Microsoft Azure uses 55 prefixes for MicrosoftPurviewPolicyDistribution.
Short answer
Microsoft Azure lists these prefixes under “MicrosoftPurviewPolicyDistribution”. Microsoft publishes Azure’s ranges weekly as Service Tags: named groups such as AzureCloud, Storage, Sql or AzureFrontDoor.Frontend, each a list of prefixes. We import the global (non-regional) tags.
Prefixes
What changed
No prefixes added or removed since we started tracking this list. Changes appear here the day after the provider publishes them.
Allowlist formats
nginx (first 5 prefixes)
allow 172.160.223.204/31; allow 172.167.232.192/31; allow 172.173.60.92/30; allow 172.178.158.140/30; allow 172.182.191.80/31; deny all;
iptables (first 5 prefixes)
iptables -A INPUT -s 172.160.223.204/31 -j ACCEPT iptables -A INPUT -s 172.167.232.192/31 -j ACCEPT iptables -A INPUT -s 172.173.60.92/30 -j ACCEPT iptables -A INPUT -s 172.178.158.140/30 -j ACCEPT iptables -A INPUT -s 172.182.191.80/31 -j ACCEPT
Generate the full list from the CSV, and refresh it on a schedule: providers add and retire prefixes often.
Sources
- Microsoft Azure: published IP ranges · checked 5 Nov 2026
- Microsoft Azure documentation