|
42 | 42 | * `*.actions.{% data variables.enterprise.data_residency_domain %}` |
43 | 43 | * `*.githubassets.com` |
44 | 44 | * `*.githubusercontent.com` |
45 | | -* `*.blob.core.windows.net` |
| 45 | +* `*.blob.core.windows.net`. If you cannot allow access to wildcard domains, see [Azure Blob Storage hostnames](#azure-blob-storage-hostnames). |
46 | 46 | * `auth.ghe.com` |
47 | 47 |
|
| 48 | +### Azure Blob Storage hostnames |
| 49 | + |
| 50 | +If you cannot allow access to `*.blob.core.windows.net`, use the `/meta` API endpoint for your enterprise to retrieve the complete list of client-facing Azure Blob Storage hostnames. For example, using the {% data variables.product.prodname_cli %}: |
| 51 | + |
| 52 | +```shell |
| 53 | +gh api /meta --hostname octocorp.ghe.com --jq '.domains.storage[]' |
| 54 | +``` |
| 55 | + |
| 56 | +Allow access to every hostname returned in `domains.storage`. The list is specific to your enterprise and {% data variables.product.company_short %} keeps it up to date as network requirements change. |
| 57 | + |
| 58 | +For more information about the `/meta` endpoint, see [AUTOTITLE](/rest/meta/meta#get-github-meta-information). |
| 59 | + |
| 60 | +> [!NOTE] |
| 61 | +> If you stream audit logs to your own Azure Blob Storage destination, you must allow access to that destination separately. |
| 62 | +
|
48 | 63 | ## {% data variables.product.github %}'s IP addresses |
49 | 64 |
|
50 | 65 | {% data variables.product.company_short %}'s IP address ranges for enterprises on {% data variables.enterprise.data_residency_site %} depend on your chosen region. |
@@ -204,41 +219,9 @@ Japan region: |
204 | 219 | * `<TENANT>.ghe.com` |
205 | 220 | * `github.com` |
206 | 221 | * `*.githubusercontent.com` |
207 | | -* `*.blob.core.windows.net` (can be further restricted by region, see below) |
| 222 | +* `*.blob.core.windows.net`. To allow access only to the hostnames used by your enterprise, see [Azure Blob Storage hostnames](#azure-blob-storage-hostnames). |
208 | 223 | * `*.web.core.windows.net` |
209 | 224 |
|
210 | | -#### EU |
211 | | - |
212 | | -`*.blob.core.windows.net` can be replaced with: |
213 | | -* `memoryalphaprodsdc01.blob.core.windows.net` |
214 | | -* `memoryalphaprodweu01.blob.core.windows.net` |
215 | | -* `prodsdc01resultssa0.blob.core.windows.net` |
216 | | -* `prodsdc01resultssa1.blob.core.windows.net` |
217 | | -* `prodsdc01resultssa2.blob.core.windows.net` |
218 | | -* `prodsdc01resultssa3.blob.core.windows.net` |
219 | | -* `prodweu01resultssa0.blob.core.windows.net` |
220 | | -* `prodweu01resultssa1.blob.core.windows.net` |
221 | | -* `prodweu01resultssa2.blob.core.windows.net` |
222 | | -* `prodweu01resultssa3.blob.core.windows.net` |
223 | | - |
224 | | -#### Australia |
225 | | - |
226 | | -`*.blob.core.windows.net` can be replaced with: |
227 | | -* `memoryalphaprodae01.blob.core.windows.net` |
228 | | -* `prodae01resultssa0.blob.core.windows.net` |
229 | | -* `prodae01resultssa1.blob.core.windows.net` |
230 | | -* `prodae01resultssa2.blob.core.windows.net` |
231 | | -* `prodae01resultssa3.blob.core.windows.net` |
232 | | - |
233 | | -#### Japan |
234 | | - |
235 | | -`*.blob.core.windows.net` can be replaced with: |
236 | | -* `memoryalphaprodjpw01.blob.core.windows.net` |
237 | | -* `prodjpw01resultssa0.blob.core.windows.net` |
238 | | -* `prodjpw01resultssa1.blob.core.windows.net` |
239 | | -* `prodjpw01resultssa2.blob.core.windows.net` |
240 | | -* `prodjpw01resultssa3.blob.core.windows.net` |
241 | | - |
242 | 225 | ### OAuth callback URL for connecting an Azure subscription for billing |
243 | 226 |
|
244 | 227 | When you connect or update an Azure subscription for billing, you must allow access to the following URL: |
|
0 commit comments