{"meta":{"title":"Network details for GHE.com","intro":"Ensure client systems can access your resources on GHE.com.","product":"Enterprise administrators","breadcrumbs":[{"href":"/en/enterprise-cloud@latest/admin","title":"Enterprise administrators"},{"href":"/en/enterprise-cloud@latest/admin/data-residency","title":"Data residency"},{"href":"/en/enterprise-cloud@latest/admin/data-residency/network-details-for-ghecom","title":"Network details"}],"documentType":"article"},"body":"# Network details for GHE.com\n\nEnsure client systems can access your resources on GHE.com.\n\nTo access your enterprise on GHE.com, client systems must:\n\n* Trust GitHub's SSH key fingerprints\n* Have access to GitHub's hostnames and IP addresses\n\n## GitHub's SSH key fingerprints\n\nTo find these details, use the `/meta` API endpoint for your instance. For example, using the GitHub CLI:\n\n```shell\ngh api /meta --hostname octocorp.ghe.com\n```\n\nFor more information, see [REST API endpoints for meta data](/en/enterprise-cloud@latest/rest/meta/meta).\n\n## Using SSH with GHE.com\n\nTo clone a repository using Git over SSH from `SUBDOMAIN.ghe.com`, where SUBDOMAIN is your enterprise's dedicated subdomain on GHE.com, use the SUBDOMAIN as the SSH username instead of `git`.\n\n```shell\ngit clone SUBDOMAIN@SUBDOMAIN.ghe.com:OWNER/REPO.git\n```\n\n## GitHub's hostnames\n\n* `*.SUBDOMAIN.ghe.com`, where SUBDOMAIN is your enterprise's dedicated subdomain on GHE.com\n* `*.pages.SUBDOMAIN.ghe.com`\n* `*.actions.SUBDOMAIN.ghe.com`\n* `*.githubassets.com`\n* `*.githubusercontent.com`\n* `*.blob.core.windows.net`. If you cannot allow access to wildcard domains, see [Azure Blob Storage hostnames](#azure-blob-storage-hostnames).\n* `auth.ghe.com`\n\n### Azure Blob Storage hostnames\n\nIf you cannot allow access to `*.blob.core.windows.net`, use the `/meta` API endpoint for your enterprise to retrieve the complete list of client-facing Azure Blob Storage hostnames. For example, using the GitHub CLI:\n\n```shell\ngh api /meta --hostname octocorp.ghe.com --jq '.domains.storage[]'\n```\n\nAllow access to every hostname returned in `domains.storage`. The list is specific to your enterprise and GitHub keeps it up to date as network requirements change.\n\nFor more information about the `/meta` endpoint, see [REST API endpoints for meta data](/en/enterprise-cloud@latest/rest/meta/meta#get-github-meta-information).\n\n> \\[!NOTE]\n> If you stream audit logs to your own Azure Blob Storage destination, you must allow access to that destination separately.\n\n## GitHub's IP addresses\n\nGitHub's IP address ranges for enterprises on GHE.com depend on your chosen region.\n\n### The EU\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 108.143.221.96/28         | 108.143.197.176/28         |\n| 20.61.46.32/28            | 20.123.213.96/28           |\n| 20.224.62.160/28          | 20.224.46.144/28           |\n| 51.12.252.16/28           | 20.240.194.240/28          |\n| 74.241.131.48/28          | 20.240.220.192/28          |\n| 20.240.211.176/28         | 20.240.211.208/28          |\n\n### Australia\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 20.5.34.240/28            | 4.237.73.192/28            |\n| 20.5.146.128/28           | 20.5.226.112/28            |\n| 68.218.155.16/28          | 20.248.163.176/28          |\n\n### US\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 20.221.76.128/28          | 74.249.180.192/28          |\n| 135.233.115.208/28        | 48.214.149.96/28           |\n| 20.118.27.192/28          | 172.202.123.176/28         |\n\n### Japan\n\n| Ranges for egress traffic | Ranges for ingress traffic |\n| ------------------------- | -------------------------- |\n| 74.226.88.192/28          | 74.226.88.240/28           |\n| 40.81.180.112/28          | 40.81.176.224/28           |\n| 4.190.169.192/28          | 4.190.169.240/28           |\n\n## GitHub Copilot\n\nMost GitHub Copilot services require access to your enterprise's subdomain on GHE.com and its subdomains. For more information, see [Copilot allowlist reference](/en/enterprise-cloud@latest/copilot/reference/copilot-allowlist-reference#copilot-on-ghecom).\n\n## Supported regions for Azure private networking\n\nGitHub deploys your runners in the same Azure region as the subnet you connect them to. Because of this, your subnet must be in one of the supported regions. If you use Azure private networking for GitHub-hosted runners, the supported Azure regions on GHE.com differ from those on GitHub.com.