Public IP addresses

Public IP addresses allow Internet resources to communicate inbound to Azure resources. Public IP addresses enable Azure resources to communicate to Internet and public-facing Azure services. The address is dedicated to the resource, until it’s unassigned by you. A resource without a public IP assigned can communicate outbound. Azure dynamically assigns an available IP address that isn’t dedicated to the resource. For more information about outbound connections in Azure, see Understand outbound connections.

In Azure Resource Manager, a public IP address is a resource that has its own properties. Some of the resources you can associate a public IP address resource with:

• Virtual machine network interfaces
• Internet-facing load balancers
• VPN gateways
• Application gateways
• Azure Firewall

IP address version

Public IP addresses are created with an IPv4 or IPv6 address.

To learn about SKU upgrade, refer to Public IP upgrade.

Public IP addresses are created with one of the following SKUs:

Matching SKUs are required for load balancer and public IP resources. You can’t have a mixture of basic SKU resources and standard SKU resources. You can’t attach standalone virtual machines, virtual machines in an availability set resource, or a virtual machine scale set resources to both SKUs simultaneously. New designs should consider using Standard SKU resources. Please review Standard Load Balancer for details.

Standard

Standard SKU public IP addresses:

• Always use static allocation method.
• Have an adjustable inbound originated flow idle timeout of 4-30 minutes, with a default of 4 minutes, and fixed outbound originated flow idle timeout of 4 minutes.
• Secure by default and closed to inbound traffic. Allow list inbound traffic with a network security group.
• Assigned to network interfaces, standard public load balancers, or Application Gateways. For more information about Standard load balancer, see Azure Standard Load Balancer.
• Can be zone-redundant (advertised from all 3 zones), zonal (guaranteed in a specific pre-selected availability zone), or no-zone (not associated with a specific pre-selected availability zone). To learn more about availability zones, see Availability zones overview and Standard Load Balancer and Availability Zones. Zone redundant IPs can only be created in regions where 3 availability zones are live. IPs created before zones are live will not be zone redundant.
• Can be used as anycast frontend IPs for cross-region load balancers (preview functionality).

Inbound communication with a Standard SKU resource fails until you create and associate a network security group and explicitly allow the desired inbound traffic.

Only Public IP addresses with basic SKU are available when using instance metadata service IMDS. Standard SKU is not supported.

Diagnostic settings does not appear under the resouce blade when using a Standard SKU Public IP address. To enable logging on your Standard Public IP address resource navigate to diagnostic settings under the Azure Monitor blade and select your IP address resource.

Basic

All public IP addresses created before the introduction of SKUs are Basic SKU public IP addresses.

With the introduction of SKUs, specify which SKU you would like the public IP address to be.

Basic SKU addresses:

• Assigned with the static or dynamic allocation method.
• Have an adjustable inbound originated flow idle timeout of 4-30 minutes, with a default of 4 minutes, and fixed outbound originated flow idle timeout of 4 minutes.
• Are open by default. Network security groups are recommended but optional for restricting inbound or outbound traffic.
• Assigned to any Azure resource that can be assigned a public IP address, such as:
  • Network interfaces
  • VPN Gateways
  • Application Gateways
  • Public load balancers
• Don’t support Availability Zone scenarios. Use Standard SKU public IP for Availability Zone scenarios. To learn more about availability zones, see Availability zones overview and Standard Load Balancer and Availability Zones.

Allocation method

Basic and standard public IPs support static assignment. The resource is assigned an IP address at the time it’s created. The IP address is released when the resource is deleted.

Basic SKU public IP addresses support a dynamic assignment. Dynamic is the default assignment method. The IP address isn’t given to the resource at the time of creation when selecting dynamic.

The IP is assigned when you associate the public IP address resource with a:

• Virtual machine
• The first virtual machine is associated with the backend pool of a load balancer.

The IP address is released when you stop (or delete) the resource.

For example, a public IP resource is released from a resource named Resource A. Resource A receives a different IP on start-up if the public IP resource is reassigned.

The IP address is released when the allocation method is changed from static to dynamic. To ensure the IP address for the associated resource remains the same, set the allocation method explicitly to static. A static IP address is assigned immediately.

