelisting, we strongly recommend moving to either a Self-hosted IR or Azure IR with Managed VNet.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.
Ignacy Jakowiecki 6 Reputation points

2025-06-17T20:41:32.35+00:00

Hi Chandra,

Thank you for your reply.

If Azure Data Factory is using IPs from outside its service tag, then why is this tag created? Or maybe it serves another purposes?

Option 1 is probably what we will eventually consider, but we want to rule out any other options.

I am curious about option 2, as I do have the Managed VNet enabled in my ADF. Yet, the documentation you sent, nor other docs I was able to find, does not explain how to assign a static outbound public IP address to this Managed VNet. Maybe you can provide some more information about that?

(I know that creating managed private endpoint is a way to do so, but the external service to which I'm trying to connect, is not a supported Azure service).

Thanks
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-17T21:26:43.8466667+00:00
@Ignacy Jakowiecki

Thanks for the thoughtful follow-up, you're asking exactly the right questions.

Why does the DataFactory.<region> service tag exist if outbound traffic uses AzureCloud.<region>?

Great question. The DataFactory.<region> service tag primarily covers control-plane and management traffic, such as:

Authoring operations in the ADF UI

Git integration

Triggering pipelines or webhooks

However, when it comes to data movement (e.g., Copy Activity using Azure IR), outbound traffic may be routed through the broader AzureCloud.<region> range, depending on your setup. This is by design not a bug and it’s a known limitation when using the default Azure IR without additional network controls.

Regarding Option 2 — Managed VNet with Static Outbound IP

Apologies for the inconsistency in the previous response and thank you for pointing it out.

You're absolutely right to call this out. While enabling a Managed Virtual Network in Azure Data Factory provides better isolation and network control, it does not currently support assigning a static outbound public IP address directly.

Important clarification:

Managed Private Endpoints allow secure access to supported Azure services.

But for outbound traffic to external (non-Azure) services, there’s no built-in way today to assign a static public IP for Managed VNet IR.

Feedback:

Appreciate if you could share the feedback on our feedback channel. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

Recommendation

Given your target service is external and not a supported Azure service, your instinct is correct:

Option 1 - Using a Self-hosted Integration Runtime (SHIR) remains the most viable path.

Deploy it on an Azure VM with a static public IP address.

That IP can be reliably whitelisted by your destination system.

For more details, please refer: Create and configure a self-hosted integration runtime

I hope this information helps.
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-18T18:35:09.4933333+00:00

@Ignacy Jakowiecki

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-19T18:29:51.7033333+00:00

@Ignacy Jakowiecki

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Ignacy Jakowiecki 6 Reputation points

2025-06-17T20:41:32.35+00:00

Hi Chandra,

Thank you for your reply.

If Azure Data Factory is using IPs from outside its service tag, then why is this tag created? Or maybe it serves another purposes?

Option 1 is probably what we will eventually consider, but we want to rule out any other options.

I am curious about option 2, as I do have the Managed VNet enabled in my ADF. Yet, the documentation you sent, nor other docs I was able to find, does not explain how to assign a static outbound public IP address to this Managed VNet. Maybe you can provide some more information about that?

(I know that creating managed private endpoint is a way to do so, but the external service to which I'm trying to connect, is not a supported Azure service).

Thanks
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-18T18:35:09.4933333+00:00

@Ignacy Jakowiecki

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 14,510 Reputation points Microsoft External Staff Moderator

2025-06-19T18:29:51.7033333+00:00

@Ignacy Jakowiecki

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Doaa Ali Hamdan AL-Jarwani 255

Recommended Solutions:

1. Use a Managed Virtual Network + Private Endpoint

Enable Managed VNet Integration in ADF.
This allows you to use a private static IP address range and control egress via NAT Gateway.

Requires using Azure Data Factory Premium features.

2. Use a Self-Hosted Integration Runtime

Deploy a Self-hosted IR inside your own VNet or on-prem environment.
You control the IP, so you can easily whitelist it.

Share via

Azure Data Factory - IP is not from a specified range

1 answer

Your answer