How to allow Defender EASM scans with geoblocking enabled?

Question

How to allow Defender EASM scans with geoblocking enabled?

AMJEN365 5

Hi all,

We’re using Microsoft Defender External Attack Surface Management (EASM) to monitor our external assets. Our public site currently enforces geo-blocking, which prevents most IPs from reaching it.

We’d like Defender EASM’s active scanning probes to still be able to scan our site without relaxing the geo-blocking globally.

Does Microsoft publish a list of IP ranges or service tags used by EASM scanners?

Is there any official method to whitelist Microsoft’s scanning infrastructure or request a European source region?

Any guidance or best practices would be greatly appreciated

Thanks in advance!

Catherine Kyalo 3,180 Reputation points Microsoft Employee

2025-09-29T07:15:31.3666667+00:00

Have you used custom discovery groups to add the public site details that you want EASM to monitor. These can include domains, IP addresses, and other asset types.”

To add assets, go to the EASM portal, select ‘Discovery’, and then create or edit a custom discovery group. Enter the domain or IP address of the asset you want to monitor.”

Refer to: Use and manage discovery in EASM

Please share any error messages or failures you encounter

Your answer

Catherine Kyalo 3,180 Reputation points Microsoft Employee

2025-09-29T07:15:31.3666667+00:00

Have you used custom discovery groups to add the public site details that you want EASM to monitor. These can include domains, IP addresses, and other asset types.”

To add assets, go to the EASM portal, select ‘Discovery’, and then create or edit a custom discovery group. Enter the domain or IP address of the asset you want to monitor.”

Refer to: Use and manage discovery in EASM

Please share any error messages or failures you encounter