How to access on premise resources via function app function?

Question

How to access on premise resources via function app function?

Dustin Chavez 0

I have a function app function that calls an on premise API. I have whitelisted the function app's outbound IP addresses to the on premise server, however, I get this error message each time I invoke the function: "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond" I can run this function app and call the API locally, however, when I host it it will not access the on premise API still. Is there something I am missing that needs to be configured for it to access my API?

Krishna Chowdary Paricharla 2,390 Reputation points Microsoft External Staff Moderator

2025-08-22T19:49:03.8333333+00:00
Hello Dustin Chavez,

When running your Function App in Azure, the outbound traffic does not automatically have line-of-sight to your on-premises network, even if you whitelist Azure outbound IPs. That’s why your function works locally but fails once deployed. To allow Azure Functions to securely reach on-prem APIs/resources, you typically need network integration. Here are the common approaches:

Azure Hybrid Connection

Easiest option if you just need to call an on-prem API over TCP (HTTP/S, SQL, etc.).

Requires installing the Hybrid Connection Manager (HCM) on a server in your on-prem environment.

The Function App then routes outbound traffic through the hybrid connection to your on-prem API.

Docs: Use Hybrid Connections with Azure Functions

Site-to-Site VPN or ExpressRoute + VNET Integration

If your Function App is running on a Premium Plan or Dedicated App Service Plan, you can integrate it with a Virtual Network (VNET).

With a VPN Gateway or ExpressRoute, the VNET can be connected to your on-prem network, allowing the Function App to access internal resources directly.

Docs: Azure Functions VNET Integration

Private Endpoint + On-prem DNS/VPN routing

For stricter security, you can use private endpoints and force all outbound traffic through a VNET that’s connected to your on-premises environment.

Simply whitelisting Azure outbound IPs is not enough, because there’s no direct connectivity path from Azure Functions to on-prem servers without one of the above networking setups.

Recommendation:

If you’re on the Consumption plan and need a quick solution → use Hybrid Connections.

If you’re on Premium/Dedicated plan and want more control → use VNET Integration with VPN/ExpressRoute.

Please refer the following document:
https://azuregems.io/azure-hybrid-connections

Hope this helps!
Krishna Chowdary Paricharla 2,390 Reputation points Microsoft External Staff Moderator

2025-08-25T17:31:27.6166667+00:00

Hello Dustin Chavez,

Just checking in to see if you've had a chance to review my previous response and let me know if you have any additional questions.
Krishna Chowdary Paricharla 2,390 Reputation points Microsoft External Staff Moderator

2025-08-26T18:31:14.7833333+00:00

Hello Dustin Chavez,

I wanted to follow up to see if you’ve had an opportunity to look over my earlier response. Please let me know if you have any further questions.

Your answer

Krishna Chowdary Paricharla 2,390 Reputation points Microsoft External Staff Moderator

2025-08-25T17:31:27.6166667+00:00

Hello Dustin Chavez,

Just checking in to see if you've had a chance to review my previous response and let me know if you have any additional questions.
Krishna Chowdary Paricharla 2,390 Reputation points Microsoft External Staff Moderator

2025-08-26T18:31:14.7833333+00:00

Hello Dustin Chavez,

I wanted to follow up to see if you’ve had an opportunity to look over my earlier response. Please let me know if you have any further questions.

Share via

How to access on premise resources via function app function?

Your answer