Even when you set the allocation method to static, you cannot specify the actual IP address assigned to the public IP address resource. Azure assigns the IP address from a pool of available IP addresses in the Azure location the resource is created in.

Static public IP addresses are commonly used in the following scenarios:

• When you must update firewall rules to communicate with your Azure resources.
• DNS name resolution, where a change in IP address would require updating A records.
• Your Azure resources communicate with other apps or services that use an IP address-based security model.
• You use TLS/SSL certificates linked to an IP address.

Azure allocates public IP addresses from a range unique to each region in each Azure cloud. You can download the list of ranges (prefixes) for the Azure Public, US government, China, and Germany clouds.

DNS hostname resolution

Select the option to specify a DNS domain name label for a public IP resource.

This selection creates a mapping for domainnamelabel.location.cloudapp.azure.com to the public IP in the Azure-managed DNS.

For instance, creation of a public IP with:

• contoso as a domainnamelabel
• West US Azure location

The fully qualified domain name (FQDN) contoso.westus.cloudapp.azure.com resolves to the public IP address of the resource.

Each domain name label created must be unique within its Azure location.

DNS Recommendations

If a region move is needed, you can’t migrate the FQDN of your public IP. Use the FQDN to create a custom CNAME record pointing to the public IP address.

If a move to a different public IP is required, update the CNAME record instead of updating the FQDN.

You can use Azure DNS or an external DNS provider for your DNS Record.

Virtual machines

You can associate a public IP address with a Windows or Linux virtual machine by assigning it to its network interface.

Choose dynamic or static for the public IP address. Learn more about assigning IP addresses to network interfaces.

Internet-facing load balancers

You can associate a public IP address of either SKU with an Azure Load Balancer, by assigning it to the load balancer frontend configuration. The public IP serves as a load-balanced IP.

You can assign either a dynamic or a static public IP address to a load balancer front end. You can assign multiple public IP addresses to a load balancer front end. This configuration enables multi-VIP scenarios like a multi-tenant environment with TLS-based websites.

For more information about Azure load balancer SKUs, see Azure load balancer standard SKU.

VPN gateways

Azure VPN Gateway connects an Azure virtual network to:

• Azure virtual networks
• On-premises network(s).

A public IP address is assigned to the VPN Gateway to enable communication with the remote network.

• Assign a dynamic basic public IP to a VPNGw 1-5 SKU front-end configuration.
• Assign a static standard public IP address to a VPNGwAZ 1-5 SKU front-end configuration.

Application gateways

You can associate a public IP address with an Azure Application Gateway, by assigning it to the gateway’s frontend configuration.

• Assign a dynamic basic public IP to an application gateway V1 front-end configuration.
• Assign a static standard public IP address to a V2 front-end configuration.

Azure Firewall

Azure Firewall allows you to create, enforce, and log application and network connectivity policies across subscriptions and virtual networks.

You can only associate static standard public IP addresses with a firewall. This allows outside firewalls to identify traffic originating from your virtual network.

At-a-glance

The following table shows the property through which a public IP can be associated to a top-level resource and the possible allocation methods.

Top-level resource	IP Address association	Dynamic	Static
Virtual machine	Network interface	Yes	Yes
Internet-facing Load balancer	Front-end configuration	Yes	Yes
VPN gateway	Gateway IP configuration	Yes	No
Application gateway	Front-end configuration	Yes (V1 only)	Yes (V2 only)
Azure Firewall	Front-end configuration	No	Yes

Limits

The limits for IP addressing are listed in the full set of limits for networking in Azure.

The limits are per region and per subscription. Contact support to increase the default limits up to the maximum limits based on your business needs.

Pricing

Public IP addresses may have a nominal charge. To learn more about IP address pricing in Azure, review the IP address pricing page.

IP addresses in Azure Functions

This article explains the following concepts related to IP addresses of function apps:

• Locating the IP addresses currently in use by a function app.
• Conditions that cause function app IP addresses to changed.
• Restricting the IP addresses that can access a function app.
• Defining dedicated IP addresses for a function app.

