微软云官方服务的IP段，和用户能开的Azure虚拟机IP段都是相同的ASN吗？

Question

分类应该是Azure，实在是找不到。

我发现自己网站上有很多来自AS8075（微软云）的访问，但这很显然不正常。有些滥用的MJJ用料卡批量薅Azure 200刀优惠开免费VPS作为代理上网，有人还会用它们发动网络攻击。我想按照ASN屏蔽掉来自机房的访问，但是看了下Windows本身，微软的官方服务也在这个ASN上，如果一刀切屏蔽可能会产生问题。

如何区分哪些IP段是微软官方的，哪些是可以分配给其他用户的，从而精准屏蔽用Azure VPS翻墙的流量，而不影响正常使用微软服务？

Answer 1

Hi, There

As your information, I'm totally get it. Blocking all of AS8075 will break legit Microsoft stuff. Here’s the clean, low-drama way to block Azure VPS abuse without hurting real Microsoft services.

• Allow first, then block. Use Microsoft’s official feeds: M365 Endpoints + Azure Service Tags (only the tags you need, e.g., AzureFrontDoor.Backend). Avoid broad tags like AzureCloud.
• Keep Bingbot. Allow only if reverse DNS ends with search.msn.com and forward-resolves back to the same IP.
• Block the rest. Drop AS8075 (and other cloud ASNs) except what’s on your allowlists.
• Optional hardening. Add an IP-intel “hosting/cloud” category block to catch generic VPS/proxy ranges.
• Automate. Nightly job to refresh the M365 + Service Tags JSON and update your firewall/WAF objects.