Due to ongoing security hardening of Microsoft Purview services, the Microsoft Purview Audit Management Activity API will be hosted on a new set of IP addresses which will have a new service tag.
When this will happen:
This change will be in effect on April 21, 2025.
How this will affect your organization:
If your organization followed official M365 endpoint guidance (https://aka.ms/m365endpoints), then no action is necessary, and no impact is expected.
If your organization’s network security policies only allow access to Service tag or allowlisting specific IPs, you will need to make changes to add the new Service tag for continued access.
This new service tag will be shared by multiple Microsoft Security Products to offer various capabilities. The service tag M365ManagementActivityApiWebhook will be unaffected and should continue to be allow listed by your organization.
What you need to do to prepare:
If you currently allow outbound traffic based on Azure service tags, please add the new Azure service tag AzureFrontDoor.MicrosoftSecurity which will be applicable and available by April 21, 2025.
For updated service tag definition, please refer to Download Azure IP Ranges and Service Tags – Public Cloud from Official Microsoft Download Center
For more information about the Microsoft Purview Audit Management Activity API, please refer to Management Activity API reference | Microsoft Learn.
Note: Refer to Microsoft 365 URLs and IP address ranges which outlines M365 network guidance on the supported way to manage domains for M365.