Azure DevOps IP addresses

I have an application running on Web App that needs to communicate with Azure DevOps Microsoft hosted agent. I've set some IP restrictions to deny everything and now in the process of whitelisting agent's IPs. When I read this page it refers to weekly json that contains objects about everything what I need (CIDRs per region). I've parsed the json, added them to my allow list, however the agent's public IP address is not from the range mentioned in the json. The way I checked it was running bash task on the agent to curl icanhazip.com. Does anyone know if the list is complete or should I look somewhere else?

I.e. example in my case:

I use this data (since my ADO org is in West Europe):

{
      "name": "AzureDevOps.WestEurope",
      "id": "AzureDevOps.WestEurope",
      "properties": {
        "changeNumber": 1,
        "region": "westeurope",
        "regionId": 18,
        "platform": "Azure",
        "systemService": "AzureDevOps",
        "addressPrefixes": [
          "40.74.28.0/23"
        ],
        "networkFeatures": null
      }
    }

but the agent initiates connection from the IP: 20.238.71.171, which is not in any of the CIDRs privided by that json file (checked all other regions with ADO).

Any thoughts / help?

You would need to whitelist ALL ranges from, for instance, Azure West Europe. Those are a lot of different IP ranges, as Azure DevOps hosted agents do not have a service Tag.

Since this opens up your firewall to literally every VM running in West Europe, this is usually not really desired, as it is just a bit short of opening up your App to the entire world.

Hence, what people usually do is the following:

1. First task in a build job, fetch the public IP address of the executing build agent, using something like ipfy.org
2. Use AZ CLI to add this IP as a single IP allow rule to your app
3. Do your deployment etc
4. Remove the IP rule again