Workload Identity IPs for whitelisting external IDP

Question

Hello :-)

I'd like to use Azure Workload Identity in conjunction with our self-hosted Gitlab instance but I can't find any information what I supposed to whitelist. Apparently here are all IPs available that I would need to expose but I wouldn't know which ones are specific for Workload Identity? If anyone has a pointer to anything that would be awesome!

Thanks,
Carlos

Answer 1

Hello Lehmann, Carlos-MGB ,

Azure Workload Identity does not have a dedicated or separate set of IP addresses that can be whitelisted. The token issuance and federation flow uses the same Microsoft Entra ID (Azure AD) authentication endpoints as other OIDC/SAML-based sign-ins.

If your self‑hosted GitLab instance requires IP-based allowlisting, the supported approach is to whitelist the AzureActiveDirectory service tag. This service tag represents the full set of outbound IP ranges used by Microsoft Entra ID for authentication and token issuance, including workload identity federation.

There is no supported way to narrow this down further to “workload identity only” IPs. Microsoft recommends:

• Using the AzureActiveDirectory service tag
• Keeping the IP list updated (weekly) via the Service Tags JSON or Service Tag Discovery API

If strict IP allowlisting is not feasible, the preferred alternative is to rely on OIDC trust + certificate/issuer validation rather than IP-based filtering.

Hope this helps clarify the expected configuration.