I need to setup my app service with a static IP address. Can this be accomplished if I use Azure Front Door?

@Mimi La Bella Thank you for reaching out. I understand you wish to set a static IP address for your app service and you want to know if this can be accomplished by using Azure Front Door. The answer here is no because as documented here in FAQ The IP address of your Front Door's frontend anycast is fixed and might not change as long as you use the Front Door. However, the fixed IP address of your Front Door's frontend anycast isn't a guarantee. Avoid relying on the IP directly. Azure Front Door is a dynamic service that routes traffic to the best available backend. It doesn't offer static or dedicated frontend anycast IPs at this time. If the requirement here is to have IP based restriction via a Firewall then you can use IP address AzureFrontDoor.Frontend service tag which contains the IP addresses that clients use to reach Front Door. You can get the list of IP's associated with this service tag by downloading the Azure IP Ranges and Service Tags file here . (Search for AzureFrontDoor.Frontend to get the list of IP addresses in the file). If this does not satisfy your requirement it will help if you could file feedback request on our feedback portal here . Hope this helps! Please let me know if you have any additional questions or you need any additional information. Thank you! Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Azure App service static Outbound IP address. Can this be accomplished if I use Azure Front Door?

Accepted answer

ChaitanyaNaykodi-MSFT 26,526 Reputation points Microsoft Employee

2024-11-11T22:09:21.92+00:00

@Mimi La Bella

Thank you for reaching out.

I understand you wish to set a static IP address for your app service and you want to know if this can be accomplished by using Azure Front Door.

The answer here is no because as documented here in FAQ

The IP address of your Front Door's frontend anycast is fixed and might not change as long as you use the Front Door. However, the fixed IP address of your Front Door's frontend anycast isn't a guarantee. Avoid relying on the IP directly. Azure Front Door is a dynamic service that routes traffic to the best available backend. It doesn't offer static or dedicated frontend anycast IPs at this time.

If the requirement here is to have IP based restriction via a Firewall then you can use IP address AzureFrontDoor.Frontend service tag which contains the IP addresses that clients use to reach Front Door. You can get the list of IP's associated with this service tag by downloading the Azure IP Ranges and Service Tags file here. (Search for AzureFrontDoor.Frontend to get the list of IP addresses in the file).
If this does not satisfy your requirement it will help if you could file feedback request on our feedback portal here.

Hope this helps! Please let me know if you have any additional questions or you need any additional information. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Mimi La Bella 20 Reputation points

2024-11-12T13:50:46.1933333+00:00

I would like to explain better. I currently use Azure Front Door to access my app services. One in Central US and one in East US 2, as part of my high availability environment. Microsoft provides an inbound IP address and many outbound IP addresses for each App Service. I have a vendor that is limiting me to 10 IP addresses coming from my App Services. My thought was I could setup a static IP address for each App Service and then only need to provide the 2 inbound IP addresses and 2 outbound IP addresses. Can I setup the static outbound IP addresses for each App Service by using a NAT Gateway and integration while continuing to use Azure Front Door.

ChaitanyaNaykodi-MSFT 26,526 Reputation points Microsoft Employee

2024-11-12T22:31:43.8266667+00:00

@Mimi La Bella

Thank you for getting back and providing the clarification here.

Can I setup the static outbound IP addresses for each App Service by using a NAT Gateway and integration while continuing to use Azure Front Door.

In this case yes the above architecture will be possible.

When the APP service has VNET integration with NAT Gateway then NAT gateway's IP will be used as the outbound IP address of the App Service

With VNET integration the Front End of the Web App is still accessible via internet so you will not face any issue in accessing it from Azure Front Door. For Front Door the origin must have a public IP or a DNS hostname that can be resolved publicly.

Since your App Service will be publicly accessible in this case, you can use Azure App Service access restrictions so that is only accessible via Azure Front Door and the Public IP addresses used by your Vendor. Link more specific to Front Door access.

I am adding a few documentation links below for additional references for configuration

https://learn.microsoft.com/en-us/azure/app-service/overview-nat-gateway-integration

https://learn.microsoft.com/en-us/azure/app-service/overview-inbound-outbound-ips#when-inbound-ip-changes

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq#what-type-of-resources-are-currently-compatible-as-an-origin-

https://learn.microsoft.com/en-us/azure/app-service/configure-vnet-integration-routing

https://learn.microsoft.com/en-us/azure/nat-gateway/troubleshoot-nat-and-azure-services#app-services-isnt-using-the-nat-gateway-public-ip-address-to-connect-outbound

Hope this helps! Please let me know if you have any additional questions or you need any additional information. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure App service static Outbound IP address. Can this be accomplished if I use Azure Front Door?

1 additional answer

Your answer