How to find Azure Function App IP for white-listing

12
votes

I have developed a PowerShell script to send mail to specified users using MX record DNS once in a day. Mails are delivered successfully but all mails are going in to Junk folder.

Exchange team have analyzed the message header and responded that sender IP addresses needs to be white-listed.

How to find Azure Function IP or IP range as I am using Consumption plan for my Function App.

Regards, K Senthilrajan

3
azureazure-functions
"Unfortunately we can't identify the IP address ranges for your function more specifically than the datacenter IP addresses." IP Address white-listing for Azure Function running under Consumption Plan – rickvdbosch

3 Answers

9
votes

In the background behind an Azure Function is an Azure App Service. So, how do you find the IP addresses it use?

There is the section containing current outbound IP addresses in the App Service settings page, see

Azure App Service - Outbound IP Addresses

But keep in mind, since the platform is a PaaS service, it might, without any notice, move to other hardware and get a totally different set of outbound IP addresses.

See this twitter conversation with Azure Support, for more details. Conclusion of the discussion is the IP range is not static and may change.

The only surefire way to know what IP's an Azure Function may be using, is to refer to the XML document published by Microsoft Azure that contain the entire IP range of all data centers, making this task a little difficult to implement.

6
votes

Unfortunately things have changed since Kim's answer. You now have to go into a JSON file via Azure Resource Manager to find the possible outbound IP addresses. Per the current Microsoft documentation:

  1. Sign in to the Azure Resource Explorer.
  2. Select subscriptions > {your subscription} > providers > Microsoft.Web > sites.
  3. In the JSON panel, find the site with an id property that ends in the name of your function app.
  4. See outboundIpAddresses and possibleOutboundIpAddresses.

Alternatively, you can also do it via the Az Powershell Module:

az webapp show --resource-group <group_name> --name <app_name> --query outboundIpAddresses --output tsv

az webapp show --resource-group <group_name> --name <app_name> --query possibleOutboundIpAddresses --output tsv

0
votes

I used this technique to dynamically identify the IP

Periodically the health endpoint will be called and the returned IP will be whitelisted.


app.get("/health", function(req, res) {
    unirest
    .get('https://<fn-appname>.azurewebsites.net/ipinfo')
    .headers({'Accept': 'application/json', 'Content-Type': 'application/json'})
    .send()
    .then((response) => {
        res.send(response.body);
      });

});

app.get("/ipinfo", function(req, res) {
    const ipaddress=req.headers['x-forwarded-for'];
    res.send({ip_address:ipaddress});
});