Secure access to the API server using authorized IP address ranges in Azure Kubernetes Service (AKS)

This article shows you how to use API server authorized IP address ranges to limit which IP addresses and CIDRs can access control plane endpoints for your Azure Kubernetes Service (AKS) workloads.

Prerequisites

Azure CLI version 2.0.76 or later. To check your version, run az --version. If you need to install or upgrade, see Install Azure CLI.
The latest version of Azure PowerShell. For installation instructions, see Install Azure PowerShell.
To learn what IP addresses to include when integrating your AKS cluster with Azure DevOps, see Allowed IP addresses and domain URLs.

Tip

In the Azure portal, use Azure Copilot to change the IP addresses that can access your cluster. For more information, see Work with AKS clusters efficiently using Azure Copilot.

Limitations and considerations

AKS supports this feature only with the Standard SKU load balancer. AKS no longer supports the Basic SKU load balancer. If you have an existing cluster that uses the Basic SKU, migrate to the Standard SKU. The migration requires downtime and has additional prerequisites.
You can't use this feature with private clusters.
For clusters that use Node public IPs, each node pool with public IPs must use public IP prefixes. Add those prefixes as authorized ranges.
You can specify up to 200 authorized IP ranges. To go beyond this limit, consider using API Server VNet Integration, which supports up to 2,000 authorized IP ranges.

Overview of API server authorized IP ranges

The Kubernetes API server exposes the underlying Kubernetes APIs. Management tools such as kubectl and the Kubernetes dashboard interact with the cluster through this API server. AKS provides a single-tenant control plane with a dedicated API server and assigns the server a public IP address by default. You can control access by using Kubernetes role-based access control (Kubernetes RBAC) or Azure RBAC.

To secure the otherwise publicly accessible AKS control plane API server, enable authorized IP ranges. Authorized IP ranges allow only defined IP address ranges to communicate with the API server. The API server blocks requests from IP addresses that aren't included in the authorized ranges. The rules can take up to two minutes to propagate. Wait up to two minutes before testing the connection.

Recommended IP ranges to allow

We recommend including the following IP address ranges in your API server authorized IP ranges configuration:

The cluster egress IP address (firewall, NAT gateway, or other address, depending on your outbound type).
The IP address ranges for networks that you use to administer the cluster.

Create an AKS cluster with API server authorized IP ranges enabled

Note

When you enable API server authorized IP ranges during cluster creation, AKS adds the API server public IP and the outbound public IP of the Standard SKU load balancer to the list of authorized IP ranges by default, in addition to any ranges you specify.

Special case - 0.0.0.0/32: The 0.0.0.0/32 placeholder tells AKS to allow only the outbound public IP of the Standard SKU load balancer to access the API server. The placeholder has the following behaviors:

Behavior	Description
Extra client IP ranges	Disables the default behavior of allowing extra client IP ranges.
API server access	Restricts API server access to only the cluster's own outbound IP.
Self-management	Lets the cluster self-manage while blocking external access.

To create a cluster with API server authorized IP ranges enabled, provide a list of authorized public IP address ranges. For a CIDR range, use the network address, which is the first IP address in the range. For example, to allow the range 137.117.106.88 to 137.117.106.95, specify 137.117.106.88/29.

Use the az aks create command with the --api-server-authorized-ip-ranges parameter to create an AKS cluster with API server authorized IP ranges enabled. The following example creates a cluster named myAKSCluster in the resource group named myResourceGroup and allows the IP address range 73.140.245.0/24 to access the API server:

az aks create --resource-group myResourceGroup --name myAKSCluster --vm-set-type VirtualMachineScaleSets --load-balancer-sku standard --api-server-authorized-ip-ranges 73.140.245.0/24 --generate-ssh-keys

Use the New-AzAksCluster cmdlet with the -ApiServerAccessAuthorizedIpRange parameter to create an AKS cluster with API server authorized IP ranges enabled. The following example creates a cluster named myAKSCluster in the resource group named myResourceGroup and allows the IP address range 73.140.245.0/24 to access the API server:

New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -NodeVmSetType VirtualMachineScaleSets -LoadBalancerSku Standard -ApiServerAccessAuthorizedIpRange '73.140.245.0/24' -GenerateSshKey

From the Azure portal home page, select Create a resource > Containers > Azure Kubernetes Service (AKS).
Configure the cluster settings as needed.
In the Networking section under Public access, select Set authorized IP ranges.
For Specify IP ranges, enter the IP address ranges you want to authorize to access the API server.
Configure the rest of the cluster settings as needed.
When you're ready, select Review + create > Create to create the cluster.

