Secure ways of accessing Azure DevOps API from Service Hooks

Question

What are the best ways to securely call a HTTP triggered azure function from Azure Devops (ADO) Service hook?

From what I can see ADO service hook page cannot use a managed identity. We are using system assigned managed identity for our function and using a function key and/or credentials is not a secure way (in plain text). As our function has a private endpoint, we have to whitelist the function with all the IP ranges for ADO hosted region as per the link below
https://learn.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url?view=azure-devops&tabs=IP-V4#inbound-connections

So, using anonymous is also not a secure way as anyone from that ADO region can access the function. Looks like it's function key and whitelist IPs for now.

Please let me know my options. Thank you.

Answer 1

HI ,

As I understand in this use case you want only to call the azure functions from azure Devops ?
instead of whitelisting ip adress you can in access restriction in the azure function allow the tag : AzureCloud you can check it from this link :

https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview?wt.mc_id=MVP_328341
else

Function Key with IP Whitelisting:

As you mentioned, using a function key along with IP whitelisting is one option. This ensures that only requests with a valid function key and originating from specified IP addresses (you may want to create self hosted agent ) can access your function. While not ideal, it does provide a level of security. API Management: You can set up Azure API Management in front of your Azure Function. API Management can act as a gateway, allowing you to enforce security policies, including authentication, IP filtering, rate limiting, and more. This allows you to use more advanced authentication mechanisms such as OAuth, client certificates, or even Azure AD authentication.

Hope this helps