IP Restrict Azure function to only allow API management

Question

I have an API management with an API that links to Azure functions. I am already restricting access to API management by IP and I want to further protect the Azure Function to only allow the API Management.

The functions are serverless on a consumption plan so can be linked to a VNET. I have tried whitelisting the API Management service tag on my function App. That doesnt work all.

I see in the application insights is 403 forbidden from Client IP address 0.0.0.0.

Any help would be greatly appreciated.

Answer 1

Hi @Dave Schofield Thanks for reaching out.

Could you please let me know if the backend Function App is in the same VNET as APIM? if that is a case the outbound requests from APIM are not being "NATTed" as they never leave the network. If the backend Function App was in a different region (or VNET), an IP restriction rule to allow Public VIP of APIM service would have been enough to avoid the 403. else you must allow the entire subnet range of IPs where APIM is deployed, as the request can originate from any of the IPs in the subnet. Use Access Restrictions feature and allow access to the entire subnet, which is used by APIM.

From the description I see that you are observing 403 errors and cannot see the source IP all you see as 0.0.0.0.
APP insights does not show the actual client IP by default as to not store personal info at APP insights collection. In that case you can disable the IP Masking by enabling the DisableIpMasking property set to true.

The concept of disabling the Masking is described in below documentation :
Link : https://learn.microsoft.com/en-us/azure/azure-monitor/app/ip-collection?tabs=net

Do let me know incase of further queries, I would be happy to assist you.