IP Whitelisting - Synthreo Pylon

Summary

To ensure reliable and secure execution of Pylon agent workflows, outbound traffic originates from Synthreo-managed infrastructure in Microsoft Azure. Pylon is currently migrating between clusters, so two ranges are published below and both must be allowlisted. If your environment or third-party platforms enforce IP-based access controls, these ranges must be allowlisted.

IP Addresses to Whitelist

Please allowlist both of the following outbound ranges:

pylon_agent_ips:
  # Current egress. Pylon sends from this address today, until the migration
  # described below completes.
  - 20.98.172.69/32
  # Post-migration egress. A Synthreo-owned Azure prefix that takes over when
  # the migration completes - not yet in use. Allowlist permanently.
  - 20.118.212.164/30

Each entry is a CIDR block: /30 covers four addresses, /32 is a single address.

Changed 2026-08-23 - action required if you allowlisted our previous addresses

This page previously published six addresses in the range 87.236.192.0/20. Those addresses are no longer used by Synthreo and are no longer under Synthreo control. If they are still permitted anywhere - your firewall, a third-party API or SaaS allowlist, a WAF, or any other IP-based access control - remove them now: that range has returned to the hosting provider’s pool and may be reassigned to an unrelated organization.

Pylon has not sent traffic from those addresses since 2026-07-20, so an obsolete allowlist may be why your Pylon integrations have been failing since then. Confirm it before you change anything: look in your firewall or service logs for a rejected request from an unexpected source address. Expired credentials, a changed endpoint, or an unrelated network policy produce the same symptoms.

Allowlist both entries above and your integrations keep working through the migration. One further step is needed afterwards: once Synthreo confirms the migration is complete, remove 20.98.172.69/32 and keep 20.118.212.164/30. That address returns to Microsoft’s pool when we stop using it, and leaving it in your firewall recreates exactly the problem this notice is about.

Overview

Pylon runs agent-based workflows that execute actions on behalf of your organization. These agents operate from Synthreo-managed infrastructure and currently initiate outbound connections from 20.98.172.69/32, moving to the 20.118.212.164/30 prefix when the migration completes. Allowlisting both covers you across that change.

Many platforms and security controls require both valid authentication credentials and approved source IP addresses. In these environments, credentials alone are not sufficient to allow API access or webhook communication.

Why IP Whitelisting Is Required

1. IP-Based API Access Controls

Many platforms, particularly those commonly used by MSPs (such as PSA, RMM, and security tools), restrict API access based on source IP.

Even with:

• Valid API keys
• Correct user permissions
• Proper roles or scopes

Requests may be blocked if they originate from an unapproved IP address.

Without IP whitelisting, Pylon agent requests may result in:

• 401 Unauthorized
• 403 Forbidden
• Blocked or dropped API calls
• Intermittent or unreliable connectivity

2. Firewalls and Network Security Policies

Organizations commonly enforce security controls such as:

• Network firewalls
• Web Application Firewalls (WAF)
• Security gateways or zero-trust policies

Since Pylon agents run outside your internal network, their outbound IP addresses must be explicitly allowlisted to pass these controls.

3. Reliable Automation and Agent Execution

Pylon agents are designed to:

• Run scheduled automations
• Trigger and receive webhooks
• Execute chained or long-running workflows
• Consistently call external APIs

IP whitelisting ensures:

• Stable and predictable connectivity
• Reduced automation failures
• Reliable execution of production workflows

When IP Whitelisting Is Needed

IP whitelisting is typically required when:

• Pylon calls third-party APIs
• Webhooks are sent or received
• Integrating with platforms that enforce IP restrictions
• Operating in environments with strict firewall or security policies

Additional Notes

• These addresses are for outbound traffic that Pylon agents initiate.
• No inbound firewall rules are required.
• 20.98.172.69/32 is where Pylon agent traffic comes from today. It is temporary: remove it from your allowlist once Synthreo confirms the migration is complete. This page is updated at that point.
• The 20.118.212.164/30 prefix is allocated to Synthreo and will carry Pylon agent outbound traffic after the migration completes. It does not carry it yet, which is why both entries are listed. Note that this prefix is shared: it also carries other Synthreo services in the same region, so allowlisting it is not a Pylon-only restriction. If you need to permit Pylon alone, pair the allowlist with authentication rather than relying on source address.

If you are unsure whether IP whitelisting is required for your integration, please consult your IT or security team.