topic Re: IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes in Automations

IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes

helton_harada — Sun, 14 Sep 2025 15:49:56 GMT

Our team needs to manage multiple Dynatrace SaaS tenant accounts. To achieve this, there are some workflows across the various tenants, even in other accounts, that make calls to a single central tenant, where central control dashboards exist in this tenant.
When implementing the IP Allow List feature in our tenants, the central tenant started blocking calls from these other managed tenants.
We would like Dynatrace to help us by providing the outbound IP addresses of the various tenants so we can register them on the central tenant's IP Allow List.
How would we obtain these IP addresses?
Note: We sampled workflow executions and found that the outbound IP addresses of the JavaScript runtimes change constantly, not following a standard pattern.

Re: IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes

helton_harada — Sun, 14 Sep 2025 16:13:24 GMT

Note 2: Even though it is counterintuitive, since this is Dynatrace SaaS to Dynatrace SaaS communication and not Dynatrace SaaS to client infrastructure, we tried to configure an on-premises edge connect to accept the "*.dynatrace.com" connection pattern, but Edge Connect did not accept this pattern (perhaps there is a validation with an internal restriction in Dynatrace to use this pattern...)

Re: IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes

helton_harada — Mon, 20 Oct 2025 10:40:59 GMT

Does anyone in Dynatrace could help us to obtain these IP addresses?

Re: IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes

Julius_Loman — Thu, 30 Oct 2025 14:05:50 GMT

@helton_harada there is no way to get a list at the moment. If you need it to be executed from a certain location, use EdgeConnect for that. More on this here.

Re: IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes

helton_harada — Fri, 31 Oct 2025 20:13:35 GMT

Thanks for the reply Julius! Actually, for our use case, it would only be possible to use EdgeConnect if it accepted "*apps.dynatrace.com" as a host pattern in the configuration, because we need to use the remote DQL API. Currently, only "live.dynatrace.com" is accepted in the host pattern configuration in EdgeConnect...it seems there's an internal validation "lock" in the platform...

Re: IP Allow List - SaaS Dynatrace Outgoing IPs from Javascript Runtimes

Julius_Loman — Sun, 02 Nov 2025 17:51:41 GMT

Ah, I see. "A wildcard host pattern must not contain dynatrace.com". Then, unfortuntately, I don't see an easy solution unless you hide your Dynatrace environment under a reverse proxy on a different domain.

I'd recommend reaching out to Dynatrace support as the requirement is quite specific.