<p>Consumption Plan Function Apps are not able to be joined to a VNET.</p>

<p>Premium Function Apps however, can be.</p>

<p>If the container has sensitive information then you should not make it public, IP restriction shouldn't be your only protection.</p>

<p>Use another service (such as a function app) to determine a user's identity: then grant them a SAS token for the container.</p>

CC BY-SA 4.0
2019-12-05T16:09:36.117Z
2019-12-05T16:09:36.117Z
Nathan
<p>I am trying to connect a (python) function app to a storage resource. The storage has a public container that is accessed by several company internal HTML/CSS pages (<code>$web</code>). </p>

<p>Unfortunately, this container <em>should</em> contain sensitive information. So in order to prevent leaking data my choice was to configure the firewall to only allow the IP range that is used by the company. So far this seemed to work fine.</p>

<p>However, no I tried to automatically generate files (blobs) using a function app. Since only very few executions are necessary, there is no real justification of using anything but the "Consumption" plan of azure function apps. However, apparently this is not part of the trusted azure services, neither has a fixed IP nor can the consumption plan be set-up in a VNet, and thus it could not pass the storage containers firewall.</p>

<p>I tried adding the function app as a role with contributor rights. I tried adding the outbound IP addresses of the function app (to be found in the resource manager) to the firewall. But both things did not work.</p>

<p>Is there any workaround for this? </p>

<azure><firewall>
Consumption Plan Function App to Firewalled Storage problem
Timm
# Consumption Plan Function App to Firewalled Storage problem

(Asked by: username_0 on 2019-12-02)

I am trying to connect a (python) function app to a storage resource. The storage has a public container that is accessed by several company internal HTML/CSS pages (`$web`).

Unfortunately, this container *should* contain sensitive information. So in order to prevent leaking data my choice was to configure the firewall to only allow the IP range that is used by the company. So far this seemed to work fine.

However, no I tried to automatically generate files (blobs) using a function app. Since only very few executions are necessary, there is no real justification of using anything but the "Consumption" plan of azure function apps. However, apparently this is not part of the trusted azure services, neither has a fixed IP nor can the consumption plan be set-up in a VNet, and thus it could not pass the storage containers firewall.

I tried adding the function app as a role with contributor rights. I tried adding the outbound IP addresses of the function app (to be found in the resource manager) to the firewall. But both things did not work.

Is there any workaround for this?

**Tags:** azure, firewall


---

## 1 answers

### Answer by username_1 on 2019-12-05. Score: 2 | Accepted answer

Consumption Plan Function Apps are not able to be joined to a VNET.

Premium Function Apps however, can be.

If the container has sensitive information then you should not make it public, IP restriction shouldn't be your only protection.

Use another service (such as a function app) to determine a user's identity: then grant them a SAS token for the container.


---

