This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 26%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
Access Forbidden when calling Azure Function
I am trying to send a json with data, created dynamically within Azure Data Factory pipeline through HTTP Post request of Azure Function Activity to Azure Function. During the debug, I am getting the error:
Error code3608
Failure type User configuration issue
Details Call to provided Azure function 'XXX' failed with status-'Forbidden' and message….
The web app you have attempted to reach has blocked your access
Source
Pipeline
NotifUrDownloads_test3
ADF settings:
Web-App Networking - > Access Restriction settings
Do not understand why the web app has blocked the access. I have added the IP of the self-hosted Integration Runtime to the Networking - > Access Restriction settings of the Web App (App Service) to allow an access. I have also asked “Diagnose & Solve Problems” setting of the Web App with a question of “Which client IPs got rejected due to IP restriction?” and found no information my IR machine was blocked.
Thanks in advance for any suggestions
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 44%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
@braxx Thanks for using Microsoft Q&A !!
I believe that IP address of the self-hosted integration runtime has not been added correctly and that is only causing this failure. Can you please make sure that you are adding the correct public IP of the machine where your SHIR resides. Please check if going to whatismyipaddress from that machine gives you the same. If SHIR is on your local and you are using wireless connection then you can access your router’s administration page to get public IP address about your Internet connection.
I am able to reproduce the same and once I have added the correct IP, my ADF calling an Azure function started working fine.
Thanks for your engagement.
I checked this IP several times. SHIR resides on Azure VM within the same resource group as ADF, Web-App and Azure Function. It's has a private IP.
I've add this IP to both:
Web-App: Networking - > Access Restriction -> Add rule
Function App: Networking - > Access Restriction -> Add rule
Web-App plan is dev/test B3.
The blocked IP doesn't come from my environmet. Looks like the Microsoft IP.
Checked also, that googling "whatsmyip" on th IR matchine returns dynamic IPs, different then Private IP of the IR machine.
Do I need to have my app service plan in ASE? That would be a problem for my applicaton
@braxx Ok got it. My SHIR is in local and with my public IP it worked. I am trying to check with SHIR on Azure VM and get back to you on the same.
@braxx I have checked with SHIR on VM with public ip's and it worked fine, however I facing issues using private ip's which I am currently looking into. Have you tried using public ip's to test your function call ? Can you please also share the ipconfig settings of the vm ? Also, how web app comes into your function call from ADF ?
@braxx Please let me know if you still needs help on this issue.
Get this finally resolved by migrating azure function-app to Isolated (within ASE) App-Service-Plan
@braxx Great. Thanks for sharing your resolution as this will help other community members.
----------
Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.