Dynamics 365 Business Central: using a static IP address to access APIs.

When third-party systems require a static IP address for API calls to Business Central, a common solution uses an Azure Function with a virtual network NAT gateway to route traffic through a fixed outbound IP. This approach bypasses the limitation that SaaS environments have dynamic IP addresses.

Key points

SaaS Business Central uses dynamic IP addresses, which conflicts with third-party systems requiring static IPs for firewall allowlisting
Azure Service Tags are the recommended solution, but not all third-party systems support them
An Azure Function in Premium or Flex Plan acts as a middleware to route requests and can be assigned a static IP via a NAT gateway
Configure virtual network integration in the Function app and set WEBSITE_VNET_ROUTE_ALL environment variable to 1 to route all outbound traffic through the VNET
A NAT gateway with a public IP address ensures all API responses to third-party systems originate from a single static IP

Quotes

“this scenario is not possible on a SaaS environment because the IP addresses of a Dynamics 365 Business Central tenant are not fixed” (Explains the core problem that triggers the need for this solution)
“A possible solution is to use an Azure Function as a middle layer between the third-party system and Dynamics 365 Business Central.” (Introduces the recommended workaround for the static IP requirement)
“The Azure Function must be deployed in the Premium Plan or in the new Flex plan to be able to support this scenario.” (Specifies the critical requirement for using NAT gateway with Azure Functions)

Context

Features: API access, virtual network integration, NAT gateway, Azure Functions, outbound IP control, environment variables

Source: Stefano Demiliani, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.