Databricks: IP whitelisting issue — 403 Forbidden error during SCIM API calls

Question

Databricks: IP whitelisting issue — 403 Forbidden error during SCIM API calls

Mark Tyson 1

I don't need help white listing IPs.

I need to know which IP ranges to white list so that we don't get these failures in future.

SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-25T11:40:51.3866667+00:00
Hi @Mark Tyson ,

Thank you for reaching out to Microsoft Q&A.

To help identify the correct IP ranges that need to be allowlisted, could you please provide a few additional details about your environment?

Are the SCIM provisioning requests originating from Microsoft Entra ID (Azure AD), or are you using a third-party Identity Provider (such as Okta, Ping, OneLogin, etc.)?

Are the 403 Forbidden responses being returned directly by Azure Databricks, or by an upstream firewall, proxy, WAF, or network security appliance?

Are you using workspace-level or account-level SCIM provisioning?

Are IP Access Lists enabled on the Databricks workspace or account?

If available, could you share a sample error message, request ID, or timestamp of a failed SCIM provisioning attempt (excluding any credentials or tokens)?

The required IP ranges depend on the service originating the SCIM requests. Once we confirm the provisioning source and where the 403 response is generated, we can provide more precise guidance on the IP ranges that should be allowlisted.

I look forward to your update.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-26T08:48:00.31+00:00

Hi @Mark Tyson ,

I hope you are doing well.

This is a gentle follow-up regarding the information requested in my previous message Could you please share the requested details when you have a chance.

This will help us continue our investigation and assist you further.

Thank you for your time and cooperation.
Mark Tyson 1 Reputation point

2026-08-26T10:20:30.41+00:00
Hi Sivasankar,

Yes, Microsoft Entra ID

Direct from Databricks

Account level SCIM provisioning

Yes, access lists are enabled

Here is a sample error message:

"While attempting to validate our authorization to access your application, we received this unexpected response: Received response from Web resource. Resource: https://accounts.azuredatabricks.net/api/2.1/accounts/180e79c8-43d2-40eb-972b-35769d361b9b/scim/v2/Groups?excludedAttributes=members&filter=externalId+eq+"AzureAD_Test-19687637-c67a-42bf-8e77-589e4e327301" Operation: GET Response Status Code: Forbidden Response Headers: strict-transport-security: max-age=31536000; includeSubDomains; preload x-content-type-options: nosniff x-request-id: 2b9f1efa-affc-4775-b959-534bfad9f0a6 x-databricks-reason-phrase: Source IP address: 40.118.35.201 is blocked by Databricks IP ACL for account: 180e79c8-43d2-40eb-972b-35769d361b9b vary: Accept-Encoding alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 server-timing: request_id;dur=0;desc="2b9f1efa-affc-4775-b959-534bfad9f0a6", client_protocol;dur=0;desc="HTTP/1.1" Date: Mon, 17 Aug 2026 05:10:37 GMT Server: databricks Response Content: {"error_code":403,"message":"Source IP address: 40.118.35.201 is blocked by Databricks IP ACL for account: 180e79c8-43d2-40eb-972b-35769d361b9b [ReqId: 2b9f1efa-affc-4775-b959-534bfad9f0a6]"} Please check the service."

So to add more context, we currently have the IP Range 20.190.128.0/18 white listed to allow SCIM provisioning from Azure AD (Entra). I believe this range was identified by seeing which addresses were being blocked, and then white listing the relevant range from the AzureActiveDirectory IP list as defined in this downloadable list: https://www.microsoft.com/en-us/download/details.aspx?id=56519

However, we ideally would like to white list all possible ranges in order to prevent these failures in future if possible.

Thanks
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-26T11:20:04.4166667+00:00

Hi @Mark Tyson

Could you please review the details shared with you in the private chat and provide the requested information at your earliest convenience?

For any future invitations or related requests, kindly share the relevant details through private chat as well. This helps us investigate and assist you more efficiently.

Thank you for your cooperation. We look forward to your response.
Mark Tyson 1 Reputation point

2026-08-26T12:29:05.9266667+00:00

Hi, when you say the personal chat, do you mean you've emailed me directly?

