On July 28, 2025 21:41 UTC, GitHub Enterprise Importer (GEI) was identified as being in a degraded state with migrations stalled. An incident was declared to restore the service to a healthy state and communicated via the GitHub status page. During this investigation, we found that a component of the GEI infrastructure had been improperly taken out of service and could not be restored to its previous configuration. This required the provisioning of new resources on new IP addresses to resolve the incident. As a result, you will need to add the following entries to corresponding allowlists:

  • The IP allow list on your destination github.com organization or enterprise
  • If you’re running migrations from github.com, the IP allow list on your source github.com organization or enterprise
  • If you’re running migrations from a GitHub Enterprise Server, Bitbucket Server, or Bitbucket Data Center instance, the allow list on your configured Azure Blob Storage or Amazon S3 storage account
  • If you’re running migrations from Azure DevOps, the allow list on your Azure DevOps organization

The new GEI IP ranges for inclusion in applicable IP allowlists are:

  • 20.99.172.64/28
  • 135.234.59.224/28

The following IP ranges are no longer used by GEI and can be removed from all applicable IP allowlists:

  • 40.71.233.224/28
  • 20.125.12.8/29

Customers with Azure Blob Storage configured for storing repository data for migrations must add virtual network firewall rules to their storage accounts to allow GEI to access the repository data. This requires the use of the Azure CLI or PowerShell, as adding these virtual network firewall rules on the Azure Portal is currently unsupported. The following virtual network subnet IDs must be added to the virtual network firewall rules for your storage account:

  • /subscriptions/cdf1c65c-e6f4-43b3-945f-c5280f104f9c/resourceGroups/ghr-network-service-1a72ec6f-45b6-44be-a4bd-f0fe50079c9f-5-westus2/providers/Microsoft.Network/virtualNetworks/1a72ec6f-45b6-44be-a4bd-f0fe50079c9f-5/subnets/1a72ec6f-45b6-44be-a4bd-f0fe50079c9f-5
  • /subscriptions/173ad082-b20d-4d44-8257-7fbf34959bed/resourceGroups/ghr-network-service-1a72ec6f-45b6-44be-a4bd-f0fe50079c9f-5-westus3/providers/Microsoft.Network/virtualNetworks/1a72ec6f-45b6-44be-a4bd-f0fe50079c9f-5/subnets/1a72ec6f-45b6-44be-a4bd-f0fe50079c9f-5

To add the virtual network firewall rules to your Azure Storage account, you can follow step 5 in the documentation for creating a virtual network rule for Azure Storage using the network subnet IDs provided above. Be sure to provide the --subscription argument with the subscription ID tied to the storage account.

Users who have run migrations using GitHub Enterprise Importer in the past 90 days will receive email alerts about this change.

For a full list of our IP ranges and more information, see our documentation on configuring IP allow lists for migrations: