Overview
Microsoft’s public IP space is dominated by AS8075. Azure ranges are organized into ServiceTags (e.g., AzureCloud.eastus, Storage.westeurope, ActionGroup) that customers can reference in Network Security Groups. The full list is published weekly as JSON but Microsoft requires manual download — there is no direct stable URL like AWS provides.
Services on these IPs
Beyond Azure itself, Microsoft IPs also serve: Office 365 (Outlook, Teams, SharePoint), Bing (search + ads), GitHub (since 2018 acquisition, but GitHub publishes its own ranges separately), LinkedIn, Xbox Live, Windows Update. Many Microsoft enterprise products front their endpoints with shared Azure IPs.
How to detect Microsoft Azure IPs
Reverse DNS for Microsoft IPs often returns *.cloudapp.azure.com or *.cloudapp.net for Azure VMs. Office 365 endpoints have predictable PTR patterns. ASN AS8075 is the definitive Microsoft check.
When this matters
Enterprises allowlist specific Office 365 ranges in firewalls (Microsoft publishes these separately as URLs/IPs lists). Security teams track abuse from Azure VM IPs. DevOps uses the JSON in automation to dynamically update firewall rules.
Caveats
Azure has been heavily abused for phishing and command-and-control — Microsoft IPs in security logs require careful triage. Some ranges are shared between consumer (Outlook.com) and enterprise (Office 365); separating them requires the ServiceTag dimension. These sample ranges are well-known Microsoft IPv4 blocks but the full Azure ServiceTags JSON contains thousands of more specific prefixes.