Can you not see that above response?
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-26T12:39:49.8266667+00:00

Hi @Mark Tyson ,

Apologies for the confusion. By “personal chat,” I meant the private message/chat option on the portal, not a direct email.
Yes, I can see the response above. I’ll provide the requested information there so you can review it.
Thank you.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-01T06:33:05.7166667+00:00

Hi @Mark Tyson ,

The 403 Forbidden error indicates that the SCIM request originated from an IP address that is not currently allowed by the Databricks IP access list.

For Microsoft Entra ID (Azure AD) SCIM provisioning, Microsoft does not guarantee that provisioning traffic will always originate from a single fixed IP range. The source IPs can change as the provisioning service scales and evolves.

Therefore, there is no Microsoft-recommended static IP range that can be permanently whitelisted to guarantee future SCIM provisioning traffic.

The recommended approach is to use the official Microsoft Entra ID provisioning service IP ranges and monitor for updates, as Microsoft may add or change addresses over time. If IP filtering is enabled on the Databricks side, all current provisioning service IPs must be allowed.

To identify the specific IP address that was blocked:

Review the Databricks audit logs around the failure time.

Review the Entra ID provisioning logs.

Locate the source IP associated with the failed SCIM request.

Compare it against the currently configured Databricks allowlist.

If the customer is already allowing previously documented provisioning IP ranges and is still seeing failures, this could indicate:

A newly introduced provisioning service IP not yet allowlisted.

An incomplete Databricks IP allowlist configuration.

A network security device blocking the request before it reaches Databricks.

Could you share:

The Databricks workspace region.

The exact 403 error message.

The blocked source IP from the Databricks audit logs.

With that information, we can determine whether the failure was caused by a missing allowlist entry or another network restriction

For any future invitations or related requests, kindly share the relevant details through private chat as well. This helps us investigate and assist you more efficiently.

Thank you for your cooperation. We look forward to your response.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-08T01:13:34.3866667+00:00

Hi @Mark Tyson ,
Thank you for reaching out to the Microsoft Q&A forum.
Just following up on this issue. Could you please share the current status and let us know if you are still experiencing the problem?

Looking forward to your update.

Thanks & Regards,
Microsoft Q&A forum.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-09T08:32:16.9833333+00:00

Hi @Mark Tyson ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.

1 answer

Your answer

SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-25T11:40:51.3866667+00:00

Hi @Mark Tyson ,

Thank you for reaching out to Microsoft Q&A.

To help identify the correct IP ranges that need to be allowlisted, could you please provide a few additional details about your environment?

Are the SCIM provisioning requests originating from Microsoft Entra ID (Azure AD), or are you using a third-party Identity Provider (such as Okta, Ping, OneLogin, etc.)?

Are the 403 Forbidden responses being returned directly by Azure Databricks, or by an upstream firewall, proxy, WAF, or network security appliance?

Are you using workspace-level or account-level SCIM provisioning?

Are IP Access Lists enabled on the Databricks workspace or account?

If available, could you share a sample error message, request ID, or timestamp of a failed SCIM provisioning attempt (excluding any credentials or tokens)?

The required IP ranges depend on the service originating the SCIM requests. Once we confirm the provisioning source and where the 403 response is generated, we can provide more precise guidance on the IP ranges that should be allowlisted.

I look forward to your update.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-26T08:48:00.31+00:00

Hi @Mark Tyson ,

I hope you are doing well.

This is a gentle follow-up regarding the information requested in my previous message Could you please share the requested details when you have a chance.

This will help us continue our investigation and assist you further.

