So for quite some time, we already needed to used URL based access for the our names pointing to contentent deliver network (CDN) providers. However, for anything else IP based access has been fully supported (although we always recommend URL based access).
It still is. However, be aware of the following:
While IP allow lists will work, there are a number of downsides to this approach, including:
Web clients such as the Office 365 admin portal or Outlook Web App won’t be able to authenticate.
Future non-web based clients may not be able to authenticate.
Additional Office 365 infrastructure won’t become instantly available to client computers.
Updates will be required as frequently as weekly.
This was recently added to our TechNet page on the subject: http://technet.microsoft.com/en-us/library/hh373144.aspx