AS8075

AS8075 is Microsoft's primary autonomous system, registered to Microsoft Corporation under ARIN as part of the AS8068–8075 block (the block's earliest handle dates to 1997). It originates the address space behind Azure, Microsoft 365 / Office, Bing, Xbox Live, and Windows Update, which makes Azure egress one of the most frequently observed cloud sources in network triage. The network is managed under the AS-SET RADb:AS-MICROSOFT and sits beside sibling ASNs AS8068–AS8074; importantly, AS12076 is Microsoft ExpressRoute, and Microsoft explicitly instructs peers NOT to accept routes from it. Microsoft's published peering policy is selective/open, requiring MANRS adherence, IRR registration, and minimum exchange capacities (around 500 Mbps for public peering and 2 Gbps for direct), and the company also offers BYOIP/BYOASN. Two route-validation details are worth surfacing: RPKI coverage is mostly valid but carries a nontrivial invalid count (on the order of 31 invalid IPv4 prefixes observed), useful input for any origin-validation scoring. As with all hyperscale cloud space, IPs are multi-tenant — attribute reputation to the tenant rather than to Microsoft.

Operator

Microsoft Corporation (ARIN OrgId MSFT) [Confirmed] — ARIN RDAP/WHOIS

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP

Allocated

~1997-03-31 (AS8068–8075 block; org RegDate 1998-07-10) [Confirmed] — ARIN RDAP

Org status

active — microsoft.com

Security/abuse context

Spamhaus lists Microsoft among recurring Top-20 botnet-C&C-hosting networks; Darktrace's 2026 reporting found Azure the most-targeted cloud (~43.5% of observed malware samples — measures malware hosted/targeted, NOT Microsoft as attacker); phishing kits abuse *.blob.core.windows.net. Shared-IP caveat applies — spamhaus.org, industrialcyber.co

Network & routing

Network type

cloud-hyperscale [Confirmed] — operator services + bgp.tools classification

Size

~1,029–1,158 IPv4 prefixes (~65.7M addrs), ~104–168 IPv6; ~552–611 peers; ~214 IXPs — bgp.he.net / bgp.tools (2026-05)

Routing/peering

selective/open (MANRS + IRR required; ~500 Mbps public / 2 Gbps direct minimums); RPKI mostly valid (~1,087 valid vs ~31 invalid — flag for ROV) — learn.microsoft.com, bgp.he.net

Notable usage

Azure, Microsoft 365/Office, Bing, Xbox Live, Windows Update — microsoft.com

Related ASNs

AS8068–AS8074 (sibling block); AS12076 (ExpressRoute — do NOT accept routes from)

Analyst note

Azure egress is extremely common; apply the same tenant-attribution discipline as AWS. Surface the RPKI-invalid count for route-validation pipelines.