Skip to main content
If you’re using the Full SaaS version of Maia, you may need to configure your source systems to accept requests from a set range of IP addresses. If you’re using the Hybrid SaaS version and have installed some hybrid agents in your cloud infrastructure but don’t want to allow unrestricted outbound access, you need to allow access to a specified range of IP addresses.

Agents and Git repositories

Full SaaS

If you’re using a Full SaaS Maia runner configuration, you may need to allow the following IP address ranges from which Maia runners call out to their source systems or to cloud data platforms. The IP addresses differ between EU, EU2, US, and AU regions. EU region (Ireland/Paris):
EU2 region (UK/London):
US region:
AU region:

Hybrid SaaS agents and Git repositories

This applies to both Maia runners and Streaming runners. If you’re using a Hybrid SaaS deployment, note that it only necessitates outbound communication. For added security measures—along with ensuring access to any desired data sources for Maia—you need to allow the following IP address ranges to enable communication between the agent and Maia. You must also allow outbound communication on port 443 from the agent container to Maia. Unlike Full SaaS, a Maia runner used in a Hybrid SaaS deployment doesn’t have a fixed Maia-assigned outbound IP address. Your own network infrastructure—typically your NAT gateway, proxy server, or cloud provider’s public IP range—determines the outbound IP instead, and Maia doesn’t surface or report this address. To find it, check your NAT gateway configuration or cloud provider network settings. For users connecting to their own external repositories (such as “connect your own Git” on GitHub or Azure DevOps), these IPs need to be allowed on the repository or organization being connected to. Note that these IP addresses vary between the EU, EU2, US, and AU regions. EU region (Ireland/Paris):
EU2 region (UK/London):
US region:
AU region:
You also need to include the following DNS entries in your outbound allowlist: Global:
EU region (Ireland/Paris):
EU2 region (UK/London):
US region:
AU region:
Adding the Hybrid SaaS agent IP ranges listed above isn’t a complete replacement for adding *.matillion.com to your domain allow list, as they serve different purposes. The IP ranges restrict outbound traffic from the agent container to specific Matillion endpoints. In contrast, *.matillion.com covers the broader set of Matillion services and endpoints required for normal platform operation. To ensure full functionality, add *.matillion.com to your domain allow list alongside any required IP ranges. You must also ensure that any other internal services (for example, AWS or Azure) are accessible, as well as the source systems you wish to connect to (for example, Oracle or SAP). If you use the Microsoft Exchange source in the Data Transfer component with your own Microsoft Entra app, also allow outbound access from the runner to login.microsoftonline.com (token requests) and graph.microsoft.com (data). The Matillion-managed connection type only needs graph.microsoft.com. Ensure connectivity from the agent container to your data warehouse. For example, when connecting to Snowflake, allow outbound access to ports 80 and 443. Port 443 is used for standard communication, while port 80 is required for OCSP certificate validation checks.

Connecting Matillion ETL to Maia

When configuring a connection from Matillion ETL to Maia, allow list the following address: api.billing.matillion.com. If you need to allow a static IP address, allow the following outbound addresses (on port 443) in your security group:
Full details on connecting Matillion ETL to Maia are provided in Configuring a connection from Matillion ETL to Maia.

Custom connectors, Flex connectors, and Git repositories

You may need to allow the following IP addresses before using custom connectors or Flex connectors, and connecting to your own Git repository. EU region (Ireland/Paris):
EU2 region (UK/London):
US region:
AU region:

Git repositories

If your Git provider uses an IP allowlist, add the IP addresses above for the region where your Maia account is hosted. Maia connects to your Git provider from these IP addresses when you connect a repository or use Git actions. If you use GitHub Enterprise Cloud, an organization owner can instead turn on a GitHub setting that adds the Maia app’s IP addresses for all regions. Read Organizations that use an IP allowlist.