Internal Use

[quietobserver1]

When using internally and we block out external IP's, it seems that that the document inline display does not work as it is trying to communicate online to display the viewer. Is there a way around this?

[Prajwal-Microsoft]

Hi @quietobserver1 ,

can you please elaborate more on this. I would like to get more context of the issue you are facing

[quietobserver1]

Hi @Prajwal-Microsoft In the website nsg we added a few inbound rules in azure which allowed external HTTPS traffic from specific ip subnets. We then edited the inbound rule in that same nsg which correspond to the HTTTP traffic from anywhere else on the internet and set it to deny. So essentially restricted HTTPS traffic only from specific IP's.

This causes the document viewer from office (view.officeapps.live.com) to error out.

[Prajwal-Microsoft]

Hi @quietobserver1 ,

If possible can you please let us know the rules that you have set on NSG, so I can check & help you to modify them.

[Prajwal-Microsoft]

Hi @quietobserver1 ,

Can you please let us know if you can share the rules on NSG?

[quietobserver1]

Hi attached are the rules.

Note: Priority 101 is the list of all our company's ip.
102 is the only range we added from Microsoft.

We know there are more IP ranges associated with the Microsoft domain but we are just not sure of the ones to add for this.

[Prajwal-Microsoft]

Hi @quietobserver1,

Thanks for sharing the NSG rules. The root cause is that the document inline viewer for Office files (Word, Excel, PowerPoint) uses the Office Online viewer (view.officeapps.live.com). This is an external Microsoft service that works by fetching the document from the provided URL server-side — meaning Office Online's servers need to be able to reach your Azure Blob Storage endpoint to render the document. Your NSG deny rule blocks this callback.

I think you need to allowlist Office 365 IP ranges

Microsoft publishes official IP ranges for Office 365 services. You can add the required ranges to your NSG inbound rules. See: Office 365 URLs and IP address ranges. Alternatively, you can use the Azure Service Tag AzureCloud or more specific tags in your NSG rules instead of managing individual IP ranges manually.

Let us know if this resolves your issue.