The Lobyco APIs sit behind Azure Front Door, Microsoft’s global edge network. Lobyco uses it for availability, latency and security. If your organisation filters traffic by IP address or by geography, the firewall must let the Front Door ranges through, or calls fail. This page says which ranges, where to get them, and how to keep them current. Your network administrator does this.
Front Door has no static or dedicated IP addresses, and its ranges change. A firewall rule with a fixed list that nobody refreshes blocks valid traffic sooner or later.
The address ranges
The addresses are published under the AzureFrontDoor.Frontend service tag in Microsoft’s Azure IP Ranges and Service Tags dataset. Microsoft updates the file weekly. A range that is new in the file is not used in Azure for at least one week. A weekly download therefore keeps you ahead of every change.
Firewalls inside Azure
If your firewall is in Azure, such as a Network Security Group or Azure Firewall, use the service tag instead of the addresses. Reference AzureFrontDoor.Frontend in the rule. Azure then follows Microsoft’s updates for you, and there is nothing to refresh.
Firewalls outside Azure
A firewall outside Azure cannot use service tags. Allow every address in the AzureFrontDoor.Frontend tag explicitly.
Automate it. A script that downloads the dataset and updates the rules should run daily. Then an emergency change from Microsoft is picked up the same day.
Last modified on October 19, 2026
