You would need to whitelist ALL ranges from, for instance, Azure West Europe. Those are a lot of different IP ranges, as Azure DevOps hosted agents do not have a service Tag.

Since this opens up your firewall to literally every VM running in West Europe, this is usually not really desired, as it is just a bit short of opening up your App to the entire world.

Hence, what people usually do is the following:

1. First task in a build job, fetch the public IP address of the executing build agent, using something like ipfy.org
2. Use AZ CLI to add this IP as a single IP allow rule to your app
3. Do your deployment etc
4. Remove the IP rule again

Answer from silent on stackoverflow.com

You can still record a /32 or /128 for the "but sometimes" cases, the most common cases are going to need the netmask when using the IP in a config template, so having it available without needing a second API call to find the Active Prefix containing the IP is helpful. Better to have and not need than need and not have. You can still query for an IP without the netmask as well, at least for IPv4, to find the right record from tools which may not already know the netmask. — Mark Tinberg ***@***.***> Division of Information Technology-Network Services University of Wisconsin-Madison … ________________________________ From: Brian Candler ***@***.***> Sent: Wednesday, February 23, 2022 3:21 PM To: netbox-community/netbox ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [netbox-community/netbox] Why are subnet masks required for IP Addresses? (Discussion #8731) I have instances in EC2. They have public IPs without a netmask. — Reply to this email directly, view it on GitHub<#8731 (reply in thread)>, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>