Azure App IPs changing

Question

Hi I am facing an isseu that the outbound IP addresses on my FunctionApps (Consumption Plan) are changed but not at the same time. Some were changed few days ago, and next one today.

I read a documentation that it's possible that it will happen.

Is it possible to be notified about such a thing like IP adress change in advanced.
Because we have to whitelist them on our partners (on their provider). So it can takes days.

It means that withoud the information in advance our system is not working for days and customers get angry.

Thanks a lot.

Answer 1

Hello @Martin Nohejl
Unfortunately it is not possible to be notified when outbound IP address change in advanced, as it is controlled by Azure.
The IP address to use is selected randomly at runtime
https://learn.microsoft.com/en-us/azure/app-service/overview-inbound-outbound-ips#when-outbound-ips-change

You can find the set of all possible outbound IP addresses your app can use, regardless of pricing tiers, by looking for the possibleOutboundIpAddresses property or in the Additional Outbound IP Addresses field in the Properties blade of your WebApp.

There is also list with Azure IP Ranges and Service Tags – Public Cloud
https://www.microsoft.com/en-us/download/details.aspx?id=56519

Answer 2

Hello @Martin Nohejl ,

You can make the App Service outbound IP static using NAT Gateway and vNet integration. Step by step guide is here: https://sakaldeep.com.np/1193/azure-web-app-nat-gateway-and-vnet-integration-to-get-static-outbound-ip.

Answer 3

Hello @Martin Nohejl , You are not getting the VNet integration option as your application is running on consumption plan. https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options#matrix-of-networking-features

So, if you think that is the best solution fir your application you may consider the Azure function premium plan : https://learn.microsoft.com/en-us/azure/azure-functions/functions-premium-plan?tabs=portal

However, when function app is running on Consumption plan , we better need to whitelist the entire datacenter( Azure region) IP range to use the outbound IPs.

Here is how to do so:

https://learn.microsoft.com/en-us/azure/azure-functions/ip-addresses#data-center-outbound-ip-addresses ( which I believe you have already checked)
https://www.microsoft.com/en-us/download/details.aspx?id=56519

I would recommend you to consider using service tags : https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags