QuotaGuard and Azure Functions / App Service Integration Guide

QuotaGuard Static IPs give your Azure Functions and App Service apps two fixed outbound IP addresses from application settings, with no VNet integration or NAT Gateway to build. Set HTTP_PROXY and HTTPS_PROXY in your app settings, and outbound calls exit from one of your two static IPs.

Why Azure Functions and App Service Need a Static IP

Azure Functions and App Service send outbound traffic from a set of possible outbound IP addresses that is shared and can change when you scale or change tier. A destination that requires a known, stable source IP cannot rely on that set. You need a fixed pair you control.

Getting Started

After creating a QuotaGuard account, you are redirected to your dashboard, where you can find your proxy credentials and two static IP addresses.

Choose the right proxy region: Select the QuotaGuard region closest to your Azure region to minimize latency. The region is set at sign-up. Changes after sign-up require contacting support.

Step 1: Set the Proxy in Application Settings

Azure Functions and App Service apps read the standard HTTP_PROXY and HTTPS_PROXY variables from application settings. Node, Python, and .NET (HttpClient.DefaultProxy on .NET Core 3.0 and later) honor them.

For a Function App:

az functionapp config appsettings set -g <resource-group> -n <app-name> --settings \
  HTTP_PROXY="http://username:password@<your-quotaguard-proxy-host>:9293" \
  HTTPS_PROXY="http://username:password@<your-quotaguard-proxy-host>:9293"

For an App Service web app:

az webapp config appsettings set -g <resource-group> -n <app-name> --settings \
  HTTP_PROXY="http://username:password@<your-quotaguard-proxy-host>:9293" \
  HTTPS_PROXY="http://username:password@<your-quotaguard-proxy-host>:9293"

You can also set these under Settings > Environment variables (formerly Configuration > Application settings) in the portal. The app restarts to pick up new settings.

Step 2: Route Outbound Traffic Through the Proxy

For runtimes that honor the proxy variables, no code change is needed. To be explicit, or for full control in .NET, attach the proxy in code.

.NET (HttpClient with WebProxy)

var proxyUri = new Uri(Environment.GetEnvironmentVariable("HTTPS_PROXY"));
var parts = proxyUri.UserInfo.Split(':');
var handler = new HttpClientHandler
{
    Proxy = new WebProxy(proxyUri) { Credentials = new NetworkCredential(parts[0], parts[1]) },
    UseProxy = true
};
var client = new HttpClient(handler);
var resp = await client.GetAsync("https://api.example.com/data");

Node.js

const { ProxyAgent, fetch } = require('undici');
const dispatcher = new ProxyAgent(process.env.HTTPS_PROXY);

const res = await fetch('https://api.example.com/data', { dispatcher });
console.log(await res.json());

Python

import os, requests

p = os.environ["HTTPS_PROXY"]
r = requests.get("https://api.example.com/data", proxies={"http": p, "https": p})
print(r.json())

Testing Your App Is Using the Static IP

For an App Service web app, open an SSH session and check the egress IP:

az webapp ssh -g <resource-group> -n <app-name>
# inside the container:
curl -x "$HTTPS_PROXY" https://ip.quotaguard.com

Azure Functions does not offer an interactive shell on all plans, so test through an HTTP-triggered function that fetches https://ip.quotaguard.com through the proxy and returns the result. Expected response:

{"ip":"<one of your two QuotaGuard static IPs>"}

The returned IP must be one of the two static IPs in your QuotaGuard dashboard. Run it more than once to see both (load-balanced).

A Note on the Native VNet and NAT Gateway Path

Azure’s native answer is VNet integration plus a NAT Gateway with a reserved static public IP, with WEBSITE_VNET_ROUTE_ALL=1 to route all outbound traffic through it. It works and is the right choice for some architectures. It also carries real constraints. VNet integration is available on Premium, Dedicated (App Service), and Flex Consumption plans, but not on the standard Consumption plan, so you may need to change plans to use it. Pinning the egress IP then means standing up a VNet, a NAT Gateway, and a Standard public IP, and paying for that NAT Gateway and public IP on top of the non-Consumption plan. QuotaGuard is application settings, gives you two IPs that work across every Azure region and every other platform you run, and adds no VNet or NAT Gateway. Choose whichever fits. This page documents the QuotaGuard path.

Troubleshooting

407 Proxy Authentication Required

The credentials are wrong. Confirm the proxy values in your app settings match your QuotaGuard dashboard exactly.

Settings not applied

App settings take effect on restart. If the app did not restart automatically, restart it and retest.

.NET still using the wrong IP

HttpClient.DefaultProxy reads the env vars on .NET Core 3.0 and later, but a custom HttpClientHandler with UseProxy = false, or a client constructed before the env var is set, bypasses it. Use the explicit WebProxy pattern above.

Wrong IP returned

The runtime is not honoring the proxy variables. Apply the proxy in code per request, as shown above.

QuotaGuard Static vs QuotaGuard Shield

For most Azure Functions and App Service apps, Static is the right product. Choose QuotaGuard Shield if your workload handles regulated data or your environment requires TLS between your app and the proxy itself.

Ready to Get Started?

Get in touch or create a free trial account.

Try QuotaGuard Now

Read: Static IP for Azure Functions Without VNet Integration

Contact Support