Power Automate – Allow list the Power Platform service tags for flows that use HTTP actions

We are announcing an infrastructure change for how Power Automate cloud flows send outbound HTTP requests in the Europe and United States regions. After this change, requests from the HTTP action, the HTTP + Swagger action, the HTTP Webhook action, and the HTTP Webhook trigger can come from any IP address in the following Azure service tags:

• LogicApps
• PowerPlatformInfra
• PowerPlatformPlex

These changes will occur on the following dates:

• Europe: November 2, 2026
• United States: November 9, 2026

How does this affect me?
We identified flows in your organization that recently used at least one of these actions or triggers in the Europe or United States region. This change affects cloud flows that call a service by using the following actions or trigger:

• HTTP action
• HTTP + Swagger action
• HTTP Webhook action
• HTTP Webhook trigger (the requests that Power Automate sends to your service to subscribe and unsubscribe)

If that service allows only specific IP addresses, and its allow list doesn't include all three service tags, calls to the service may time out or fail. A flow run impacted by this change may display 502 (Bad Gateway) error, or the service's firewall might return 403 (Forbidden).

This change does not affect connector actions and triggers, which keep using the AzureConnectors service tag, or requests that your systems send to a flow's "When an HTTP request is received" trigger.

What action do I need to take?
Please take the following actions to prepare for these changes:

1. Find the services that your flows call with these actions and triggers, and check which of them accept traffic only from approved IP addresses. Include firewalls, gateways and web application firewalls in front of those services.
2. Allow incoming traffic from the LogicApps, PowerPlatformInfra and PowerPlatformPlex service tags:
   • For Azure resources that accept a service tag as the source of an inbound rule, such as network security groups and App Service access restrictions, add the three service tags to those rules.
   • For other firewalls, including Azure Firewall, add the IP address ranges of these service tags from the Azure IP Ranges and Service Tags file or the Service Tag Discovery API. The ranges change over time, so keep them up to date.
3. After you update an allow list, confirm that the flows that call that service still succeed.

If your allow lists already include all three service tags, as described in IP address configuration for Power Automate, no action is required.

For more information about this change, please visit:

• IP address configuration for Power Automate
• Azure service tags overview