Azure Firewall Container Apps

Question

Azure Firewall Container Apps

Phillip S. Stenger Jr 65

I am trying to enable Azure Firewall on a Container Apps Environment. I have set up the UDR and created Allow rules as documented here: https://learn.microsoft.com/en-us/azure/container-apps/use-azure-firewall

However I am noticing requests being blocked still to the following addresses: acs-mirror.azureedge.net, management.azure.com, gsm1776064220eh.servicebus.windows.net, and packages.aks.azure.com.

None of these are present in the documentation for what needs to be enabled in the above article. However I found all but the servicebus FQDN listed for AKS. Is there a reason they are not listed for Container Apps as well? I have not figured out where the servicebus request is coming from. The only application in the environment is a GitHub runner which from what I can find shouldn't be requesting to servicebus, but I'm not positive.

Praveen Kumar Gudipudi 2,290 Reputation points Microsoft External Staff Moderator

2025-09-15T13:42:10.61+00:00
Phillip S. Stenger Jr,

Thanks for reaching out.

Consider Azure Diagnostics: Enable diagnostics logging for your Azure Firewall, which might help you understand what’s being blocked and why. You can find out more about enabling logging in the Azure Firewall documentation.

Enable and configure diagnostic logging and metrics for the Azure Firewall

Please share me below details:

What specific Allow rules did you create, and are they set for both inbound and outbound traffic?

Have you checked the Azure Firewall logs to see the exact details of the blocked requests?

Is your Azure Container App environment integrated into a Virtual Network? If so, could you share more about the NSG rules and UDR you have in place?

Have you attempted to run any diagnostics or network tracing to gather more insights on the request origins?
Phillip S. Stenger Jr 65 Reputation points

2025-09-15T14:00:02.7233333+00:00
I have created the Allow rules as outlined in the article I linked above. They are outbound rules- Yes, the logs show that the requests are coming from the Container Apps Environment Subnet

Yes. NSG rules have been created according to https://learn.microsoft.com/en-us/azure/container-apps/firewall-integration?tabs=workload-profiles

I have not. Can you suggest a process to gather more insights? I can see the IP address that the request originated from, but how do I get more info on what is actually making the request?
Anonymous

2025-09-16T10:45:21.7766667+00:00

Hello Phillip S. Stenger Jr,

I hope the provided answer is helpful, do let me know if you have any further questions on this Please accept as Yes if the answer is helpful so that it can help others in the community.

Thanks

Answer accepted by question author

0 additional answers

Your answer

Praveen Kumar Gudipudi 2,290 Reputation points Microsoft External Staff Moderator

2025-09-15T13:42:10.61+00:00

Phillip S. Stenger Jr,

Thanks for reaching out.

Consider Azure Diagnostics: Enable diagnostics logging for your Azure Firewall, which might help you understand what’s being blocked and why. You can find out more about enabling logging in the Azure Firewall documentation.

Enable and configure diagnostic logging and metrics for the Azure Firewall

Please share me below details:

What specific Allow rules did you create, and are they set for both inbound and outbound traffic?

Have you checked the Azure Firewall logs to see the exact details of the blocked requests?

Is your Azure Container App environment integrated into a Virtual Network? If so, could you share more about the NSG rules and UDR you have in place?

Have you attempted to run any diagnostics or network tracing to gather more insights on the request origins?
Phillip S. Stenger Jr 65 Reputation points

2025-09-15T14:00:02.7233333+00:00

I have created the Allow rules as outlined in the article I linked above. They are outbound rules- Yes, the logs show that the requests are coming from the Container Apps Environment Subnet

Yes. NSG rules have been created according to https://learn.microsoft.com/en-us/azure/container-apps/firewall-integration?tabs=workload-profiles

I have not. Can you suggest a process to gather more insights? I can see the IP address that the request originated from, but how do I get more info on what is actually making the request?
Anonymous

2025-09-16T10:45:21.7766667+00:00

Hello Phillip S. Stenger Jr,

I hope the provided answer is helpful, do let me know if you have any further questions on this Please accept as Yes if the answer is helpful so that it can help others in the community.

Thanks

Answer 1

oh Phillip, this is a classic azure firewall gotcha. you followed the docs to the letter, but then real world traffic throws a bunch of new FQDNs at you that are not in the guide.

you are absolutely right. the documentation for container apps and azure firewall is not fully comprehensive. those FQDNs you discovered are critical for the underlying container apps infrastructure to function, especially for image pulling and management operations. it is a documentation gap that they are not explicitly listed.

for your microsoft azure solution, you need to add application rules in your azure firewall to allow outbound traffic to these newly discovered FQDNs. based on your list, you will need to create rules for.

acs-mirror.azureedge.net - this is for container image pulls.

management.azure.com - this is for control plane communication.

*.servicebus.windows.net - use a wildcard for servicebus. this is used for internal messaging and logging.

packages.aks.azure.com - this is for core kubernetes components.

the reason you see these for aks and not container apps is because container apps is built on aks. it uses the same underlying plumbing, so it needs the same endpoints https://learn.microsoft.com/azure/aks/limit-egress-traffic

the servicebus call is likely coming from the container apps runtime itself, not your github runner. the platform uses it for internal coordination. adding a wildcard rule for *.servicebus.windows.net should resolve that block.

when building firewall rules for a new azure service, enable logging and set a wide allow rule initially. watch the logs for a few days to see all the FQDNs that are being hit. then, build your specific deny rules based on that real traffic. it is a more reliable way to find all the required endpoints.

use fully qualified domain name (fqdn) tags in your firewall rules when available. for example, there is an 'azurekuberneteservice' tag that bundles many of the necessary aks endpoints. check if there is a similar tag for container apps.

Best regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/

Share via

Azure Firewall Container Apps

0 additional answers

Your answer