Thank you for your time and cooperation.
Mark Tyson 1 Reputation point

2026-08-26T10:20:30.41+00:00

Hi Sivasankar,

Yes, Microsoft Entra ID

Direct from Databricks

Account level SCIM provisioning

Yes, access lists are enabled

Here is a sample error message:

"While attempting to validate our authorization to access your application, we received this unexpected response: Received response from Web resource. Resource: https://accounts.azuredatabricks.net/api/2.1/accounts/180e79c8-43d2-40eb-972b-35769d361b9b/scim/v2/Groups?excludedAttributes=members&filter=externalId+eq+"AzureAD_Test-19687637-c67a-42bf-8e77-589e4e327301" Operation: GET Response Status Code: Forbidden Response Headers: strict-transport-security: max-age=31536000; includeSubDomains; preload x-content-type-options: nosniff x-request-id: 2b9f1efa-affc-4775-b959-534bfad9f0a6 x-databricks-reason-phrase: Source IP address: 40.118.35.201 is blocked by Databricks IP ACL for account: 180e79c8-43d2-40eb-972b-35769d361b9b vary: Accept-Encoding alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 server-timing: request_id;dur=0;desc="2b9f1efa-affc-4775-b959-534bfad9f0a6", client_protocol;dur=0;desc="HTTP/1.1" Date: Mon, 17 Aug 2026 05:10:37 GMT Server: databricks Response Content: {"error_code":403,"message":"Source IP address: 40.118.35.201 is blocked by Databricks IP ACL for account: 180e79c8-43d2-40eb-972b-35769d361b9b [ReqId: 2b9f1efa-affc-4775-b959-534bfad9f0a6]"} Please check the service."

So to add more context, we currently have the IP Range 20.190.128.0/18 white listed to allow SCIM provisioning from Azure AD (Entra). I believe this range was identified by seeing which addresses were being blocked, and then white listing the relevant range from the AzureActiveDirectory IP list as defined in this downloadable list: https://www.microsoft.com/en-us/download/details.aspx?id=56519

However, we ideally would like to white list all possible ranges in order to prevent these failures in future if possible.

Thanks
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-26T11:20:04.4166667+00:00

Hi @Mark Tyson

Could you please review the details shared with you in the private chat and provide the requested information at your earliest convenience?

For any future invitations or related requests, kindly share the relevant details through private chat as well. This helps us investigate and assist you more efficiently.

Thank you for your cooperation. We look forward to your response.
Mark Tyson 1 Reputation point

2026-08-26T12:29:05.9266667+00:00

Hi, when you say the personal chat, do you mean you've emailed me directly?

Can you not see that above response?
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-26T12:39:49.8266667+00:00

Hi @Mark Tyson ,

Apologies for the confusion. By “personal chat,” I meant the private message/chat option on the portal, not a direct email.
Yes, I can see the response above. I’ll provide the requested information there so you can review it.
Thank you.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-08T01:13:34.3866667+00:00

Hi @Mark Tyson ,
Thank you for reaching out to the Microsoft Q&A forum.
Just following up on this issue. Could you please share the current status and let us know if you are still experiencing the problem?

Looking forward to your update.

Thanks & Regards,
Microsoft Q&A forum.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-09T08:32:16.9833333+00:00

Hi @Mark Tyson ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.

Answer 1

Hi Mark,

For SCIM provisioning from Microsoft Entra ID to Azure Databricks, the source traffic is from the Microsoft Entra ID provisioning service, not from your local network and not from your Databricks workspace cluster IPs.

So the allowlist should include the IP ranges for the Azure service tag:

AzureActiveDirectory

Microsoft’s Azure Databricks SCIM documentation specifically says that when network access is restricted, you must allow traffic from the IP addresses for AzureActiveDirectory in the Azure IP Ranges and Service Tags public cloud file. Databricks also has a KB article for 403 errors during Entra SCIM provisioning that says the same thing: add the Microsoft Entra ID IPs to the Databricks IP access list.

A few notes:

If you are using account-level SCIM, update the account IP access list.
If you are using workspace-level SCIM, update the workspace IP access list.
Do not use Databricks cluster/control-plane IPs for this specific issue; SCIM calls are coming from Entra ID provisioning.
The Azure service tag IP ranges can change, so this should be reviewed/automated rather than added once and forgotten.

Azure Databricks IP access lists apply to web app and REST API access, so they can block SCIM API calls if the Entra provisioning service IPs are not allowed.

So the direct answer is: whitelist the AzureActiveDirectory service tag IP ranges from the official Azure IP Ranges and Service Tags file for the public cloud, and apply them to the correct Databricks account/workspace IP access list depending on which SCIM endpoint you use.