Microsoft Azure IP Ranges
Microsoft Azure is one of the three largest global cloud platforms offering compute, AI, databases, and enterprise services. Azure operates regions on every continent and is widely used by enterprises and government organisations.
- Provider
- Microsoft Azure
- Primary ASN
- AS8075
- Category
- Cloud
- Headquarters
- Redmond, WA, USA
- Announced IPv4 prefixes
- 1159
Known IP ranges
The blocks below are the major address allocations associated with Microsoft Azure. A network of this size deaggregates heavily, so an individual route in the global routing table is usually more specific than the block shown. Prefix sets change over time — use WHOIS Lookup for the authoritative current record for any specific IP.
20.0.0.0/8 (partial)
40.0.0.0/8 (partial)
52.0.0.0/8 (partial)
13.64.0.0/11
104.40.0.0/13
168.62.0.0/19
What does a Microsoft Azure IP mean in a privacy test?
A Microsoft Azure IP as your exit address means your VPN provider hosts servers on Azure infrastructure, or your traffic routes to an Azure-hosted application. Azure IPs appear in VPN tests for providers that lease Azure VMs.
Where Microsoft publishes the Azure IP list
Azure ranges are published as service tags rather than as one flat list. The full set is a weekly JSON download from the Microsoft Download Center — Azure IP Ranges and Service Tags for the Public cloud is download id 56519, with separate files for US Government (57063), Microsoft Azure operated by 21Vianet (57062) and Azure Germany (57064). Every section of the file, such as Storage.WestUS, carries its own changeNumber, and the top-level changeNumber increments whenever any section does, so comparing that single value against your last copy is how Microsoft documents detecting an update.
There is also a Service Tag Discovery API, reachable as az network list-service-tags, Get-AzNetworkServiceTag or the REST equivalent, and it needs an authenticated subscription. Microsoft is explicit that the two sources disagree by design: new service tag data takes up to four weeks to propagate through the API across all regions, so the API returns a subset of what the downloadable file already lists. The operationally useful fact is the grace period — Microsoft states that a newly added address is not used in Azure for at least a week after it appears, which is the window anything tracking these ranges has to catch up.
What the service tag tells you that the ASN does not
Every Azure address looks identical in a WHOIS lookup: AS8075, Microsoft Corporation. The tag is what separates Microsoft's own traffic from a tenant's virtual machine. AzureCloud covers all Azure data centre public addresses and can be narrowed to a region as AzureCloud.westeurope; an address that appears only there is general tenant compute. The specific tags are the ones that name Microsoft as the sender — AzureFrontDoor.Backend is Front Door fetching from an origin, AzureTrafficManager is Traffic Manager probing an endpoint, ActionGroup and AzureMonitor are monitoring, and AzureLoadBalancer resolves to a single host address, 168.63.129.16, that Azure health probes originate from.
Microsoft's own caution about allowlisting is the same point from the other side: permitting AzureCloud inbound admits every other Azure customer along with the service you wanted, because the tag is shared address space and not an identity. An AS8075 address in a log therefore means a machine in a Microsoft data centre; the tag narrows it to a named service or to rented compute; and neither step reaches a person.
Related tools
Frequently asked questions
What IP ranges does Microsoft Azure use?
Azure controls portions of 20.0.0.0/8, 40.0.0.0/8, and 52.0.0.0/8. Microsoft publishes weekly-updated Azure IP Ranges in JSON format through the Microsoft Download Center, broken down by service tag and region.
Why does a Microsoft Azure IP appear in my VPN test?
An Azure IP as your VPN exit means your provider hosts that server on Azure infrastructure. Microsoft allows VPN services on Azure. Check whether your VPN provider discloses which cloud hosts they use.
How do I find the Azure region for an IP?
Use MyIPScan WHOIS Lookup for the registered CIDR block. Microsoft service tags JSON file maps IP ranges to geographic regions and is available through the Microsoft Download Center.
How do I look up a Microsoft Azure IP?
Enter the IP in MyIPScan IP Geolocation Lookup. Azure IPs return AS8075 (Microsoft Corporation) with the registered country and data center location.
What ASN does Microsoft Azure use?
Microsoft uses AS8075 as its primary ASN for Azure and Microsoft services. The AS8075 page on MyIPScan covers the Microsoft network including Azure, Bing, and Teams.