I have:

• A Consumption Function App

• An APIM API connected to the Function App backend - no additional customisations or policies

  • There is a static IP (Developer tier)

I turn on traffic rules for the Function App with the following rules:

• <APIM static IP> - Allow

• Default - Deny

The results of this:

• From Postman I get a successful response from my Function App endpoint

• From Power Automate using a HTTP action I get a 403 with an x-ms-forbidden-ip from the known Logic Apps address range

x-ms-forbidden-ip error header

After this I update the traffic rules on the Function App with a Service Tag:

• LogicApps.<region> - Allow

This, of course, now allows that traffic from Power Automate HTTP actions.

My question is - what is APIM doing internally for the Function App to see a different IP for each request source?

I have tried reviewing documentation and like this and using different traffic rules, but cannot find any new information or documentation to explain the behaviour.