\n\n### Supported regions in the EU\n\n| Runner type | Supported regions                                                     |\n| ----------- | --------------------------------------------------------------------- |\n| x64         | `francecentral`, `swedencentral`, `germanywestcentral`, `northeurope` |\n| arm64       | `francecentral`, `northeurope`, `germanywestcentral`                  |\n| GPU         | `italynorth`, `swedencentral`                                         |\n\n### Supported regions in Australia\n\n| Runner type | Supported regions                   |\n| ----------- | ----------------------------------- |\n| x64         | `australiaeast`, `australiacentral` |\n| arm64       | `australiaeast`, `australiacentral` |\n| GPU         | `australiaeast`, `australiacentral` |\n\n### Supported regions in the US\n\n| Runner type | Supported regions                 |\n| ----------- | --------------------------------- |\n| x64         | `centralus`, `eastus2`, `westus3` |\n| arm64       | `centralus`, `eastus2`, `westus3` |\n| GPU         | `centralus`, `eastus2`, `westus3` |\n\n### Supported regions in Japan\n\n| Runner type | Supported regions        |\n| ----------- | ------------------------ |\n| x64         | `japaneast`, `japanwest` |\n| arm64       | `japaneast`, `japanwest` |\n| GPU         | `japaneast`              |\n\n### IP ranges for Azure private networking\n\n#### EU\n\nActions IPs:\n\n* 74.241.192.231\n* 20.4.161.108\n* 74.241.204.117\n* 20.31.193.160\n\nEU region:\n\n* 108.143.197.176/28\n* 108.143.197.160/28\n* 20.123.213.96/28\n* 20.123.214.144/28\n* 20.224.46.144/28\n* 20.224.46.160/28\n* 20.240.194.240/28\n* 20.240.194.224/28\n* 20.240.220.192/28\n* 20.240.220.176/28\n* 20.240.211.208/28\n* 20.240.211.224/28\n\n#### Australia\n\nActions IPs:\n\n* 4.147.140.77\n* 20.53.114.78\n\nAustralia region:\n\n* 4.237.73.144/28\n* 4.237.73.192/28\n* 20.5.226.96/28\n* 20.5.226.112/28\n* 20.248.163.160/28\n* 20.248.163.176/28\n\n#### Japan\n\nActions IPs:\n\n* 20.63.233.164\n* 172.192.153.164\n\nJapan region:\n\n* 74.226.88.240/28\n* 74.226.88.224/28\n* 40.81.176.224/28\n* 40.81.178.160/28\n* 4.190.169.240/28\n* 4.190.170.0/28\n\n#### Required for all regions\n\n* `Storage` service tag\n* Communication requirements for github.com\n  * 192.30.252.0/22\n  * 185.199.108.0/22\n  * 140.82.112.0/20\n  * 143.55.64.0/20\n  * 20.201.28.151/32\n  * 20.205.243.166/32\n  * 20.87.245.0/32\n  * 4.237.22.38/32\n  * 20.207.73.82/32\n  * 20.27.177.113/32\n  * 20.200.245.247/32\n  * 20.175.192.147/32\n  * 20.233.83.145/32\n  * 20.29.134.23/32\n  * 20.199.39.232/32\n  * 20.217.135.5/32\n  * 4.225.11.198/32\n  * 4.208.26.197/32\n  * 20.26.156.215/32\n\n### Domains for Azure private networking\n\n#### Required for all regions\n\n* `*.<TENANT>.ghe.com`\n* `<TENANT>.ghe.com`\n* `github.com`\n* `*.githubusercontent.com`\n* `*.blob.core.windows.net`. To allow access only to the hostnames used by your enterprise, see [Azure Blob Storage hostnames](#azure-blob-storage-hostnames).\n* `*.web.core.windows.net`\n\n### OAuth callback URL for connecting an Azure subscription for billing\n\nWhen you connect or update an Azure subscription for billing, you must allow access to the following URL:\n\n* `https://github.com/enterprises/oauth_callback`\n\nThis URL is required during the OAuth authentication flow that occurs when:\n\n* Connecting an Azure subscription to your enterprise for the first time\n* Changing or updating an existing Azure subscription connection\n\n> \\[!IMPORTANT]\n>\n> * The URL must be allowed with all query parameters, for example `https://github.com/enterprises/oauth_callback?code=...`\n> * After the Azure subscription is successfully connected and the subscription ID is stored, you can remove this URL from your allowlist\n> * To change or update your Azure subscription, you must add the URL back to your allowlist\n\nThe OAuth flow works as follows:\n\n1. The user starts the connection process on `SUBDOMAIN.ghe.com`\n2. Azure redirects to `https://github.com/enterprises/oauth_callback` to complete the OAuth flow\n3. The system redirects back to `SUBDOMAIN.ghe.com` to finalize the connection\n\n## IP ranges for GitHub Enterprise Importer\n\nIf you're running a migration to your enterprise with GitHub Enterprise Importer, you may need to add certain ranges to an IP allow list. See [Managing access for a migration between GitHub products](/en/enterprise-cloud@latest/migrations/using-github-enterprise-importer/migrating-between-github-products/managing-access-for-a-migration-between-github-products#configuring-ip-allow-lists-for-migrations)."}