diff --git a/azurerm/internal/services/eventhub/resource_arm_eventhub_namespace.go b/azurerm/internal/services/eventhub/resource_arm_eventhub_namespace.go
index b3d11deabdd0..5ae3bbfa2af6 100644
--- a/azurerm/internal/services/eventhub/resource_arm_eventhub_namespace.go
+++ b/azurerm/internal/services/eventhub/resource_arm_eventhub_namespace.go
@@ -103,9 +103,11 @@ func resourceArmEventHubNamespace() *schema.Resource {
 							}, false),
 						},
 
+						// 128 limit per https://docs.microsoft.com/azure/event-hubs/event-hubs-quotas
 						"virtual_network_rule": {
 							Type:       schema.TypeList,
 							Optional:   true,
+							MaxItems:   128,
 							ConfigMode: schema.SchemaConfigModeAttr,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
@@ -127,10 +129,11 @@ func resourceArmEventHubNamespace() *schema.Resource {
 							},
 						},
 
+						// 128 limit per https://docs.microsoft.com/azure/event-hubs/event-hubs-quotas
 						"ip_rule": {
 							Type:       schema.TypeList,
 							Optional:   true,
-							MaxItems:   1,
+							MaxItems:   128,
 							ConfigMode: schema.SchemaConfigModeAttr,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
diff --git a/azurerm/internal/services/eventhub/tests/resource_arm_eventhub_namespace_test.go b/azurerm/internal/services/eventhub/tests/resource_arm_eventhub_namespace_test.go
index 6a7a18f91539..3f830588499a 100644
--- a/azurerm/internal/services/eventhub/tests/resource_arm_eventhub_namespace_test.go
+++ b/azurerm/internal/services/eventhub/tests/resource_arm_eventhub_namespace_test.go
@@ -116,6 +116,27 @@ func TestAccAzureRMEventHubNamespace_networkrule_vnet(t *testing.T) {
 	})
 }
 
+func TestAccAzureRMEventHubNamespace_networkruleVnetIpRule(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_eventhub_namespace", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMEventHubNamespaceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAzureRMEventHubNamespace_networkruleVnetIpRule(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMEventHubNamespaceExists(data.ResourceName),
+					resource.TestCheckResourceAttr(data.ResourceName, "network_rulesets.0.virtual_network_rule.#", "2"),
+					resource.TestCheckResourceAttr(data.ResourceName, "network_rulesets.0.ip_rule.#", "2"),
+				),
+			},
+			data.ImportStep(),
+		},
+	})
+}
+
 func TestAccAzureRMEventHubNamespace_readDefaultKeys(t *testing.T) {
 	data := acceptance.BuildTestData(t, "azurerm_eventhub_namespace", "test")
 
@@ -388,8 +409,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "Basic"
 }
 `, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
@@ -401,10 +422,10 @@ func testAccAzureRMEventHubNamespace_requiresImport(data acceptance.TestData) st
 %s
 
 resource "azurerm_eventhub_namespace" "import" {
-  name                = "${azurerm_eventhub_namespace.test.name}"
-  location            = "${azurerm_eventhub_namespace.test.location}"
-  resource_group_name = "${azurerm_eventhub_namespace.test.resource_group_name}"
-  sku                 = "${azurerm_eventhub_namespace.test.sku}"
+  name                = azurerm_eventhub_namespace.test.name
+  location            = azurerm_eventhub_namespace.test.location
+  resource_group_name = azurerm_eventhub_namespace.test.resource_group_name
+  sku                 = azurerm_eventhub_namespace.test.sku
 }
 `, template)
 }
@@ -418,8 +439,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "Standard"
   capacity            = "2"
 }
@@ -435,8 +456,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "Standard"
   capacity            = "2"
 
@@ -460,28 +481,28 @@ resource "azurerm_resource_group" "test" {
 resource "azurerm_virtual_network" "test" {
   name                = "acctvn-%[1]d"
   address_space       = ["10.0.0.0/16"]
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
 }
 
 resource "azurerm_subnet" "test" {
   name                 = "acctsub-%[1]d"
-  resource_group_name  = "${azurerm_resource_group.test.name}"
-  virtual_network_name = "${azurerm_virtual_network.test.name}"
+  resource_group_name  = azurerm_resource_group.test.name
+  virtual_network_name = azurerm_virtual_network.test.name
   address_prefix       = "10.0.2.0/24"
 }
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%[1]d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "Standard"
   capacity            = "2"
 
   network_rulesets {
     default_action = "Deny"
     virtual_network_rule {
-      subnet_id = "${azurerm_subnet.test.id}"
+      subnet_id = azurerm_subnet.test.id
 
       ignore_missing_virtual_network_service_endpoint = true
     }
@@ -490,6 +511,73 @@ resource "azurerm_eventhub_namespace" "test" {
 `, data.RandomInteger, data.Locations.Primary)
 }
 
