Azure Monitor endpoint access and firewall configuration

If your monitored application or infrastructure is behind a firewall, you need to configure network access to allow communication with Azure Monitor services.

Azure Monitor uses service tags, which provide a dynamic way to manage network access, especially if you're using Azure network security groups, Azure Firewall, or next generation firewalls (NGFW) that can implement service tags. For hybrid or on-premises resources, or network perimeter controls that don't support service tags, retrieve the equivalent IP address lists programmatically or download them as JSON files. For more information, see Service tags on-premises.

To cover all necessary exceptions, use the service tags ActionGroup, ApplicationInsightsAvailability, and AzureMonitor. Service tags don't replace validation and authentication checks required for cross-tenant communications between a customer's Azure resource and other service tag resources.

Outbound traffic

Each of the following Azure Monitor service sections require outbound traffic rules (destination) unless indicated otherwise. For example, availability monitoring and action group webhooks require inbound firewall rules (source).

Application Insights ingestion

You need to open the following outbound ports in your firewall to allow the Application Insights SDK or Application Insights agent to send data to the portal.

Application Insights agent configuration

Application Insights agent configuration is needed only when you're making changes.

Availability tests

Availability tests require inbound firewall access and are best configured with service tags and custom headers. For more information, see Availability testing behind a firewall.

Logs Query API endpoints

Starting July 1, 2025, Log Analytics enforces TLS 1.2 or higher for secure communication. For more information, see Secure Logs data in transit.

Logs Ingestion API endpoints

Starting March 1, 2026, Logs Ingestion enforces TLS 1.2 or higher for secure communication. For more information, see Secure Logs data in transit.

Application Insights analytics

Log Analytics portal

Application Insights Azure portal extension

Application Insights SDKs (Software Development Kits)

Action group webhooks

Webhooks require inbound network access. Eliminate the need to update firewall and network configurations by using the ActionGroup service tag. Alternatively, you can query the current list of IP addresses used by action groups with the Get-AzNetworkServiceTag PowerShell command or the other Service tags on-premises methods.

Here's an example of an inbound security rule with an ActionGroup service tag:

Application Insights Profiler for .NET

Snapshot Debugger

Frequently asked questions

This section provides answers to common questions.

Can I monitor an intranet web server?

Yes, but you need to allow traffic to our services by either firewall exceptions or proxy redirects.

See IP addresses used by Azure Monitor to review our full list of services and IP addresses.

How do I reroute traffic from my server to a gateway on my intranet?

Route traffic from your server to a gateway on your intranet by overwriting endpoints in your configuration. If the Endpoint properties aren't present in your config, these classes use the default values which are documented in IP addresses used by Azure Monitor.

Your gateway should route traffic to our endpoint's base address. In your configuration, replace the default values with http://<your.gateway.address>/<relative path>.