Specify outbound IPs for a Standard SKU load balancer using Azure CLI

When you create a cluster with API server authorized IP ranges enabled, you can also specify its outbound IP addresses or prefixes by using the --load-balancer-outbound-ips or --load-balancer-outbound-ip-prefixes parameters. AKS allows these IP addresses in addition to the IP addresses in the --api-server-authorized-ip-ranges parameter.

Use the --load-balancer-outbound-ips parameter to create an AKS cluster with API server authorized IP ranges enabled and specify the outbound IP addresses for the Standard SKU load balancer. The following example creates a cluster named myAKSCluster in the resource group named myResourceGroup, allows 73.140.245.0/24 to access the API server, and specifies two outbound IP addresses for the Standard SKU load balancer. Replace <public-ip-id-1> and <public-ip-id-2> with the resource IDs of your public IP addresses.

az aks create --resource-group myResourceGroup --name myAKSCluster --vm-set-type VirtualMachineScaleSets --load-balancer-sku standard --api-server-authorized-ip-ranges 73.140.245.0/24 --load-balancer-outbound-ips <public-ip-id-1>,<public-ip-id-2> --generate-ssh-keys

Allow only the outbound public IP of the Standard SKU load balancer

Use the --api-server-authorized-ip-ranges parameter to create an AKS cluster that allows only the outbound public IP of the Standard SKU load balancer to access the API server. The following example creates a cluster named myAKSCluster in the resource group named myResourceGroup:

az aks create --resource-group myResourceGroup --name myAKSCluster --vm-set-type VirtualMachineScaleSets --load-balancer-sku standard --api-server-authorized-ip-ranges 0.0.0.0/32 --generate-ssh-keys

Use the -ApiServerAccessAuthorizedIpRange parameter to create an AKS cluster that allows only the outbound public IP of the Standard SKU load balancer to access the API server. The following example creates a cluster named myAKSCluster in the resource group named myResourceGroup:

New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -NodeVmSetType VirtualMachineScaleSets -LoadBalancerSku Standard -ApiServerAccessAuthorizedIpRange '0.0.0.0/32' -GenerateSshKey

From the Azure portal home page, select Create a resource > Containers > Azure Kubernetes Service (AKS).
Configure the cluster settings as needed.
In the Networking section under Public access, select Set authorized IP ranges.
For Specify IP ranges, enter 0.0.0.0/32. This setting allows only the outbound public IP of the Standard SKU load balancer.
Configure the rest of the cluster settings as needed.
When you're ready, select Review + create > Create to create the cluster.

Update the API server authorized IP ranges on an existing cluster

Use the az aks update command with the --api-server-authorized-ip-ranges parameter to update a cluster's API server authorized IP ranges. The following example sets the authorized range to 73.140.245.0/24 for the cluster named myAKSCluster in the resource group named myResourceGroup:

az aks update --resource-group myResourceGroup --name myAKSCluster --api-server-authorized-ip-ranges 73.140.245.0/24

Allow multiple IP address ranges using Azure CLI

To allow multiple IP address ranges, separate them with commas.