+func testAccAzureRMEventHubNamespace_networkruleVnetIpRule(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-%[1]d"
+  location = "%[2]s"
+}
+
+resource "azurerm_virtual_network" "test" {
+  name                = "acctvn1-%[1]d"
+  address_space       = ["10.0.0.0/16"]
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+}
+
+resource "azurerm_subnet" "test" {
+  name                 = "acctsub1-%[1]d"
+  resource_group_name  = azurerm_resource_group.test.name
+  virtual_network_name = azurerm_virtual_network.test.name
+  address_prefix       = "10.0.1.0/24"
+  service_endpoints    = ["Microsoft.EventHub"]
+}
+
+resource "azurerm_virtual_network" "test2" {
+  name                = "acctvn2-%[1]d"
+  address_space       = ["10.1.0.0/16"]
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+}
+
+resource "azurerm_subnet" "test2" {
+  name                 = "acctsub2-%[1]d"
+  resource_group_name  = azurerm_resource_group.test.name
+  virtual_network_name = azurerm_virtual_network.test2.name
+  address_prefix       = "10.1.1.0/24"
+  service_endpoints    = ["Microsoft.EventHub"]
+}
+
+resource "azurerm_eventhub_namespace" "test" {
+  name                = "acctesteventhubnamespace-%[1]d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  sku                 = "Standard"
+  capacity            = "2"
+
+  network_rulesets {
+    default_action = "Deny"
+
+    virtual_network_rule {
+      subnet_id = azurerm_subnet.test.id
+    }
+
+    virtual_network_rule {
+      subnet_id = azurerm_subnet.test2.id
+    }
+
+    ip_rule {
+      ip_mask = "10.0.1.0/24"
+    }
+
+    ip_rule {
+      ip_mask = "10.1.1.0/24"
+    }
+  }
+}
+`, data.RandomInteger, data.Locations.Primary)
+}
+
 func testAccAzureRMEventHubNamespaceNonStandardCasing(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 resource "azurerm_resource_group" "test" {
@@ -499,8 +587,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "basic"
 }
 `, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
@@ -515,8 +603,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                     = "acctesteventhubnamespace-%d"
-  location                 = "${azurerm_resource_group.test.location}"
-  resource_group_name      = "${azurerm_resource_group.test.name}"
+  location                 = azurerm_resource_group.test.location
+  resource_group_name      = azurerm_resource_group.test.name
   sku                      = "Standard"
   capacity                 = "2"
   auto_inflate_enabled     = true
@@ -534,8 +622,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "Basic"
 
   tags = {
@@ -554,8 +642,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                = "acctesteventhubnamespace-%d"
-  location            = "${azurerm_resource_group.test.location}"
-  resource_group_name = "${azurerm_resource_group.test.name}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
   sku                 = "Basic"
   capacity            = %d
 }
@@ -571,8 +659,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                     = "acctesteventhubnamespace-%d"
-  location                 = "${azurerm_resource_group.test.location}"
-  resource_group_name      = "${azurerm_resource_group.test.name}"
+  location                 = azurerm_resource_group.test.location
+  resource_group_name      = azurerm_resource_group.test.name
   sku                      = "Standard"
   capacity                 = 1
   auto_inflate_enabled     = true
@@ -590,8 +678,8 @@ resource "azurerm_resource_group" "test" {
 
 resource "azurerm_eventhub_namespace" "test" {
   name                     = "acctesteventhubnamespace-%d"
-  location                 = "${azurerm_resource_group.test.location}"
-  resource_group_name      = "${azurerm_resource_group.test.name}"
+  location                 = azurerm_resource_group.test.location
+  resource_group_name      = azurerm_resource_group.test.name
   sku                      = "Standard"
   capacity                 = 1
   auto_inflate_enabled     = false
diff --git a/website/docs/guides/2.0-upgrade-guide.html.markdown b/website/docs/guides/2.0-upgrade-guide.html.markdown
index 026dc51329dc..56d19acdf74e 100644
--- a/website/docs/guides/2.0-upgrade-guide.html.markdown
+++ b/website/docs/guides/2.0-upgrade-guide.html.markdown
@@ -327,6 +327,8 @@ The deprecated `kafka_enabled` field will be removed, since this is no longer us
 
 The deprecated `location` field will be removed, since this is no longer used.
 
+The `virtual_network_rule` and `ip_rule` fields in the `network_rulesets` block will have a hard limit of 128 items.
+
 ### Resource: `azurerm_firewall`
 
 The deprecated `internal_public_ip_address_id` field in the `ip_configuration` block will be removed. This field has been replaced by the `public_ip_address_id` field in the `ip_configuration` block.