Actual IP address of Azure Function App is not listed in possibleOutboundIpAddresses

Zoltan Solya 21

Just noted that my Function App's actual IP address is not in the range listed in possibleOutboundIpAddresses...is that normal?

1 answer

MayankBargali-MSFT 68,476 Reputation points

2022-06-08T02:39:55.717+00:00

@Zoltan Solya Thanks for reaching out. Azure function uses app service environment, and the inbound and outbound IP addresses of an app can be different and can even change in certain situations. Therefore, the inbound IP address (actual IP address of azure function) can be different from outbound IP addresses (possibleOutboundIpAddresses) of the function app.

Azure App Service is a multi-tenant service, except for App Service Environments. Apps that are not in an App Service environment (not in the Isolated tier) share network infrastructure with other apps. As a result, the inbound and outbound IP addresses of an app can be different, and can even change in certain situations.

App Service Environments use dedicated network infrastructures, so apps running in an App Service environment get static, dedicated IP addresses both for inbound and outbound connections.

To know more details, you can refer to Inbound and outbound IP addresses in Azure App Service and IP addresses in Azure Functions document.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.
Zoltan Solya 21 Reputation points

2022-06-08T08:08:12.28+00:00

Thanks Mayank, that's well understood.

What I don't get is, why provide a possible pool of outbound IP addresses in the possibleOutboundIpAddresses field, if the outbound IP addresses can be from outside this pool?

The only solution I have seen was to move over to Premium tier and pay 100+ EUR/month...which is, like, 100x the cost I'm paying today for my Azure Function (and altogether it's more than double I'm paying for other Azure services).

Is that really the only way? Can't you guys just make your infrastructure respect the possibleOutboundIpAddresses when starting up the Function?

MayankBargali-MSFT 68,476 Reputation points

2022-06-08T14:50:15.163+00:00

@Zoltan Solya The outbound IP should be same from the possibleOutboundIpAddresses fields i.e. when you are making any call from function app to any outside service. Then the request can come from any of the possibleOutboundIpAddresses of your function app. But when you call the function app then that would be the inbound IP address. Inbound and outbound IP addresses can be different as per the architecture. Can you share more details on the business requirement why you want inbound and outbound IP address to be same? As you can whitelist the different IP inbound/outbound as per your client communicating with function app.

Hope this clears thing up. Feel free to get back to me if you have any queries or concerns.

Zoltan Solya 21 Reputation points

2022-06-08T15:00:28.36+00:00

Thanks Mayank, for elaborating further.

What I have observed so far is that my Function never uses an IP from the possibleOutboundIpAddresses pool. I created a Function within my Function App, which does nothing else but reports the outbound IP address by calling https://ifconfig.me. 5 mins ago, the IP address was 20.103.65.143, while the value of possibleOutboundIpAddresses is "51.124.22.192,51.124.22.215,51.124.23.119,51.138.16.35,51.124.21.175,51.138.20.233,51.138.21.47,51.138.21.189,51.138.22.34,51.138.22.122,51.138.22.229,51.138.104.128,51.138.105.63,51.138.105.163,51.138.105.196,51.138.106.37,51.138.22.141,51.138.106.177,51.138.81.107,51.138.81.170,40.114.174.73,51.138.81.175,51.138.82.168,51.138.82.188,20.50.2.42".

My problem is that clearly, the IP 20.103.65.143 did not come from the possibleOutboundIpAddresses pool, and it's the ~10th IP address I see today (none were in the possibleOutboundIpAddresses).

The Function is supposed to be triggered by a timer (or by a HTTP request for the admin), so the inbound IP address can be anything, I'm not using that for anything in my Function App, and it does not have to be the same as the outbound IP address.

Any suggestions how to address this problem? Is this normal that the outbound IP address is not from the possibleOutboundIpAddresses?

MayankBargali-MSFT 68,476 Reputation points

2022-06-10T03:23:11.433+00:00

@Zoltan Solya Thanks for clarifying it further. Yes, it is expected behavior if you are on Consumption or premium plan due to the Autoscale behavior. For more details refer to this document.

The outbound ip addresses can change at any time if you are on Consumption or premium plan due to the Autoscale behavior. For a dedicated plan, the outbound ip address can change if you take any action that can change the inbound IP address or change your Dedicated (App Service) plan pricing tier.

You can control the IP address of outbound traffic from your functions by using a virtual network NAT gateway to direct traffic through a static public IP address. You can use this topology when running in a Premium plan or in a Dedicated (App Service) plan. Another option is to deploy the function in an App Service Environment.

The alternative would add the function apps' data center (Azure region) to an allow list at your client end. To get the list of IP addresses for all Azure data centers you can refer to this.

**Note: ** Please make sure to refer Details section of Azure IP Ranges and Service Tags – Public Cloud.
Sign in to comment