Establish a connection to Workfront Data Connect

Workfront Data Connect allows you to use your organization’s Workfront data with business intelligence tools or store it in an external data warehouse.

In order connect your Data Connect data lake with an external product, you must first create a connection as described in Create a reader account or connection for Snowflake. Then, you must add any required IPs to the allowlist as described in Add IPs to the allowlist below.

Most products will require the following information about your data lake to establish a connection:

*For information on where to find the Data Connect page containing your connections, see Create a reader account or connection for Snowflake.

Access requirements

Add IPs to the allowlist

Find Azure IP ranges for Microsoft Power BI

Microsoft Power BI traffic to Data Connect doesn’t come from a single fixed address. Microsoft publishes the IP ranges as CIDR blocks in a large JSON file. This section explains how to find the blocks for the regions you actually use.

Official Microsoft source for Azure IP ranges and service tags

Microsoft publishes the list on the Azure IP Ranges and Service Tags – Public Cloud download page. Download the current JSON file (the filename is typically similar to ServiceTags_Public_YYYYMMDD.json). Refresh your allowlist when Microsoft updates this file, or when connectivity issues appear after a Microsoft change.

Power BI vs. Power Query Online

Customers sometimes report “Power BI” when the traffic actually comes from Power Query components that Microsoft treats as a separate Azure service in the service tag list.

If your organization uses both experiences, add CIDR blocks from both PowerBI and PowerQueryOnline for the same regions. If you only add one, some users may still be blocked while others succeed.

Choose regional tags, not the global aggregate

The JSON file contains a single all-regions entry for PowerBI (and similarly for PowerQueryOnline) that aggregates many regions and can contain hundreds of CIDR blocks, plus many smaller regional entries such as PowerBI.WestUS, PowerBI.WestUS2, and PowerBI.WestUS3. Each regional object lists only the prefixes for that region, typically dozens of lines at most. We don’t recommend adding the global entry unless you have a documented requirement to allow every Azure region. For most Data Connect customers, regional entries are the right default. Add the regions where your Power BI tenants and users actually run, plus a small buffer for redundancy (for example, a secondary disaster-recovery region your company uses).

Choose your regions

Microsoft’s region names in the file look like EastUS, WestEurope, GermanyWestCentral, and so on. Use the regions where your Power BI capacity and users are hosted, not where your office is, although they often align.

Find IP ranges and add them to the allowlist

To collect IP ranges from Microsoft and add them to your Workfront allowlist:

For example, if your Microsoft administrator confirms that your Power BI workloads use West US, West US 2, and West US 3, and your users use both Power BI and Power Query Online, you would open six objects: PowerBI.WestUS, PowerBI.WestUS2, PowerBI.WestUS3, and the matching PowerQueryOnline.<Region> for each, then copy addressPrefixes from all six.

JSON structure reference

Each service tag block looks conceptually like the following. Real files include more metadata.

{
  "name": "PowerBI.WestUS2",
  "id": "PowerBI.WestUS2",
  "properties": {
    "region": "westus2",
    "systemService": "PowerBI",
    "addressPrefixes": [
      "203.0.113.0/24",
      "2001:db8::/32"
    ],
    "networkFeatures": ["API", "NSG", "UDR", "FW"]
  }
}

The addressPrefixes array contains the CIDR blocks you’ll add to Workfront. Other fields are for Azure networking scenarios and don’t apply here.

Maintain the allowlist

Remove an IP address from the allowlist

Share data with Business intelligence tools

A number of common business intelligence tools are listed below; visit their documentation sites to learn more about connecting to your data lake.

Store data in an external data warehouse

A number of common data warehouses are listed below; visit their documentation sites to learn more about connecting to your data lake.