This article applies to:
- Revu 21 & below
- Bluebeam Cloud
- Studio
If you’re an IT admin who needs to allowlist Revu, Studio, and/or Bluebeam Cloud for users, use the information below to access regions and services, domains and wildcards, and steps for how to obtain IP ranges from AWS.
Bluebeam AWS Regions & Services
US Region
- Region: us-east-1
- Service: AMAZON
- Service: CLOUDFRONT IPS
UK Region
- Region: eu-west-2
- Service: AMAZON
- Service: CLOUDFRONT IPS
AU Region
- Region: ap-southeast-2
- Service: AMAZON
- Service: CLOUDFRONT IPS
DE Region
- Region: eu-central-1
- Service: AMAZON
- Service: CLOUDFRONT IPS
SE Region
- Region: eu-north-1
- Service: AMAZON
- Service: CLOUDFRONT IPS
Allowlist by domains or wildcards
As a best practice, we recommend allowlisting by domain and using wildcards to capture all Bluebeam solutions (i.e., Revu, Studio, and Bluebeam Cloud). This will ensure users receive account activation emails for Revu 21 subscriptions.
US Domains
- studio.bluebeam.com
- gds.bluebeam.com
- studiorealtime.bluebeam.com
- internalapi.bluebeam.com
- prime.bluebeam.com (for Studio Prime only)
- portal.bluebeam.com
- activation.bluebeam.com (for registering Revu)
- login.bluebeam.com
- login.microsoftonline.com (validation token for licensing Revu 20 & below, not part of AWS)
- accounts.bluebeam.com
- authserver.bluebeam.com (for Studio Prime workflows)
- identitygateway.bluebeam.com
- okta.bluebeam.com
- org-admin.bluebeam.com
- app.bluebeam.com
- signin.bluebeam.com (for sign in/login authentication)
- lagapi.bluebeam.com (for authorizing Revu 21)
- revusyncbff.bluebeam.com (for syncing Revu 21 tool sets in Bluebeam Cloud)
- updatesservice-p-xx-ue1.bluebeam.com (the update service for all versions and all regions)
Wildcards
If you’re able to use wildcards *, these are the only domains you’ll need to allowlist:
- *.bluebeam.com:443
- *.amazonaws.com:443
Note: studio.bluebeam.com sits in front of *.amazonaws.com, so usually *.amazonaws.com is not necessary for allowlisting. However, if allowlisting the Bluebeam domains above doesn’t work, try allowlisting *.amazonaws.com as well.
UK Domains
- bluebeamstudio.co.uk
- login.bluebeamstudio.co.uk
- internalapi.bluebeamstudio.co.uk
- activation.bluebeamstudio.co.uk (for registering Revu)
- studiorealtime.bluebeamstudio.co.uk
- accounts.bluebeamstudio.co.uk
- signin.bluebeamstudio.co.uk
- lagapi.bluebeamstudio.co.uk
- revusyncbff.bluebeamstudio.co.uk
- okta.bluebeamstudio.co.uk
- app.bluebeam.co.uk
- org-admin.bluebeam.com
- updatesservice-p-xx-ue1.bluebeam.com (the update service for all versions and all regions)
Wildcards
If you’re able to use wildcards *, these are the only domains you’ll need to allowlist:
- *.bluebeamstudio.co.uk:443
- *.amazonaws.com:443
Note: bluebeamstudio.co.uk sits in front of *.amazonaws.com, so usually *.amazonaws.com is not necessary for allowlisting. However, if allowlisting the Bluebeam domains above doesn’t work, try allowlisting *.amazonaws.com as well.
AU Domains
- bluebeamstudio.com.au
- studiorealtime.bluebeamstudio.com.au
- internalapi.bluebeamstudio.com.au
- activation.bluebeamstudio.com.au (for registering Revu)
- login.bluebeamstudio.com.au
- accounts.bluebeamstudio.com.au
- signin.bluebeamstudio.com.au
- lagapi.bluebeamstudio.com.au
- revusyncbff.bluebeamstudio.com.au
- okta.bluebeamstudio.com.au
- app.bluebeam.com.au
- org-admin.bluebeam.com
- updatesservice-p-xx-ue1.bluebeam.com (the update service for all versions and all regions)
Wildcards
If you’re able to use wildcards *, these are the only domains you’ll need to allowlist:
- *.bluebeamstudio.com.au:443
- *.amazonaws.com:443
Note: bluebeamstudio.com.au sits in front of *.amazonaws.com, so usually *.amazonaws.com is not necessary for allowlisting. However, if allowlisting the Bluebeam domains above doesn’t work, try allowlisting *.amazonaws.com as well.
