Are firewall rules supported on the storage account for durable functions?

[JeroenJSmit]

We have our function apps (V4, .Net 6) deployed in VNets (subnets) and would like to apply general IP restrictions to the storage account connected to the function app (the one for for durable function state, blob leases, etcetera). Is that supported? I cannot read anything on that explicitely.

Some documentation mentions private endpoints, some information is on service endpoints.
We would just like to enable the following

[olitomlinson]

@JeroenJSmit

I haven't tested this, but I don't see why adding a Firewall IP range would impact the functioning of the TaskHub in your storage Account. All resources in the VNET should be able to communicate with the Storage Account (if you connect the Storage Account into the VNET as per the above configuration)

Ultimately, I would recommend giving it a quick go to build certainty - Add your IP range, (or even a fictitious IP range if you don't have one yet) and try running a sample Hello World Durable Functions App connected to this Storage Account.

Chances are if the Function App can't communicate successfully to the TaskHub in the Storage Account, your App will struggle to start-up successfully, so I would expect a whole bunch of errors in App Insights or the Portal etc.

[JeroenJSmit]

Thanks for the response!

We raised a support ticket in 2020 where we ran into some issues and eventually got the answer that there are no guarantees nor SLA and we were wondering if that is still the case.

Reading https://docs.microsoft.com/en-us/azure/azure-functions/configure-networking-how-to#restrict-your-storage-account-to-a-virtual-network it seems to suggest additional configuration is necessary to restrict a storage account to a virtual network. Is that also the case when we only want to use service endpoints for whitelisting subnet instead of private endpoints?

[olitomlinson]

@JeroenJSmit

I was able to connect Function App (premium plan) to a VNET (subnet1)

and then connect a Storage Account via Private Endpoint to the same VNET (subnet 2).

and then configured the Storage Account to only allow selected networks (not public) but didn't chose any particular Network. I also added my own IP address so I could inspect the Storage Account using storage explorer.

Can confirm the TaskHub residing in the locked-down Storage Account is working just fine from the Function App.

[JeroenJSmit]

We know it is working, it has been for a while but we want to know what is officially supported.

[olitomlinson]

I don't see why it wouldn't be officially supported. Its just an infrastructure thing, between the Function App and the Storage Account (It being a TaskHub should be of no concern)

@cgillum any thoughts?