Required IP Ranges for On-Premises Teams Bot - Firewall Configuration

I need to configure firewall rules for an on-premises Teams bot deployment. Our firewall requires explicit IP addresses - we can't use FQDN wildcards.

Current setup:

• Microsoft 365 endpoints (ID 12) are whitelisted
• Have Azure IP ranges JSON downloaded
• Observed connections to token.botframework.com, smba.trafficmanager.net, login.microsoftonline.com

Need help with:

1. Which Azure Service Tags are required for Bot Framework?
2. Complete list of botframework.com subdomains (docs say *.botframework.com)
3. Which Azure regions should we whitelist?
4. Any additional endpoints beyond the M365 documentation?

Our customer needs official documentation for their security team. Any guidance would be appreciated.