DE Domains
- bluebeamstudio.de
- studiorealtime.bluebeamstudio.de
- internalapi.bluebeamstudio.de
- activation.bluebeamstudio.de (for registering Revu)
- login.bluebeamstudio.de
- accounts.bluebeamstudio.de
- signin.bluebeamstudio.de
- lagapi.bluebeamstudio.de
- revusyncbff.bluebeamstudio.de
- okta.bluebeamstudio.de
- app.bluebeam.de
- org-admin.bluebeam.com
- updatesservice-p-xx-ue1.bluebeam.com (the update service for all versions and all regions)
Wildcards
If you’re able to use wildcards *, these are the only domains you’ll need to allowlist:
- *.bluebeamstudio.de:443
- *.amazonaws.com:443
Note: bluebeamstudio.de sits in front of *.amazonaws.com, so usually *.amazonaws.com is not necessary for allowlisting. However, if allowlisting the Bluebeam domains above doesn’t work, try allowlisting *.amazonaws.com as well.
SE Domains
- bluebeamstudio.se
- studiorealtime.bluebeamstudio.se
- internalapi.bluebeamstudio.se
- activation.bluebeamstudio.se (for registering Revu)
- login.bluebeamstudio.se
- accounts.bluebeamstudio.se
- signin.bluebeamstudio.se
- lagapi.bluebeamstudio.se
- revusyncbff.bluebeamstudio.se
- okta.bluebeamstudio.se
- app.bluebeam.se
- org-admin.bluebeam.com
- updatesservice-p-xx-ue1.bluebeam.com (the update service for all versions and all regions)
Wildcards
If you’re able to use wildcards *, these are the only domains you’ll need to allowlist:
- *.bluebeamstudio.se:443
- *.amazonaws.com:443
Note: bluebeamstudio.se sits in front of *.amazonaws.com, so usually *.amazonaws.com is not necessary for allowlisting. However, if allowlisting the Bluebeam domains above doesn’t work, try allowlisting *.amazonaws.com as well.
Global Services
Wildcards
If you’re able to use wildcards *, these are the only domains you’ll need to allowlist:
- *.gds.bluebeam.com:443
- *.amazonaws.com:443
- *.login.okta.com:443
Allowlist by IP addresses
If you’re unable to allowlist Bluebeam solutions with the domains/wildcards above because firewalls require you to use IP addresses, we highly recommend retrieving Amazon IP ranges according to your Bluebeam region/service.
How to obtain IP ranges
In each region that hosts Bluebeam solutions, the IP ranges are dynamic, and AWS updates their IP Range JSON file frequently. On their website, Amazon states the following best practices for retrieving AWS IP Ranges:
Amazon Web Services (AWS) publishes its current IP address ranges in JSON format. To view the current ranges, download the .json file. To maintain history, save successive versions of the .json file on your system. To determine whether there have been changes since the last time that you saved the file, check the publication time in the current file and compare it to the publication time in the last file that you saved.
- Download and install AWS PowerShell.
- Run the following command to return all the IPs in your geographic location and display the results in the PowerShell console.
(@(Get-AWSPublicIpAddressRange -Region us-east-1) | ? { $.IpAddressFormat -eq 'Ipv4'-and $.Service -eq 'AMAZON' }).IpPrefix
- Run the following command to store the results into a .txt file.
(@(Get-AWSPublicIpAddressRange -Region us-east-1) | ? { $.IpAddressFormat -eq 'Ipv4'-and $.Service -eq 'AMAZON' }).IpPrefix > C:\Users\\Downloads\AMAZON.txt
Additional Resources
Add IP addresses to authorized senders
If you use the Sender Policy Framework (SPF) Record, you must add the IP addresses for your region to the list of authorized senders, so users can validate their Bluebeam ID (BBID) accounts and receive automated emails from Bluebeam.
- US: 54.240.43.6, 54.240.43.7
- DE: 76.223.184.4, 76.223.184.48
- SE: 23.251.241.6, 23.251.241.7
- AU: 69.169.234.170, 69.169.234.171
- UK: 23.249.219.49, 23.249.219.50
Bluebeam Cloud
Revu 21
Revu 20
Revu 2019
Revu 2018
Revu 2017 & Below
How-To
Studio