Give Microsoft Power Automate a Static Outbound IP With a Relay Function

You added a partner API to a Power Automate cloud flow and the partner asked for your outbound IP address to allowlist. Power Automate doesn't give you one. Cloud flows call out through Microsoft's shared connector infrastructure, so the IP your target API sees changes and belongs to a wide Microsoft range. Here's how to put two fixed static IPs in front of those calls.

Power Automate Egresses From Microsoft's Shared Service Tag Ranges

Cloud flows send outbound requests through the HTTP action and connectors, which egress from Microsoft's shared Azure ranges. Microsoft publishes these as service tags, and the primary tag for connector traffic is AzureConnectors. Those ranges are large, shared across every tenant, and updated by Microsoft over time. You can allowlist the whole service tag, but that opens your firewall to all of Microsoft's connector infrastructure, not just your flow. That defeats the point of an allowlist. Verify the current service tag ranges against Microsoft's Power Automate IP address documentation before you rely on them.

Power Automate also gives you no proxy setting. There's no HTTP_PROXY field, no place to paste a proxy URL, and no arbitrary code step where you could set one. So the usual proxy approach, where you point an HTTP client at QuotaGuard with one environment variable, doesn't apply on this platform. You need a different shape.

A Small Relay Function Gives Power Automate Two Static IPs

Because Power Automate can't set a proxy or run a sidecar, you host a small relay function that egresses through QuotaGuard. You deploy the relay once as an AWS Lambda or a Google Cloud Function. The relay reads two headers, forwards your request through the QUOTAGUARDSTATIC_URL connection, and your target API sees QuotaGuard's two load-balanced static IPs. Your Power Automate flow just calls the relay's function URL.

QuotaGuard gives every subscription two load-balanced static IPs. You allowlist both on the partner side. This is the same reusable pattern QuotaGuard documents for any platform that can't set an HTTP proxy, so you don't have to design it from scratch. The full write-up and a ready-to-run example are linked at the end of this post.

The relay takes two headers from your flow:

• X-Relay-Key is a shared secret so only your flow can use the relay.
• X-Target-URL is the real API you want to reach.

In the Power Automate HTTP action, set the method to POST, the URI to your deployed relay function URL, and add the two headers. Here's the request the HTTP action sends:

POST https://your-relay-function-url.example.com
X-Relay-Key: your-shared-secret
X-Target-URL: https://api.partner.com/v1/orders
Content-Type: application/json

{
  "order_id": "12345",
  "status": "shipped"
}

The equivalent call as curl, which is useful for testing the relay before you wire it into the flow:

curl -X POST "https://your-relay-function-url.example.com" \
  -H "X-Relay-Key: your-shared-secret" \
  -H "X-Target-URL: https://api.partner.com/v1/orders" \
  -H "Content-Type: application/json" \
  -d '{"order_id":"12345","status":"shipped"}'

The relay forwards the body and method to the target URL through QuotaGuard. The partner API sees the request arriving from one of your subscription's two static IPs. Your Static payload is tunneled end to end and is never decrypted at the proxy, so a standard HTTPS API call works without exposing anything to the relay layer beyond routing.

Test the Static IPs by Pointing X-Target-URL at ip.quotaguard.com

Confirm the path works before you point it at a real partner. Set X-Target-URL to https://ip.quotaguard.com and run the flow, or run the curl version below. The response returns one of your two static IPs. Run it a few times and you'll see both, because the pair sits behind a load balancer.

curl -X GET "https://your-relay-function-url.example.com" \
  -H "X-Relay-Key: your-shared-secret" \
  -H "X-Target-URL: https://ip.quotaguard.com"

Allowlist both returned IPs on the partner side. QuotaGuard assigns the pair per subscription, so both addresses stay fixed as long as the subscription is active.

QuotaGuard Static Pricing Starts at $19/Month

QuotaGuard Static direct plans start at $19/month. Bandwidth is bundled and there are no per-GB overage fees. For a Power Automate flow calling a partner API through a relay, standard HTTPS traffic sits well inside the entry tier. Static tunnels your payload end to end and never decrypts it at the proxy, which is the right fit for ordinary API calls. Dedicated IPs are available on Enterprise and above. On lower tiers your subscription's two IPs are still static, but shared with other customers.

QuotaGuard Shield Pricing Starts at $29/Month

QuotaGuard Shield direct plans start at $29/month. Shield uses SSL passthrough, so the TLS connection runs end to end and QuotaGuard doesn't decrypt your data in ordinary operation. Choose Shield when your flow moves regulated data and you need to meet compliance standards like HIPAA, PCI-DSS, or SOC 2. The relay setup is the same. Point the relay at your Shield connection instead of Static. All plans include a 3-day trial, Enterprise plans include a 7-day trial, and a credit card is required.

Power Automate has no proxy field, so the relay function is the clean way to give your flows two fixed static IPs a partner can allowlist. Deploy the relay once, call it from the HTTP action with the two headers, and you're done. See the full pricing table at quotaguard.com/products/pricing, grab the ready-to-run relay example at the QuotaGuard lambda-relay repo, and read the reusable relay pattern in full at the QuotaGuard static IP relay docs.