Give Power Apps a Static Outbound IP With a Relay Function

Power Apps reaches external APIs through custom connectors, and those connectors run on Microsoft's infrastructure. There's no field to set an HTTP proxy and no way to pin the outbound IP. When a vendor asks you to allowlist a fixed IP, Power Apps has nothing fixed to give them. A small relay function fixes that. You host the relay, the relay egresses through QuotaGuard, and your API sees two stable static IPs.

Power Apps Custom Connectors Egress From Microsoft's Shared IP Ranges

A custom connector is a wrapper around a REST API. Power Apps runs it on Microsoft-managed infrastructure, so the outbound call leaves from Microsoft's regional connector IP ranges, published as the AzureConnectors service tags. Those ranges are large, shared across every tenant in the region, and updated on Microsoft's schedule. Verify the current ranges in Microsoft's managed connectors outbound IP documentation before relying on them.

That model breaks IP allowlisting. Your vendor wants a short, stable list of addresses. Microsoft gives you wide regional blocks that change and that you don't control. The custom connector definition has no proxy setting, so you can't route the call through a fixed egress on the platform itself. You need the fixed IP to live outside Power Apps.

A Relay Function Gives Power Apps Two Static IPs to Allowlist

The pattern is simple. You deploy a small relay function on AWS Lambda or a Google Cloud Function. The relay egresses through QuotaGuard using the QUOTAGUARDSTATIC_URL connection. Your custom connector calls the relay function URL instead of calling the target API directly. The relay forwards the request, and the target API sees QuotaGuard's two load-balanced static IPs. You allowlist both IPs with the vendor, and Power Apps never touches the proxy directly.

QuotaGuard maintains a ready-to-run relay so you don't write it from scratch. The published example lives at github.com/quotaguard/static-examples, and the reusable pattern is documented at quotaguard.com/docs/platforms/static-ip-no-http-proxy. The relay pattern exists because platforms like Power Apps run on managed infrastructure with no place to configure a proxy. That's a QuotaGuard architectural note, not a Power Apps limitation you can toggle off.

Both static IPs belong to your QuotaGuard subscription. Every subscription includes two load-balanced static IPs. Submit both to your vendor when you allowlist.

Point Your Custom Connector at the Relay Function URL

Deploy the relay first. Set its QUOTAGUARDSTATIC_URL environment variable to your QuotaGuard connection string and set a secret for the X-Relay-Key header. Then build a Power Apps custom connector whose host is the relay function URL. The connector sends two headers: X-Relay-Key with your shared secret, and X-Target-URL with the real API you want to reach. The relay validates the key, forwards the request through QuotaGuard, and returns the response.

Here's the request your custom connector sends to the relay:

POST https://your-relay-id.lambda-url.us-east-1.on.aws/
X-Relay-Key: your-shared-secret
X-Target-URL: https://api.yourvendor.com/v1/resource
Content-Type: application/json

{ "field": "value" }

Test it before you wire in the real API. Point X-Target-URL at https://ip.quotaguard.com, which returns one of your two static IPs. Run the same call with curl to confirm the relay works outside Power Apps:

curl -X POST "https://your-relay-id.lambda-url.us-east-1.on.aws/" \
  -H "X-Relay-Key: your-shared-secret" \
  -H "X-Target-URL: https://ip.quotaguard.com"

The response is one of the two static IPs on your subscription. Call it a few times and you'll see both, because they sit behind a load balancer. Those are the addresses you hand your vendor. Your QuotaGuard region is set when you sign up, so pick the region closest to your target API. Changing it later means contacting QuotaGuard support.

QuotaGuard Static Pricing Starts at $19/Month

QuotaGuard Static is the right product for standard HTTPS API calls. On outbound HTTPS it uses a CONNECT tunnel, so your payload is tunneled end to end and never decrypted at the proxy. Bandwidth is bundled and there are no per-GB overage fees. For most Power Apps relay traffic, a handful of API calls per run, the entry tier is plenty. Dedicated IPs are available on Enterprise and above. On lower tiers your two assigned IPs are still static, but shared with other customers.

QuotaGuard Shield Pricing Starts at $29/Month

Use QuotaGuard Shield only if your relay carries regulated data. Shield uses SSL passthrough, so the TLS connection runs end to end and QuotaGuard doesn't decrypt your payload in ordinary operation. That's what makes it suitable for HIPAA, PCI-DSS, and SOC 2 workflows. Shield costs slightly more than Static at each tier because passthrough adds routing overhead. If your Power Apps flow moves health records, payment data, or other regulated information, the compliance coverage is worth the difference.

All plans include a 3-day trial. Enterprise plans include a 7-day trial. A credit card is required.

Power Apps won't give you a static outbound IP on its own, but a relay function does the job cleanly. Deploy the relay, point your custom connector at its URL, and allowlist your subscription's two static IPs with the vendor. Start from the ready-to-run example at the QuotaGuard relay repo, follow the full walkthrough at the relay docs page, and see plans at quotaguard.com/products/pricing.