# How to dynamically add Okta IP addresses to Web Application Firewall

**URL:** <https://devforum.okta.com/t/how-to-dynamically-add-okta-ip-addresses-to-web-application-firewall/24940>\
**Category:** Questions\
**Created:** [August 1, 2023, 3:05pm UTC](https://devforum.okta.com/t/how-to-dynamically-add-okta-ip-addresses-to-web-application-firewall/24940 "2023-08-01T15:05:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tjpspf](https://avatars.discourse-cdn.com/v4/letter/t/838e76/32.png) [@tjpspf](https://devforum.okta.com/u/tjpspf)\
**Post date:** [August 1, 2023, 3:05pm UTC](https://devforum.okta.com/t/how-to-dynamically-add-okta-ip-addresses-to-web-application-firewall/24940/1 "2023-08-01T15:05:08Z")

</div>

Our SCIM server is protected by an AWS Web Application Firewall. We’ve added Okta’s published list of IP addresses to the whitelist, but we’ve already had the IP addresses change on us, causing issues.

What’s the best way to dynamically update our firewall with the latest IP addresses from Okta? I haven’t been able to figure out a specific Okta notification (if one exists) to target.

Also, I’m not clear on the scope of the following instruction from Okta: “Allowlisting Amazon Web Services CloudFront IP range will ensure that inbound traffic is accepted.”

Does that mean “Just allow _all_ CloudFront IP addresses through your firewall and you’ll get the Okta ones for free”? Or is it suggesting a more targeted approach to just Okta IP addresses?

Thanks for the help on this!

---

<div class="post-metadata">

**Author:** ![sigama](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/sigama/32/5811_2.png) [@sigama](https://devforum.okta.com/u/sigama)\
**Post date:** [August 2, 2023, 4:56pm UTC](https://devforum.okta.com/t/how-to-dynamically-add-okta-ip-addresses-to-web-application-firewall/24940/2 "2023-08-02T16:56:44Z")

</div>

Hi @tjpspf! Thank you for your question. You may have already seen this support page - [Okta Help Center (Lightning)](https://support.okta.com/help/s/article/What-IP-addresses-ranges-should-we-whitelist-for-inbound-traffic-i-e-REST-API-calls-from-Okta-to-on-prem-JIRA-server?language=en_US) that links to our allow list [https://s3.amazonaws.com/okta-ip-ranges/ip\_ranges.json](https://s3.amazonaws.com/okta-ip-ranges/ip_ranges.json). For SCIM, you may not need CloudFront IP addresses as this is for web assets, and so you’ll only need to monitor Okta IP Ranges (targeting only your org cells) periodically for updates. Apologies in advance, the update frequency is unpredictable, and we currently have no way to inform/alert you. I recommend creating a [feature request](https://ideas.okta.com) for a webhook push when IP Ranges change.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 15, 2024, 11:32pm UTC](https://devforum.okta.com/t/how-to-dynamically-add-okta-ip-addresses-to-web-application-firewall/24940/3 "2024-02-15T23:32:23Z")

</div>