question

FranciscoDominguez-7929 avatar image
0 Votes"
FranciscoDominguez-7929 asked MughundhanRaveendran-MSFT commented

Outbound IP addresses for Azure Function App

Hi,

I'm using certain API that needs IP whitelisting to be able to use it. I've built a couple of Azure Functions inside my Azure Function App and both of them make requests to that API. I have whitelisted the outbound IP addresses of the Azure Function App.

Today, when the trigger of the Azure Functions ran, they were using a different IP out of the list of the outbound IP addresses, and therefore, it was not whitelisted in the API:

200809-screenshot-from-2022-05-11-08-33-29.png



My list of outbound IP addresses does not include an IP similar to that one sending the request to the API.

Could you please guide me on what's going on here?

Regards,
Francisco.

azure-functions
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

MughundhanRaveendran-MSFT avatar image
1 Vote"
MughundhanRaveendran-MSFT answered MughundhanRaveendran-MSFT commented

@FranciscoDominguez-7929 ,

Thanks for reaching out to Q&A forum.

Please note that, the ip adresses of the function app shown in the portal (networking section) is actually the datacenter outbound ip address. So you might want to add the function apps' data center (Azure region) to an allowlist. You can download a JSON file that lists IP addresses for all Azure data centers.

Reference: https://docs.microsoft.com/en-us/azure/azure-functions/ip-addresses?msclkid=ada8be7ed0fb11ecb04d1cc6c5e3a0cd&tabs=portal#data-center-outbound-ip-addresses

The outbound ip addresses can change at any time if you are on Consumption or premium plan due to the Autoscale behavior. For a dedicated plan, the outbound ip address can change if you take any action that can change the inbound IP address or change your Dedicated (App Service) plan pricing tier.

You can control the IP address of outbound traffic from your functions by using a virtual network NAT gateway to direct traffic through a static public IP address. You can use this topology when running in a Premium plan or in a Dedicated (App Service) plan. Another option is to deploy the function in an App Service Environment.

Reference: https://docs.microsoft.com/en-us/azure/azure-functions/ip-addresses?msclkid=ada8be7ed0fb11ecb04d1cc6c5e3a0cd&tabs=portal#outbound-ip-address-changes

· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @MughundhanRaveendran-MSFT ,

I checked the JSON you linked in your comment, and the IP address 20.236.200.108 which appears in the picture I attached in my original post, is not listed in that JSON. Why?

Kind regards,
Francisco.

0 Votes 0 ·

@FranciscoDominguez-7929 , Is the function app directly calling the external API or it goes through any proxy or another service?

0 Votes 0 ·
FranciscoDominguez-7929 avatar image FranciscoDominguez-7929 MughundhanRaveendran-MSFT ·

@MughundhanRaveendran-MSFT The function app is directly calling the external API.

0 Votes 0 ·