IP addresses in Azure API Management

APPLIES TO: All API Management tiers

This article describes how to retrieve the IP addresses of Azure API Management. IP addresses can be public or private if the service is in a virtual network. You can use IP addresses to create firewall rules, filter incoming traffic to backend services, or restrict outbound traffic.

Public IP addresses

Every API Management instance in Developer, Basic, Standard, or Premium tier has public IP addresses that are exclusive to that instance. (They're not shared with other resources.)

Retrieve the IP addresses from the overview dashboard of your resource in the Azure portal:

Screenshot that shows an IP address in API Management.

Alternatively, fetch them programmatically by using this API call:

GET https://management.chinacloudapi.cn/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>?api-version=<api-version>

Public IP addresses appear in the response:

{
  ...
  "properties": {
    ...
    "publicIPAddresses": [
      "172.31.0.1"
    ],
    ...
  }
  ...
}

In multi-regional deployments, each regional deployment has one public IP address.

IP addresses of API Management in a virtual network

If your API Management instance is inside a virtual network, it has two types of IP addresses: public and private.

  • Use public IP addresses for internal communication on port 3443 to manage configuration, such as through Azure Resource Manager. In the external virtual network configuration, also use them for runtime API traffic. In the internal virtual network configuration, use public IP addresses only for Azure internal management operations. They don't expose your instance to the internet.

  • Use private virtual IP (VIP) addresses, available only in internal virtual network mode, to connect from within the network to API Management endpoints: gateways, the developer portal, and the management plane for direct API access. Use these addresses to set up DNS records within the network.

You see addresses of both types in the Azure portal and in the response of an API call:

Screenshot that shows a VIP address in API Management. 

GET https://management.chinacloudapi.cn/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>?api-version=<api-version>

{
  ...
  "properties": {
    ...
    "publicIPAddresses": [
      "172.31.0.1"
    ],
    "privateIPAddresses": [
      "192.168.1.5"
    ],
    ...
  },
  ...
}

Important

The internal load balancer and API Management units get private IP addresses dynamically. You can't anticipate the private IP of the API Management instance before its deployment. Also, changing to a different subnet and then returning might cause a change in the private IP address.

IP addresses for outbound traffic

API Management uses a public IP address for a connection outside the virtual network or a peered virtual network. It uses a private IP address for a connection in the virtual network or a peered virtual network.

  • When you deploy API Management in an external or internal virtual network and it connects to private (intranet-facing) backends, API Management uses internal IP addresses (dynamic IP, or DIP, addresses) from the subnet for the runtime API traffic. When API Management sends a request to a private backend, a private IP address is visible as the origin of the request.

    Therefore, if IP restriction lists secure resources within the virtual network or a peered virtual network, use the whole API Management subnet range with an IP rule and (in internal mode) not just the private IP address associated with the API Management resource.

  • When API Management sends a request to a public (internet-facing) backend, a public IP address is always visible as the origin of the request.

Changes to IP addresses

In the Developer, Basic, Standard, and Premium tiers of API Management, the public IP address or addresses (VIP) and private VIP addresses (if configured in the internal virtual network mode) are static for the lifetime of a service, with the following exceptions:

  • The API Management is deleted and then re-created.

  • The service subscription is disabled or warned (for example, for nonpayment) and then reinstated. Learn more about subscription states.

  • (Developer and Premium tiers) Azure Virtual Network is added to or removed from the service.

  • (Developer and Premium tiers) API Management is switched between external and internal virtual network deployment mode.

  • (Developer and Premium tiers) API Management is moved to a different subnet or configured with a different public IP address resource.

  • (Premium tier) Availability zones are enabled, added, or removed.

  • (Premium tier) In multi-regional deployments, the regional IP address changes if a region is vacated and then reinstated.

    Important

    When changing from an internal to external virtual network or changing subnets in the network, you can configure a different public IP address. If you don't provide one, an Azure-managed public IP address is automatically configured.

Related content

  • Last updated on