Sign inMonitor a domain
azure · MicrosoftDefenderForEndpoint

Microsoft Azure uses 34 prefixes for MicrosoftDefenderForEndpoint.

Last updated 2 Nov 2026 from Microsoft Azure’s own list (file dated 2026-10-26 (change 424))

Short answer

Microsoft Azure lists these prefixes under “MicrosoftDefenderForEndpoint”. Microsoft publishes Azure’s ranges weekly as Service Tags: named groups such as AzureCloud, Storage, Sql or AzureFrontDoor.Frontend, each a list of prefixes. We import the global (non-regional) tags.

IPv4 prefixes34
IPv6 prefixes0
Regions in the first 100—
Fetched by peekip2 Nov 2026

Prefixes

PrefixRegion / locationService
13.83.125.0/24—MicrosoftDefenderForEndpoint
172.129.100.32/28—MicrosoftDefenderForEndpoint
20.10.127.0/24—MicrosoftDefenderForEndpoint
20.15.141.0/24—MicrosoftDefenderForEndpoint
20.175.2.208/28—MicrosoftDefenderForEndpoint
20.18.4.160/28—MicrosoftDefenderForEndpoint
20.19.31.144/28—MicrosoftDefenderForEndpoint
20.199.204.160/28—MicrosoftDefenderForEndpoint
20.204.195.240/28—MicrosoftDefenderForEndpoint
20.208.150.16/28—MicrosoftDefenderForEndpoint
20.211.228.80/28—MicrosoftDefenderForEndpoint
20.220.2.112/28—MicrosoftDefenderForEndpoint
20.226.211.64/28—MicrosoftDefenderForEndpoint
20.242.181.0/24—MicrosoftDefenderForEndpoint
20.254.173.48/28—MicrosoftDefenderForEndpoint
20.26.63.224/28—MicrosoftDefenderForEndpoint
20.8.195.0/24—MicrosoftDefenderForEndpoint
20.91.149.32/28—MicrosoftDefenderForEndpoint
20.91.96.64/28—MicrosoftDefenderForEndpoint
4.149.115.16/28—MicrosoftDefenderForEndpoint
4.190.130.32/28—MicrosoftDefenderForEndpoint
4.194.226.160/27—MicrosoftDefenderForEndpoint
4.208.13.0/24—MicrosoftDefenderForEndpoint
40.80.103.192/28—MicrosoftDefenderForEndpoint
48.196.155.32/28—MicrosoftDefenderForEndpoint
48.197.152.240/28—MicrosoftDefenderForEndpoint
48.198.197.240/28—MicrosoftDefenderForEndpoint
51.4.226.144/28—MicrosoftDefenderForEndpoint
51.57.176.192/28—MicrosoftDefenderForEndpoint
52.172.85.0/28—MicrosoftDefenderForEndpoint
57.167.188.80/28—MicrosoftDefenderForEndpoint
68.218.120.64/28—MicrosoftDefenderForEndpoint
74.162.53.32/28—MicrosoftDefenderForEndpoint
74.243.77.176/28—MicrosoftDefenderForEndpoint
Showing 34 of 34 prefixes All prefixes (CSV)

What changed

No prefixes added or removed since we started tracking this list. Changes appear here the day after the provider publishes them.

Allowlist formats

nginx (first 5 prefixes)
allow 13.83.125.0/24;
allow 172.129.100.32/28;
allow 20.10.127.0/24;
allow 20.15.141.0/24;
allow 20.175.2.208/28;
deny all;
iptables (first 5 prefixes)
iptables -A INPUT -s 13.83.125.0/24 -j ACCEPT
iptables -A INPUT -s 172.129.100.32/28 -j ACCEPT
iptables -A INPUT -s 20.10.127.0/24 -j ACCEPT
iptables -A INPUT -s 20.15.141.0/24 -j ACCEPT
iptables -A INPUT -s 20.175.2.208/28 -j ACCEPT

Generate the full list from the CSV, and refresh it on a schedule: providers add and retire prefixes often.

Sources

  1. Microsoft Azure: published IP ranges · checked 2 Nov 2026
  2. Microsoft Azure documentation