Web app (Linux) OutBound IP's

Question

Hello,

I have an Azure Web App that is configured with a set of outbound IP addresses. My production database firewall is restricted to allow only these IPs. Could you please confirm under what conditions (if any) the outbound IP addresses for the Web App may change? For example, would they change during scaling operations, service plan changes, regional maintenance, or upgrades?

I need to understand if the outbound IPs are guaranteed to remain static, or if they can change unexpectedly, so I can ensure uninterrupted connectivity between the Web App and the production database.

Thank you.

Answer 1

Hi Martin Bardarov
Your Azure Web App's outbound IP addresses may change in certain situations.

Recreating the app in a different resource group can result in different outbound IP addresses.

Changing your app's tier (Basic, Standard, Premium, PremiumV2, PremiumV3) may add or remove outbound IP addresses.

 Removing the last app in a resource group and region, then recreating it, may also change outbound IP addresses.

Keep in mind that outbound IP addresses are not fixed. Make sure your production database firewall allows all possible outbound IP addresses for your app.

• When outbound IPs change
• Find outbound IPs
  Let me know if you have any further assistances needed.

Answer 2

Hi Martin Bardarov

Thank you for posting your question on Microsoft Q&A.

Outbound IP addresses of an Azure Web App can change in several scenarios, including:

• Scaling operations (scale up or scale out)
• Service plan changes (for example, moving between pricing tiers)
• Regional moves (migrating the Web App to another Azure region)
• Platform updates or maintenance performed by Azure
• Deleting and recreating the Web App

Because of these possibilities, the outbound IPs are not guaranteed to remain static. To ensure uninterrupted and secure connectivity with your production database, it is recommended to use Azure Virtual Network (VNet) integration with Service Endpoints or Private Link rather than relying on the outbound IP addresses directly.

Refer When outbound IPs change