I am trying to connect a (python) function app to a storage resource. The storage has a public container that is accessed by several company internal HTML/CSS pages ($web).

Unfortunately, this container should contain sensitive information. So in order to prevent leaking data my choice was to configure the firewall to only allow the IP range that is used by the company. So far this seemed to work fine.

However, no I tried to automatically generate files (blobs) using a function app. Since only very few executions are necessary, there is no real justification of using anything but the "Consumption" plan of azure function apps. However, apparently this is not part of the trusted azure services, neither has a fixed IP nor can the consumption plan be set-up in a VNet, and thus it could not pass the storage containers firewall.

I tried adding the function app as a role with contributor rights. I tried adding the outbound IP addresses of the function app (to be found in the resource manager) to the firewall. But both things did not work.

Is there any workaround for this?

1 Answer 1


Consumption Plan Function Apps are not able to be joined to a VNET.

Premium Function Apps however, can be.

If the container has sensitive information then you should not make it public, IP restriction shouldn't be your only protection.

Use another service (such as a function app) to determine a user's identity: then grant them a SAS token for the container.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.