Outbound IP addresses for Azure Function App

Question

Hi,

I'm using certain API that needs IP whitelisting to be able to use it. I've built a couple of Azure Functions inside my Azure Function App and both of them make requests to that API. I have whitelisted the outbound IP addresses of the Azure Function App.

Today, when the trigger of the Azure Functions ran, they were using a different IP out of the list of the outbound IP addresses, and therefore, it was not whitelisted in the API:

My list of outbound IP addresses does not include an IP similar to that one sending the request to the API.

Could you please guide me on what's going on here?

Regards,
Francisco.

Answer 1

@Francisco Dominguez ,

Thanks for reaching out to Q&A forum.

Please note that, the ip adresses of the function app shown in the portal (networking section) is actually the datacenter outbound ip address. So you might want to add the function apps' data center (Azure region) to an allowlist. You can download a JSON file that lists IP addresses for all Azure data centers.

Reference: https://learn.microsoft.com/en-us/azure/azure-functions/ip-addresses?msclkid=ada8be7ed0fb11ecb04d1cc6c5e3a0cd&tabs=portal#data-center-outbound-ip-addresses

The outbound ip addresses can change at any time if you are on Consumption or premium plan due to the Autoscale behavior. For a dedicated plan, the outbound ip address can change if you take any action that can change the inbound IP address or change your Dedicated (App Service) plan pricing tier.

You can control the IP address of outbound traffic from your functions by using a virtual network NAT gateway to direct traffic through a static public IP address. You can use this topology when running in a Premium plan or in a Dedicated (App Service) plan. Another option is to deploy the function in an App Service Environment.

Reference: https://learn.microsoft.com/en-us/azure/azure-functions/ip-addresses?msclkid=ada8be7ed0fb11ecb04d1cc6c5e3a0cd&tabs=portal#outbound-ip-address-changes

Answer 2

I have been debugging / tracking this for months.

We have a large collection of function apps on the consumption plan. All of them are using 5-minute timer triggers; either every execution is a "scaling event" or none of them are.

The outbound address is random. Sometimes it is in the "outbound" list, sometimes it is in the "possible outbound" list, and sometimes (most of the time) it is in neither.

What I find most concerning is that the "possible outbound" list has never updated or refreshed. It is identical to when the functions were deployed.

We satisfied our use-case with regional service tags, but this obviously does not help anyone using a 3rd party service.