Unexpected IP Requirement for Azure Analysis Services Trigger from NorthEurope ADF

Question

Unexpected IP Requirement for Azure Analysis Services Trigger from NorthEurope ADF

somyasri 0

I’ve encountered an issue while triggering an Azure Analysis Services refresh from my Azure Data Factory (ADF), both located in the North Europe region.

I've enabled the firewall on the Analysis Service to allow NorthEuropeADF, as that’s the only region from which it should be accessed. Two refresh activities were triggered from the same NorthEurope ADF instance:

One database refreshed successfully.

The second failed with the following error:

Operation on target *** failed: Operation on target Analysis_service failed: { "code": "Unauthorized", "subCode": 0, "message": "An internal error occurred.", "httpStatusCode": 401, "details": [ {"code": "Param2", "message": "<ip>72.145.56.40</ip>"} ] }

When I explicitly added the IP 72.145.56.40 to the firewall, the refresh worked fine.

My question is: Why was this specific IP (72.145.56.40)—associated with NorthEuropeAzureCloud—required now?

Earlier, this same job used to run successfully with only the NorthEuropeADF IPs allowed. But now it is failing for the same.

Kalyani Kondavaradala 405 Reputation points Microsoft External Staff Moderator

2025-07-30T10:05:06.48+00:00

Hello somyasri ,

Thanks for reaching out on Microsoft Q&A!

We understand your concern regarding the need to explicitly add the IP address 72.145.56.40 to the Azure Analysis Services (AAS) firewall.

Root Cause:

Based on our analysis, Azure services like ADF use a dynamic pool of outbound IP addresses that can expand or change over time due to scaling, hardware refresh, or network routing updates. When the AAS firewall was originally configured, it included only the published ADF IP ranges at that moment. The new request originated from a recently allocated North Europe Azure Cloud IP (72.145.56.40) that wasn’t in the existing rules, resulting in the 401 Unauthorized error.

When you enabled the firewall for NorthEuropeADF, you likely included the published set of outbound IPs available at that point. However, Azure may have assigned a new IP address (72.145.56.40) for your recent activity that wasn't part of the originally configured list. This resulted in a 401 Unauthorized error.

By explicitly allowing 72.145.56.40, you ensured that this specific outbound IP could connect to AAS, your issue got resolved.

Although this article focuses on Azure Firewall, it highlights capacity and dynamic infrastructure issues in North Europe, especially in Zone 2.

Might be this is the reason previously you haven't faced any issues regarding specific IP ranges. Please go through this link for more clarity:

Azure Firewall known issues and limitations | Microsoft Learn

Let me know if you require any additional information from our end. If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Thanks,

Kalyani
Kalyani Kondavaradala 405 Reputation points Microsoft External Staff Moderator

2025-07-31T07:41:21.7433333+00:00

Hi somyasri,

Greetings for the day!

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

If the provided information answers your query, do click "Upvote" and "Accept Answer", it will help others who might be facing similar challenges.

Thanks

Kalyani

2 answers

Your answer

Kalyani Kondavaradala 405 Reputation points Microsoft External Staff Moderator

2025-07-30T10:05:06.48+00:00

Hello somyasri ,

Thanks for reaching out on Microsoft Q&A!

We understand your concern regarding the need to explicitly add the IP address 72.145.56.40 to the Azure Analysis Services (AAS) firewall.

Root Cause:

Based on our analysis, Azure services like ADF use a dynamic pool of outbound IP addresses that can expand or change over time due to scaling, hardware refresh, or network routing updates. When the AAS firewall was originally configured, it included only the published ADF IP ranges at that moment. The new request originated from a recently allocated North Europe Azure Cloud IP (72.145.56.40) that wasn’t in the existing rules, resulting in the 401 Unauthorized error.

When you enabled the firewall for NorthEuropeADF, you likely included the published set of outbound IPs available at that point. However, Azure may have assigned a new IP address (72.145.56.40) for your recent activity that wasn't part of the originally configured list. This resulted in a 401 Unauthorized error.

By explicitly allowing 72.145.56.40, you ensured that this specific outbound IP could connect to AAS, your issue got resolved.

Although this article focuses on Azure Firewall, it highlights capacity and dynamic infrastructure issues in North Europe, especially in Zone 2.

Might be this is the reason previously you haven't faced any issues regarding specific IP ranges. Please go through this link for more clarity:

Azure Firewall known issues and limitations | Microsoft Learn

Let me know if you require any additional information from our end. If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Thanks,

Kalyani
Kalyani Kondavaradala 405 Reputation points Microsoft External Staff Moderator

2025-07-31T07:41:21.7433333+00:00

Hi somyasri,

Greetings for the day!

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

If the provided information answers your query, do click "Upvote" and "Accept Answer", it will help others who might be facing similar challenges.

Thanks

Kalyani

Answer 1

somyasri 0

Hi @Kalyani Kondavaradala

Thanks for the detailed explanation.

However, I’d like to highlight that the IP address 72.145.56.40 is not listed in the currently published IP ranges for North Europe ADF.

I double-checked, and this IP seems to be part of the NorthEuropeAzureCloud range, not specifically under the North Europe ADF range.

This is a bit confusing—could you clarify why an IP from NorthEuropeAzureCloud is required to refresh the Analysis Service when the request is triggered from North Europe ADF?

Kalyani Kondavaradala 405 Reputation points Microsoft External Staff Moderator

2025-08-02T04:44:10.03+00:00

Hi somyasri,

Greetings for the day!

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

If the provided information answers your query, do click "Upvote" and "Accept Answer", it will help others who might be facing similar challenges.

Thanks

Kalyani

Answer 2

Hello somyasri,

Greetings for the day!

You’re right that this 72.145.56.40 IP appears to fall under the NorthEuropeAzureCloud range and not specifically under the North Europe ADF range as published. I understand this can be a bit confusing.

Please note that Azure IP ranges are dynamic and subject to change on a weekly basis as part of Microsoft's platform updates. Because of this, relying on static IPs can sometimes lead to unexpected connectivity issues, especially if a new IP is introduced after your last allowlist update.

To avoid such disruptions, we highly recommend using Azure Service Tags (e.g., AzureDataFactory, AzureCloud, etc.) wherever possible. Service Tags are designed to automatically include the correct and updated IP ranges behind Azure services, and they help ensure that your environment stays in sync with Azure’s backend changes.

You can refer to the official Microsoft IP range listing, which is updated every week, using the link below:

https://www.microsoft.com/en-us/download/details.aspx?id=56519

Hope this helps. Let me know if you have any further questions or need additional assistance. Also, if these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members.

Thanks

Kalyani

Kalyani Kondavaradala 405 Reputation points Microsoft External Staff Moderator

2025-08-04T06:37:26.0133333+00:00

Hi somyasri,

Hope you are doing well!

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this.

If the provided information answers your query, do click "Upvote" and "Accept Answer", it will help others who might be facing similar challenges.

Thanks

Kalyani

Share via

Unexpected IP Requirement for Azure Analysis Services Trigger from NorthEurope ADF

2 answers

Your answer