Salesforce Docs Portal

IP Addresses for Inclusion on Allowlists in Marketing Cloud Intelligence

Sometimes you need to set up a data stream via an SQL service provider or an FTPS. If you have a firewall in place, you must allow specific IP addresses to ensure data is retrieved.

This table describes which IP addresses must be allowed in the firewall (according to service and environment).

Note
Note PROD-US2 and PROD-EU2 are Azure environments. Some services have two IP addresses that need to be allowed, make sure you allow both IP addresses.
Service Environment
  PROD - US PROD - US2 PROD - EU PROD - EU2
Python Integration

34.195.192.26

52.0.230.128
Data Import and Data Export Services

54.163.226.11

54.83.10.143

54.227.219.146

20.41.43.59

20.44.73.165

40.65.212.209

35.157.8.65

54.93.174.35

40.67.249.123

52.155.226.154

52.155.230.152
Reserved External IP (see note)  

20.69.195.34

20.69.196.125

20.69.196.152

20.69.196.150

20.69.196.108

  

20.67.202.77

20.67.202.79

20.67.202.98

20.67.202.111

20.67.202.90
VPC S3 Endpoint ID vpce-7e4ef417   vpce-f678ba9f  

Important Information

  • Azure uses Azure Storage Service Endpoints in all subnets to optimize and secure access. When accessing Azure Storage, the traffic comes from Marketing Cloud Intelligence’s internal Azure IP addresses. When using a firewall on the Azure Portal, you can only allow private IP address ranges and VNETS that belong to the same account. One possible workaround for this issue, is to set up an SFTP server in your VNET and have Marketing Cloud Intelligence send reports to that server. See Microsoft Learn: Azure virtual network service endpoints. Another workaround is to run a command in Cloud Shell in the Azure Portal or locally (requires Azure CLI).

    The subnet ID for Azure US is:

    az storage account network-rule add --account-name 
<inputaccountname> --subnet /subscriptions/009fdd36-efea-4a4a-a0ec-173c31f6122a/resourceGroups/Networking-RG/providers/Microsoft.Network/virtualNetworks/Prod-VNET/subnets/aks-prod-us2-green
 
az storage account network-rule add --account-name 
<inputaccountname> --subnet /subscriptions/009fdd36-efea-4a4a-a0ec-173c31f6122a/resourceGroups/Networking-RG/providers/Microsoft.Network/virtualNetworks/Prod-VNET/subnets/aks-prod-us2-blue

    Microsoft.Network/virtualNetworks/Prod-IE-VNET/subnets/SF-K8S-EU2-G3-node is the ID of our subnet on Azure EU. The subnet ID for Azure EU is:

    az storage account network-rule add --account-name 
<inputaccountname> --subnet /subscriptions/a6dcb2d5-c7e2-488d-9187-c8d8e5b68789/resourceGroups/Prod-IE-RG/providers/Microsoft.Network/virtualNetworks/Prod-IE-VNET/subnets/aks-prod-eu2-green
 
az storage account network-rule add --account-name 
<inputaccountname> --subnet /subscriptions/a6dcb2d5-c7e2-488d-9187-c8d8e5b68789/resourceGroups/Prod-IE-RG/providers/Microsoft.Network/virtualNetworks/Prod-IE-VNET/subnets/aks-prod-eu2-blue
  • Reserved External IP - If you’re in the Azure environment, allow these IP addresses as well, due to future updates to the Azure IP addresses.
  • Marketing Cloud Intelligence relies on a technology called websockets to be enabled in order for the platform to work correctly. Some IT departments restrict communication via websockets, and this can lead to dashboards not loading correctly or at all. To test if websockets are enabled, navigate to https://websocketstest.com/. If for some reason they aren’t working correctly, contact your IT department. If you encounter problems despite websockets being allowed in your environment, then contact Marketing Cloud Intelligence support.
  • For Amazon S3 services, when the client's bucket is located in the same region as Marketing Cloud Intelligence’s bucket, the client should whitelist the VPC endpoints instead of the public IP's (as described in the table above). For more information, see Controlling Access from VPC Endpoints with Bucket Policies

    These are the available regions:

    • (AWS US) is in Amazon region us-east-1
    • AWS EU) is in Amazon region eu-central-1