IP addresses are associated with function apps, not with individual functions. Incoming HTTP requests can’t use the inbound IP address to call individual functions; they must use the default domain name (functionappname.azurewebsites.net) or a custom domain name.

Function app inbound IP address

Each function app has a single inbound IP address. To find that IP address:

1. Sign in to the Azure portal.
2. Navigate to the function app.
3. Under Settings, select Properties. The inbound IP address appears under Virtual IP address.

Function app outbound IP addresses

Each function app has a set of available outbound IP addresses. Any outbound connection from a function, such as to a back-end database, uses one of the available outbound IP addresses as the origin IP address. You can’t know beforehand which IP address a given connection will use. For this reason, your back-end service must open its firewall to all of the function app’s outbound IP addresses.

To find the outbound IP addresses available to a function app:

1. Sign in to the Azure Resource Explorer.
2. Select subscriptions >> providers > Microsoft.Web > sites.
3. In the JSON panel, find the site with an id property that ends in the name of your function app.
4. See outboundIpAddresses and possibleOutboundIpAddresses .

The set of outboundIpAddresses is currently available to the function app. The set of possibleOutboundIpAddresses includes IP addresses that will be available only if the function app scales to other pricing tiers.

An alternative way to find the available outbound IP addresses is by using the Cloud Shell:

When a function app that runs on the Consumption plan or the Premium plan is scaled, a new range of outbound IP addresses may be assigned. When running on either of these plans, you may need to add the entire data center to an allow list.

Data center outbound IP addresses

If you need to add the outbound IP addresses used by your function apps to an allowlist, another option is to add the function apps’ data center (Azure region) to an allowlist. You can download a JSON file that lists IP addresses for all Azure data centers. Then find the JSON fragment that applies to the region that your function app runs in.

For example, the following JSON fragment is what the allowlist for Western Europe might look like:

For information about when this file is updated and when the IP addresses change, expand the Details section of the Download Center page.

Inbound IP address changes

The inbound IP address might change when you:

• Delete a function app and recreate it in a different resource group.
• Delete the last function app in a resource group and region combination, and re-create it.
• Delete a TLS binding, such as during certificate renewal.

When your function app runs in a Consumption plan or in a Premium plan, the inbound IP address might also change even when you haven’t taken any actions such as the ones listed above.

Outbound IP address changes

The set of available outbound IP addresses for a function app might change when you:

• Take any action that can change the inbound IP address.
• Change your App Service plan pricing tier. The list of all possible outbound IP addresses your app can use, for all pricing tiers, is in the possibleOutboundIPAddresses property. See Find outbound IPs.

When your function app runs in a Consumption plan or in a Premium plan, the outbound IP address might also change even when you haven’t taken any actions such as the ones listed above.

Use the following procedure to deliberately force an outbound IP address change:

Scale your App Service plan up or down between Standard and Premium v2 pricing tiers.

Wait 10 minutes.

Scale back to where you started.

IP address restrictions

You can configure a list of IP addresses that you want to allow or deny access to a function app. For more information, see Azure App Service Static IP Restrictions.

Dedicated IP addresses

There are several strategies to explore when your function app requires static, dedicated IP addresses.

Virtual network NAT gateway for outbound static IP

You can control the IP address of outbound traffic from your functions by using a virtual network NAT gateway to direct traffic through a static public IP address. You can use this topology when running in a Premium plan. To learn more, see Tutorial: Control Azure Functions outbound IP with an Azure virtual network NAT gateway.

App Service Environments

For full control over the IP addresses, both inbound and outbound, we recommend App Service Environments (the Isolated tier of App Service plans). For more information, see App Service Environment IP addresses and How to control inbound traffic to an App Service Environment.

To find out if your function app runs in an App Service Environment:

1. Sign in to the Azure portal.
2. Navigate to the function app.
3. Select the Overview tab.
4. The App Service plan tier appears under App Service plan/pricing tier. The App Service Environment pricing tier is Isolated.

As an alternative, you can use the Cloud Shell:

The App Service Environment sku is Isolated .

Next steps

A common cause of IP changes is function app scale changes. Learn more about function app scaling.