Restrict API access to Atomicwork's IP addresses

When you connect Atomicwork to services in your Microsoft Entra tenant — whether through the Azure AD integration, Microsoft Intune, Microsoft Teams, SharePoint, Sentinel, or any other Entra-based integration — Atomicwork authenticates using app-only client credentials (client ID and client secret) rather than a signed-in user. By default, Microsoft Entra accepts these API calls from any IP address.

We recommend restricting this traffic so that your Entra tenant only accepts API requests from Atomicwork’s static outbound IP addresses. This ensures that even if a client secret were compromised, it could not be used from outside Atomicwork’s infrastructure.

The mechanism for doing this is Conditional Access for workload identities — a policy type in Microsoft Entra that evaluates service principal token requests based on conditions like IP location.

---

Prerequisites

Before setting up IP restrictions, confirm the following:

• Microsoft Entra Workload ID Premium license. Your tenant needs this license to create or modify workload identity policies. Standard Entra ID P1/P2 licenses do not cover this — check with your Microsoft account team if you are unsure whether your tenant has this license.
• Single-tenant app registration. This approach works because the Atomicwork app is registered as a single-tenant application in your directory. Multi-tenant apps and managed identities cannot be targeted with workload identity policies.
• Block access is the only grant control. Workload identity policies do not support “require MFA” or other grant options — the only available control is to block access from locations outside your allowed IP range.

---

Atomicwork’s outbound IP addresses

Add the set that matches your Atomicwork environment. If you are not sure which set applies to your instance, confirm with your Atomicwork CSM before proceeding — using the wrong set will break the integration.

Last verified: November 2026. If these addresses change, Atomicwork will notify affected customers by email in advance.

---

Setup

Step 1: Add Atomicwork’s IPs as a named location

1. In the Microsoft Entra admin center, go to Protection > Conditional Access > Named locations.
2. Select IP ranges location and name it something recognizable, like Atomicwork – outbound IPs.
3. Add the IP addresses for your environment from the table above. Enter each address as a /32 CIDR range (only masks greater than /8 are allowed).
4. Leave Mark as trusted location unchecked — the workload identity policy in Step 3 references this list directly.

Step 2: Find the Atomicwork service principal’s Object ID

1. In the Entra admin center, go to Enterprise applications (not App registrations) and find the Atomicwork app you registered.
2. Open it and copy the Object ID from the Overview tab.

If you have multiple Atomicwork integrations in your tenant (for example, separate app registrations for Azure AD and Intune), repeat this step for each service principal you want to restrict.

Step 3: Create the workload identity policy

1. Go to Protection > Conditional Access > Policies and click New policy.
2. Under Users or workload identities, switch to Workload identities. Under Include, select Select service principals and pick the Atomicwork service principal from Step 2.
3. Under Target resources, select All resources. The policy is already scoped to the Atomicwork app through the service principal selection — it only evaluates when that service principal requests a token.
4. Under Conditions > Locations, set Include to Any location and Exclude to the Atomicwork – outbound IPs named location you created in Step 1.
5. Under Grant, select Block access. Any token request from outside the excluded (allowed) IP range will be blocked.
6. Save the policy as Report-only first.

Step 4: Verify and enable

1. With the policy in Report-only mode, go to Entra ID > Monitoring & health > Sign-in logs > Service principal sign-ins. Check the Conditional Access tab on each entry to confirm that normal Atomicwork sync traffic is not being flagged.
2. Once you have verified that legitimate traffic passes correctly, switch the policy from Report-only to On.

---

FAQ

• Does this affect SAML SSO sign-in? No. Workload identity policies only evaluate service principal token requests (the app’s API calls). User SSO sign-in is a separate flow and is not affected by this policy.
• Can I apply this per-permission instead of to the whole app? No. The policy scopes to the service principal as a whole, not to individual Microsoft Graph permissions.
• What if Atomicwork’s IP addresses change? Atomicwork will email affected customers in advance. You will need to update the named location in Entra with the new addresses.
• Which Atomicwork integrations does this apply to? Any Atomicwork integration that uses a single-tenant app registration in your Entra tenant, including Azure AD. Atomicwork will notify customers as more integrations are confirmed.