Use the az aks update command with the --api-server-authorized-ip-ranges parameter to authorize multiple IP address ranges. The following example updates the cluster named myAKSCluster in the resource group named myResourceGroup:

az aks update --resource-group myResourceGroup --name myAKSCluster --api-server-authorized-ip-ranges 73.140.245.0/24,193.168.1.0/24,194.168.1.0/24

Use the Set-AzAksCluster cmdlet with the -ApiServerAccessAuthorizedIpRange parameter to update a cluster's API server authorized IP ranges. The following example sets the authorized range to 73.140.245.0/24 for the cluster named myAKSCluster in the resource group named myResourceGroup:

Set-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -ApiServerAccessAuthorizedIpRange '73.140.245.0/24'

Navigate to the Azure portal and select the AKS cluster you want to update.
From the service menu, under Settings, select Networking.
Under Resource settings, select Manage.
On the Authorized IP ranges page, update the Authorized IP ranges as needed.
When you're done, select Save.

Disable API server authorized IP ranges on an existing cluster

To disable API server authorized IP ranges, use the az aks update command and specify an empty range "" for the --api-server-authorized-ip-ranges parameter.

az aks update --resource-group myResourceGroup --name myAKSCluster --api-server-authorized-ip-ranges ""

To disable API server authorized IP ranges, use the Set-AzAksCluster cmdlet and specify an empty range '' for the -ApiServerAccessAuthorizedIpRange parameter.

Set-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -ApiServerAccessAuthorizedIpRange ''

Navigate to the Azure portal and select the AKS cluster you want to update.
From the service menu, under Settings, select Networking.
Under Resource settings, select Manage.
On the Authorized IP ranges page, deselect the Set authorized IP ranges checkbox.
Select Save.

Find existing API server authorized IP ranges

To find existing API server authorized IP ranges, use the az aks show command with the --query parameter set to apiServerAccessProfile.authorizedIpRanges.

az aks show --resource-group myResourceGroup --name myAKSCluster --query apiServerAccessProfile.authorizedIpRanges

Example output:

[
    "73.140.245.0/24"
]

To find existing API server authorized IP ranges, use the Get-AzAksCluster cmdlet.

Get-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster | Select-Object -ExpandProperty ApiServerAccessProfile

Example output:

AuthorizedIPRanges: {73.140.245.0/24}
...

Navigate to the Azure portal and select your AKS cluster.
From the service menu, under Settings, select Networking.

The Resource settings section on the Networking page displays the currently configured authorized IP ranges.

Access the API server from your development machine, tooling, or automation

To access the API server from a development machine, tool, or automation system, add its public IP address to the cluster's authorized IP ranges.

Alternatively, configure a jumpbox with the necessary tooling in a separate subnet in the firewall's virtual network, and add the firewall IP addresses to the authorized ranges. If the AKS cluster subnet uses forced tunneling through the firewall, you can instead place that jumpbox in the AKS cluster subnet.

Note

The following example preserves the existing authorized range and adds another IP address. If you omit an existing IP address, the command replaces it with the new range.

Run the following command to retrieve your IP address and set it as an environment variable:

# Retrieve your IP address
CURRENT_IP=$(dig +short "myip.opendns.com" "@resolver1.opendns.com")

Use the az aks update command with the --api-server-authorized-ip-ranges parameter to add your IP address to the authorized ranges. The following example adds your current IP address to the existing ranges on the cluster named myAKSCluster in the resource group named myResourceGroup:
```
az aks update --resource-group myResourceGroup --name myAKSCluster --api-server-authorized-ip-ranges $CURRENT_IP/32,73.140.245.0/24
```

Run the following command to retrieve your IP address and set it as an environment variable:

# Retrieve your IP address
$CURRENT_IP = (Invoke-RestMethod -Uri 'https://ipinfo.io/json').ip

Use the Set-AzAksCluster cmdlet with the -ApiServerAccessAuthorizedIpRange parameter to add your IP address to the authorized ranges. The following example adds your current IP address to the existing ranges on the cluster named myAKSCluster in the resource group named myResourceGroup:
```
Set-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -ApiServerAccessAuthorizedIpRange "$CURRENT_IP/32", '73.140.245.0/24'
```

For another way to identify your IP address, see Find your IP address or search for what is my IP address? in a web browser.

To learn more about security in AKS, see the following articles:

Feedback

Was this page helpful?

Last updated on 2026-08-04