Access restricted storage account from function app on consumption plan

Question

Is there a way to access a restricted storage account that doesn't allow public access from a function app running on the consumption plan? The only ways I've come across are both solutions I don't like.

1. Upgrade plan to premium (It seems that this would cost a lot more than the consumption plan)
2. Move the function app to a different region and whitelist the outbound IPs. (I think those IP addresses are shared so that's a security risk and no good.)

It seems that solution 1 is the only feasible route, but maybe you know of a solution I haven't come across.

Answer 1

Hi @Clay Casper ,

Thanks for reaching out to Q&A forum.

When the storage account has network restrictions, one of the ways for a function app to access the storage account is vnet integration. Function app has to be on the same vnet as that of storage account ( they both can be in different subnets though). Vnet integration is supported only for Elastic Premium(serverless) and dedicated app service plan SKU (Standard, PremiumV3, Isolated) and it is not supported in consumption plan.

If you would like to whitelist the outbound ip of the function app, then consumption plan would still not be an ideal choice as the IP adresses would keep changing frequently because of the serverless architecture. An ideal choice for your scenario is to move to a dedicated app service plan (Standard plan which is not costly), so that you can integrate with vnet and also whitelist IP adresses as they remain the same.

Hope this helps! Feel free to reach out to me if you have any queries or concerns.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.