A consumption-plan Azure Function that posts canal lock telemetry still cannot reach a VNet-injected internal API. The Function already has the same outbound-versus-inbound split pattern as App Service documented for private access. What should the security engineer change first?
Select an answer to reveal the explanation.
Short Explanation
Consumption Functions can’t hop the VNet fence the way Premium/Dedicated App Service plans can. Move to a plan that supports regional VNet integration, then wire outbound the same way you would for App Service—don’t try to NSG your way around a SKU limit.
Full Explanation
Azure Functions network integration follows the same security pattern as App Service: regional VNet integration requires a plan/SKU that supports it; the Consumption plan does not. The engineer should move the Function to an eligible plan and configure outbound VNet integration so private APIs are reachable without exposing them publicly. Opening the multi-tenant front end with broad NSG rules is not a substitute for integration. Domain 3 data-security controls (Always Encrypted, Entra DB auth) and ACI rewrites do not solve Functions VNet reachability.