IP Addresses for Inclusion on Allowlists in Marketing Cloud Intelligence

This table describes which IP addresses must be allowed in the firewall (according to service and environment).

Note PROD-US2 and PROD-EU2 are Azure environments. Some services have two IP addresses that need to be allowed, make sure you allow both IP addresses.

Important Information

• Azure uses Azure Storage Service Endpoints in all subnets to optimize and secure access. When accessing Azure Storage, the traffic comes from Marketing Cloud Intelligence’s internal Azure IP addresses. When using a firewall on the Azure Portal, you can only allow private IP address ranges and VNETS that belong to the same account. One possible workaround for this issue, is to set up an SFTP server in your VNET and have Marketing Cloud Intelligence send reports to that server. See Microsoft Learn: Azure virtual network service endpoints. Another workaround is to run a command in Cloud Shell in the Azure Portal or locally (requires Azure CLI).

  The subnet ID for Azure US is:

  az storage account network-rule add --account-name 
  <inputaccountname> --subnet /subscriptions/009fdd36-efea-4a4a-a0ec-173c31f6122a/resourceGroups/Networking-RG/providers/Microsoft.Network/virtualNetworks/Prod-VNET/subnets/aks-prod-us2-green
   
  az storage account network-rule add --account-name 
  <inputaccountname> --subnet /subscriptions/009fdd36-efea-4a4a-a0ec-173c31f6122a/resourceGroups/Networking-RG/providers/Microsoft.Network/virtualNetworks/Prod-VNET/subnets/aks-prod-us2-blue
  

  Microsoft.Network/virtualNetworks/Prod-IE-VNET/subnets/SF-K8S-EU2-G3-node is the ID of our subnet on Azure EU. The subnet ID for Azure EU is:

  az storage account network-rule add --account-name 
  <inputaccountname> --subnet /subscriptions/a6dcb2d5-c7e2-488d-9187-c8d8e5b68789/resourceGroups/Prod-IE-RG/providers/Microsoft.Network/virtualNetworks/Prod-IE-VNET/subnets/aks-prod-eu2-green
   
  az storage account network-rule add --account-name 
  <inputaccountname> --subnet /subscriptions/a6dcb2d5-c7e2-488d-9187-c8d8e5b68789/resourceGroups/Prod-IE-RG/providers/Microsoft.Network/virtualNetworks/Prod-IE-VNET/subnets/aks-prod-eu2-blue
  
  

• Reserved External IP - If you’re in the Azure environment, allow these IP addresses as well, due to future updates to the Azure IP addresses.
• Marketing Cloud Intelligence relies on a technology called websockets to be enabled in order for the platform to work correctly. Some IT departments restrict communication via websockets, and this can lead to dashboards not loading correctly or at all. To test if websockets are enabled, navigate to https://websocketstest.com/. If for some reason they aren’t working correctly, contact your IT department. If you encounter problems despite websockets being allowed in your environment, then contact Marketing Cloud Intelligence support.
• For Amazon S3 services, when the client's bucket is located in the same region as Marketing Cloud Intelligence’s bucket, the client should whitelist the VPC endpoints instead of the public IP's (as described in the table above). For more information, see Controlling Access from VPC Endpoints with Bucket Policies

  These are the available regions:

  • (AWS US) is in Amazon region us-east-1
  • AWS EU) is in Amazon region eu-central-1