Stable egress IP addresses on Azure (GA)

Use cases

Imagine you need to allow Snowflake UDFs, procedures, or Git integrations to access an external server restricted by a firewall. With stable egress IP addresses, you can retrieve the CIDR ranges to add to your external server or Azure service allowlist.

• Obtain IP ranges in CIDR format to allowlist Snowflake traffic.
• Filter the purpose of each range using the usage field on Azure.
• Automate allowlist refreshes before IPs expire.

How to use

Call the system function to query the available egress IP ranges for your region.

SELECT SYSTEM$GET_SNOWFLAKE_EGRESS_IP_RANGES();

What happens in this code:

1. The function runs without required parameters in your account.
2. Snowflake returns a JSON document containing CIDR blocks, effective dates, and the usage field for Azure environments.

To omit inline comments from the JSON output on Azure, pass the TRUE parameter.

SELECT SYSTEM$GET_SNOWFLAKE_EGRESS_IP_RANGES(TRUE);

What happens in this code:

1. The boolean TRUE parameter is passed to the function.
2. The output is returned cleanly without extra inline comments.

What it returns

Field	Description
ipv4_prefix	The IP range in CIDR format.
effective	The date when the IP range becomes effective.
published	The date Snowflake published the IP range.
expires	The expiration date of the IP range.
usage	An array describing the intended use, such as Stable Egress IP or Network Identifier.

Limitations and requirements

• Generally available (GA) on Azure and AWS Commercial deployments.
• IP addresses expire over time and require periodic updates in your firewall.
• Addresses are scoped to the region and shared among Snowflake accounts in that region.