IP addresses used by Azure Monitor

Azure Monitor uses several IP addresses. Azure Monitor is made up of core platform metrics and logs in addition to Log Analytics and Application Insights. You might need to know IP addresses if the app or infrastructure that you're monitoring is hosted behind a firewall.


Although these addresses are static, it's possible that we'll need to change them from time to time. All Application Insights traffic represents outbound traffic with the exception of availability monitoring and webhook action groups, which also require inbound firewall rules.

You can use Azure network service tags to manage access if you're using Azure network security groups. If you're managing access for hybrid/on-premises resources, you can download the equivalent IP address lists as JSON files, which are updated each week. To cover all the exceptions in this article, use the service tags ActionGroup, ApplicationInsightsAvailability, and AzureMonitor.


Service tags do not replace validation/authentication checks required for cross-tenant communications between a customer's azure resource and other service tag resources.

Outgoing ports

You need to open some outgoing ports in your server's firewall to allow the Application Insights SDK or Application Insights Agent to send data to the portal.


These addresses are listed by using Classless Interdomain Routing notation. As an example, an entry like is equivalent to 16 IPs that start at and end at

Purpose URL Type IP Ports
Telemetry dc.applicationinsights.azure.com

Live Metrics live.applicationinsights.azure.com


*Example for {region}: westus2



Application Insights ingestion endpoints are IPv4 only.

Application Insights Agent

Application Insights Agent configuration is needed only when you're making changes.

Purpose URL Ports
Configuration management.core.windows.net 443
Configuration management.azure.com 443
Configuration login.windows.net 443
Configuration login.microsoftonline.com 443
Configuration secure.aadcdn.microsoftonline-p.com 443
Configuration auth.gfx.ms 443
Configuration login.live.com 443
Installation globalcdn.nuget.org, packages.nuget.org ,api.nuget.org/v3/index.json nuget.org, api.nuget.org, dc.services.vsallin.net 443

Availability tests

For more information on availability tests, see Private availability testing.

Application Insights and Log Analytics APIs

Purpose URI IP Ports
API api.applicationinsights.io
Azure Pipeline annotations extension aigs1.aisvc.visualstudio.com dynamic 443

Application Insights analytics

Purpose URI IP Ports
Analytics portal analytics.applicationinsights.io dynamic 80,443
CDN applicationanalytics.azureedge.net dynamic 80,443
Media CDN applicationanalyticsmedia.azureedge.net dynamic 80,443

The *.applicationinsights.io domain is owned by the Application Insights team.

Log Analytics portal

Purpose URI IP Ports
Portal portal.loganalytics.io dynamic 80,443
CDN applicationanalytics.azureedge.net dynamic 80,443

The *.loganalytics.io domain is owned by the Log Analytics team.

Application Insights Azure portal extension

Purpose URI IP Ports
Application Insights extension stamp2.app.insightsportal.visualstudio.com dynamic 80,443
Application Insights extension CDN insightsportal-prod2-cdn.aisvc.visualstudio.com
dynamic 80,443

Application Insights SDKs

A diagram illustrating the ingestion flow of telemetry.

Purpose URI IP Ports
Application Insights JS SDK CDN az416426.vo.msecnd.net
dynamic 80,443

A diagram illustrating the ingestion flow of telemetry.

Action group webhooks

You can query the list of IP addresses used by action groups by using the Get-AzNetworkServiceTag PowerShell command.

Action group service tag

Managing changes to source IP addresses can be time consuming. Using service tags eliminates the need to update your configuration. A service tag represents a group of IP address prefixes from a specific Azure service. Microsoft manages the IP addresses and automatically updates the service tag as addresses change, which eliminates the need to update network security rules for an action group.

  1. In the Azure portal under Azure Services, search for Network Security Group.

  2. Select Add and create a network security group:

    1. Add the resource group name, and then enter Instance details information.
    2. Select Review + Create, and then select Create.

    Screenshot that shows how to create a network security group.

  3. Go to Resource Group, and then select the network security group you created:

    1. Select Inbound security rules.
    2. Select Add.

    Screenshot that shows how to add inbound security rules.

  4. A new window opens in the right pane:

    1. Under Source, enter Service Tag.
    2. Under Source service tag, enter ActionGroup.
    3. Select Add.

    Screenshot that shows how to add a service tag.


Purpose URI IP Ports
Agent agent.azureserviceprofiler.net
Portal gateway.azureserviceprofiler.net dynamic 443
Storage *.core.windows.net dynamic 443

Snapshot Debugger


Profiler and Snapshot Debugger share the same set of IP addresses.

Purpose URI IP Ports
Agent agent.azureserviceprofiler.net
Portal gateway.azureserviceprofiler.net dynamic 443
Storage *.core.windows.net dynamic 443

Frequently asked questions

This section provides answers to common questions.

Can I monitor an intranet web server?

Yes, but you need to allow traffic to our services by either firewall exceptions or proxy redirects:

  • QuickPulse https://rt.services.visualstudio.com:443
  • ApplicationIdProvider https://dc.services.visualstudio.com:443
  • TelemetryChannel https://dc.services.visualstudio.com:443

See IP addresses used by Azure Monitor to review our full list of services and IP addresses.

How do I reroute traffic from my server to a gateway on my intranet?

Route traffic from your server to a gateway on your intranet by overwriting endpoints in your configuration. If the Endpoint properties aren't present in your config, these classes use the default values shown in the following ApplicationInsights.config example.

Your gateway should route traffic to our endpoint's base address. In your configuration, replace the default values with http://<your.gateway.address>/<relative path>.

Example ApplicationInsights.config with default endpoints:

    <Add Type="Microsoft.ApplicationInsights.Extensibility.PerfCounterCollector.QuickPulse.QuickPulseTelemetryModule, Microsoft.AI.PerfCounterCollector">
<ApplicationIdProvider Type="Microsoft.ApplicationInsights.Extensibility.Implementation.ApplicationId.ApplicationInsightsApplicationIdProvider, Microsoft.ApplicationInsights">


ApplicationIdProvider is available starting in v2.6.0.