Add Azure hosted build agents IP addresses to Analysis Services Firewall rules

Based on your requirement, you can use the Azure PowerShell task in Pipeline to run the script to update the agent IP used for each run to the existing firewall rule.

Here are the steps:

Step1: Manully create a firewall rule in Analysis Services.

For example:

Step2: Create a .ps1 file in Azure repo with the following script:

[CmdletBinding()]
param(
    [Parameter(ValueFromPipeline = $true)][String] $ResourceName = "AnalysisServicesName",
    [Parameter(ValueFromPipeline = $true)][String] $ResourceGroup = "ResourceGroupName"
     )

#Setting additional parameters
$ExistingFirewallRuleName = "firewall rule name" 
$PubIPSource = "ipinfo.io/ip"

$AServiceServer = Get-AzAnalysisServicesServer -Name $ResourceName -ResourceGroupName $ResourceGroup
$FirewallRules = ($AServiceServer).FirewallConfig.FirewallRules
$FirewallRuleNameList = $FirewallRules.FirewallRuleName
$powerBi = ($AServiceServer).FirewallConfig.EnablePowerBIService

#Getting previous IP from firewall rule, and new public IP
$PreviousRuleIndex = [Array]::IndexOf($FirewallRuleNameList, $ExistingFirewallRuleName)
$currentIP = (Invoke-WebRequest -uri $PubIPSource -UseBasicParsing).content.TrimEnd()
$previousIP = ($FirewallRules).RangeStart[$PreviousRuleIndex]

#Updating rules if request is coming from new IP address.
if (!($currentIP -eq $previousIP)) {
    Write-Output "Updating Analysis Service firewall config"
    $ruleNumberIndex = 1
    $Rules = @() -as [System.Collections.Generic.List[Microsoft.Azure.Commands.AnalysisServices.Models.PsAzureAnalysisServicesFirewallRule]]

    #Storing Analysis Service firewall rules
    $FirewallRules | ForEach-Object {
        $ruleNumberVar = "rule" + "$ruleNumberIndex"
        #Exception of storage of firewall rule is made for the rule to be updated
        if (!($_.FirewallRuleName -match "$ExistingFirewallRuleName")) {

            $start = $_.RangeStart
            $end = $_.RangeEnd
            $tempRule = New-AzAnalysisServicesFirewallRule `
                -FirewallRuleName $_.FirewallRuleName `
                -RangeStart $start `
                -RangeEnd $end

            Set-Variable -Name "$ruleNumberVar" -Value $tempRule
            $Rules.Add((Get-Variable $ruleNumberVar -ValueOnly))
            $ruleNumberIndex = $ruleNumberIndex + 1
        }
    }
    
    Write-Output $FirewallRules         #Write all FireWall Rules to Host

    #Add rule for new IP
    $updatedRule = New-AzAnalysisServicesFirewallRule `
        -FirewallRuleName "$ExistingFirewallRuleName" `
        -RangeStart $currentIP `
        -RangeEnd $currentIP
    
    $ruleNumberVar = "rule" + "$ruleNumberIndex"
    Set-Variable -Name "$ruleNumberVar" -Value $updatedRule
    $Rules.Add((Get-Variable $ruleNumberVar -ValueOnly))

    #Creating Firewall config object
    if ($powerBi) {
            $conf = New-AzAnalysisServicesFirewallConfig -EnablePowerBiService -FirewallRule $Rules 
        }
    else {       
            $conf = New-AzAnalysisServicesFirewallConfig -FirewallRule $Rules 
        }
    
    #Setting firewall config
    if ([String]::IsNullOrEmpty($AServiceServer.BackupBlobContainerUri)) {
        $AServiceServer | Set-AzAnalysisServicesServer `
            -FirewallConfig $conf `
            -DisableBackup `
            -Sku $AServiceServer.Sku.Name.TrimEnd()
    }
    else {
        $AServiceServer | Set-AzAnalysisServicesServer `
            -FirewallConfig $conf `
            -BackupBlobContainerUri $AServiceServer.BackupBlobContainerUri `
            -Sku $AServiceServer.Sku.Name.TrimEnd()
    
    }
    Write-Output "Updated firewall rule to include current IP: $currentIP"
    Write-Output "Enable Power Bi Service was set to: $powerBi" 
}

Step3: Add Azure PowerShell task and define the arguments.

For example:

- task: AzurePowerShell@5
  displayName: 'Azure PowerShell script: FilePath'
  inputs:
    azureSubscription: kevin0627
    ScriptPath: test.ps1
    ScriptArguments: '-ResourceName  AnalysisServicesName -ResourceGroup  ResourceGroupName'
    azurePowerShellVersion: LatestVersion

When you run the pipeline, it will update the existing firewall rule with the IP of the current agent.

Result:

In this case, you don’t need to manually add all IPs to firewall.