Is there a way of obtaining the Private IP address for Azure Functions (Linux) programatically?

Question

The scenario I'm trying to solve is I have a list of Source IP addresses from Azure Monitor (Firewall logs). Some of these are private IPs which belong to Azure Functions. I'd like to either resolve the IPs to resource names via KQL and Azure Monitor, or failing that at least generate a list of Private IPs with their corresponding Azure Function name. Other details; The Azure Functions are using Private Endpoints. The IP address of the Azure Function can be found on the Advanced Tools > Environment page under the value "WEBSITE_PRIVATE_IP".

Answer 1

To obtain the private IP addresses of Azure Functions programmatically, especially when they are using Private Endpoints, you have a couple of approaches to consider: Azure CLI or PowerShell Scripts: You can write a script that iterates over your Azure Functions and queries their properties to obtain the private IP address. This script can be run programmatically as needed.

• For Azure CLI, you would typically use a command like az functionapp show to get details about each function app, and then parse the output for the private IP address.
• For PowerShell, you would use Azure PowerShell cmdlets like Get-AzFunctionApp to obtain similar information.

Extracting Private IP: Since the private IP address is found in the Advanced Tools > Environment page under the value "WEBSITE_PRIVATE_IP", your script needs to query this specific property.

KQL Query: Write a KQL query that joins Azure Monitor data (like firewall logs) with Azure Resource Graph data to correlate resource names with private IP addresses. The query would look something like this (simplified example):

Resources
| where type == 'microsoft.web/sites'
| extend privateIP = properties.privateIpAddress
| join kind=inner (
    AzureDiagnostics
    | where ResourceProvider == "MICROSOFT.WEB" and Category == "FunctionAppLogs"
    ) on $left.ResourceId == $right.ResourceId
This query is a basic example. You'll need to adjust it based on the exact schema of your logs and the information available in the Resource Graph.

By using these methods, you should be able to programmatically obtain the private IP addresses of your Azure Functions and possibly resolve them to resource names. Remember, the exact implementation will depend on the specifics of your Azure environment and the details you need to extract.

Answer 2

JasonS-0863 To answer your question, currently, it is not possible to retrieve WEBSITE_PRIVATE_IP property via CLI, PowerShell or Rest API and this is available only inside the application. I did a quick test via portal C# (Linux) and able to retrieve the property (similarly should work for other languages).

So, you might have to create a HTTP triggered function and expose this property like above for external callers. However, as I previously mentioned, WEBSITE_PRIVATE_IP value can change during scaling, or few other scenarios and should not rely on this. Instead, always use subnet range wherever possible.

I hope this helps and let me know if any questions.

---

If you found the answer to your question helpful, please take a moment to mark it as Yes for others to benefit from your experience. Or simply add a comment tagging me and would be happy to answer your questions.