GitHub Actions Multi-Cloud Runners: Update Allowlists and Entra

by

Updated: November 2, 2026. GitHub Actions is expanding its hosted-runner infrastructure: eligible Linux jobs may now run on Amazon Web Services (AWS) in addition to Microsoft Azure. The goal is better capacity, queue times, and resilience, but the architectural consequence is immediate: allowlists that trust only Azure or Microsoft ranges can block connections from the expanded runner pool.

What changed

As of October 28, 2026, GitHub can schedule eligible jobs across a multi-cloud compute pool. The expansion covers standard 2-core and 4-core Linux runners and compatible larger runners without specialized configurations. Existing labels and workflow syntax remain unchanged.

  • GitHub Free, Pro, and Team: eligible runners automatically use multi-cloud compute.
  • GitHub Enterprise Cloud: an enterprise administrator must opt in under Enterprise settings → Actions → Hosted compute cloud providers.
  • Not included: Windows runners, private-networking runners, and other specialized configurations.

Why pipelines can break

A workflow can keep exactly the same YAML while its outbound traffic originates from a different IP range. If an Azure Key Vault, Storage Account, API, firewall, proxy, or SaaS platform accepts only Azure-associated ranges, the job can start failing when GitHub schedules it on AWS.

GitHub also warns that network-based access policies—including Microsoft Entra Conditional Access policies that depend on named locations—can reject authentication from the expanded pool. Failures may look intermittent because the scheduler selects available capacity across providers.

What cloud architects should review

  1. Inventory network dependencies: identify workflows that reach endpoints restricted by IP, firewalls, proxies, or trusted locations.
  2. Use the authoritative source: consume the actions array from GET https://api.github.com/meta. Do not maintain an Azure-only static list.
  3. Automate synchronization: compare GitHub’s published ranges with effective rules and require approval before changing sensitive firewalls.
  4. Review Conditional Access: find non-interactive flows that depend on named locations. Prefer workload identity, short-lived tokens, and resource authorization over IP trust where possible.
  5. Pilot before Enterprise opt-in: validate authentication, registries, artifacts, secrets, and deployment targets in a controlled organization.

Recommended architecture pattern

Hosted-runner IP addresses are an operational control, not an identity. For Azure deployments, the preferred design is OpenID Connect workload identity federation, least-privilege RBAC, and ephemeral credentials. Allowlists may still be required, but they should not be the only trust signal.

When a target requires private connectivity or deterministic egress, use private-networking runners or self-hosted runners in a controlled segment. That choice increases operational responsibility for patching, isolation, workspace cleanup, scaling, and protection from pull-request code.

Immediate action checklist

  • Find rules that allow only Microsoft or Azure ranges for GitHub Actions traffic.
  • Verify that controls consume every range in the GitHub Meta API actions array.
  • Review Entra named locations used by pipelines.
  • Run a test workflow against each protected target and record outbound IP behavior.
  • Document rollback before enabling AWS compute in GitHub Enterprise Cloud.

The Agentic DevOps connection

Execution infrastructure matters even more as workflows gain autonomy through agents and AI-powered automation. For additional context, read Microsoft AZ-401: The New Agentic DevOps Engineer Expert Certification Explained.

Official references

LinkedIn proposal

GitHub Actions can now run eligible Linux jobs on AWS in addition to Azure. Your workflow syntax does not change—but your allowlists, firewalls, and Microsoft Entra named locations might need to. This article explains which workloads are affected, why IP-only trust is fragile, and how to prepare with the Meta API, OIDC, and a controlled pilot. #GitHubActions #AzureDevOps #CloudSecurity #MicrosoftEntra #DevSecOps

Leave a Comment