{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "slug": "dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address", "url": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/" }, "title": "Verify container-group egress identity separately from its inbound address", "summary": "An externally reachable Azure Container Instances address is not the group's outbound source address.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:34+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 222, "potentially_affected": "Azure Container Instances groups whose downstream services require a known outbound public address.", "dse_recommendation": "Verify the actual egress path and approved source address instead of copying the container group's ingress address into an allowlist.", "primary_source": { "name": "Configure Static Outbound IP - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents that a container group’s external-facing address accepts inbound connections while the group uses a different outbound address. That default egress address is not exposed programmatically.

\n

Its documented virtual-network design uses Azure Firewall, a user-defined route and firewall rules so ingress and egress use the firewall’s public address. Multiple groups in the subnet can share that egress identity. Microsoft Learn.

\n

Applicability

\n

Identify the container group, required destination and actual approved outbound design. This is an address-identity review, not a complete firewall deployment procedure.

\n

DSE recommendation

\n

DSE recommends recording inbound publishing and outbound source requirements as separate entries. If a stable shared egress path is needed, review the supported design with the network owner before requesting a destination-side allowlist change. Account for the other groups using that path when assigning ownership. Use an approved observation endpoint rather than sending application data to an arbitrary public address-checking service.

\n

Verification

\n

From a controlled container workload, make an authorized request and compare the destination’s observed source with the reviewed egress address. Test inbound access separately where required. Retain the route and rule context with both results. If the addresses differ from the plan, investigate the actual path before broadening the receiving service’s allowlist or claiming the container’s public address is sufficient evidence.

\n

Official references

\n

Microsoft Learn: Configure Static Outbound IP. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft documents that a container group’s external-facing address accepts inbound connections while the group uses a different outbound address. That default egress address is not exposed programmatically.\nIts documented virtual-network design uses Azure Firewall, a user-defined route and firewall rules so ingress and egress use the firewall’s public address. Multiple groups in the subnet can share that egress identity. Microsoft Learn.\nApplicability\nIdentify the container group, required destination and actual approved outbound design. This is an address-identity review, not a complete firewall deployment procedure.\nDSE recommendation\nDSE recommends recording inbound publishing and outbound source requirements as separate entries. If a stable shared egress path is needed, review the supported design with the network owner before requesting a destination-side allowlist change. Account for the other groups using that path when assigning ownership. Use an approved observation endpoint rather than sending application data to an arbitrary public address-checking service.\nVerification\nFrom a controlled container workload, make an authorized request and compare the destination’s observed source with the reviewed egress address. Test inbound access separately where required. Retain the route and rule context with both results. If the addresses differ from the plan, investigate the actual path before broadening the receiving service’s allowlist or claiming the container’s public address is sufficient evidence.\nOfficial references\nMicrosoft Learn: Configure Static Outbound IP. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents that a container group’s external-facing address accepts inbound connections while the group uses a different outbound address. That default egress address is not exposed programmatically.\n\nIts documented virtual-network design uses Azure Firewall, a user-defined route and firewall rules so ingress and egress use the firewall’s public address. Multiple groups in the subnet can share that egress identity. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address).\n\n## Applicability\n\nIdentify the container group, required destination and actual approved outbound design. This is an address-identity review, not a complete firewall deployment procedure.\n\n## DSE recommendation\n\nDSE recommends recording inbound publishing and outbound source requirements as separate entries. If a stable shared egress path is needed, review the supported design with the network owner before requesting a destination-side allowlist change. Account for the other groups using that path when assigning ownership. Use an approved observation endpoint rather than sending application data to an arbitrary public address-checking service.\n\n## Verification\n\nFrom a controlled container workload, make an authorized request and compare the destination’s observed source with the reviewed egress address. Test inbound access separately where required. Retain the route and rule context with both results. If the addresses differ from the plan, investigate the actual path before broadening the receiving service’s allowlist or claiming the container’s public address is sufficient evidence.\n\n## Official references\n\n[Microsoft Learn: Configure Static Outbound IP](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "url": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Verify container-group egress identity separately from its inbound address", "item": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "url": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/", "headline": "Verify container-group egress identity separately from its inbound address", "description": "An externally reachable Azure Container Instances address is not the group's outbound source address.", "abstract": "An externally reachable Azure Container Instances address is not the group's outbound source address.", "articleBody": "Source facts\nMicrosoft documents that a container group’s external-facing address accepts inbound connections while the group uses a different outbound address. That default egress address is not exposed programmatically.\nIts documented virtual-network design uses Azure Firewall, a user-defined route and firewall rules so ingress and egress use the firewall’s public address. Multiple groups in the subnet can share that egress identity. Microsoft Learn.\nApplicability\nIdentify the container group, required destination and actual approved outbound design. This is an address-identity review, not a complete firewall deployment procedure.\nDSE recommendation\nDSE recommends recording inbound publishing and outbound source requirements as separate entries. If a stable shared egress path is needed, review the supported design with the network owner before requesting a destination-side allowlist change. Account for the other groups using that path when assigning ownership. Use an approved observation endpoint rather than sending application data to an arbitrary public address-checking service.\nVerification\nFrom a controlled container workload, make an authorized request and compare the destination’s observed source with the reviewed egress address. Test inbound access separately where required. Retain the route and rule context with both results. If the addresses differ from the plan, investigate the actual path before broadening the receiving service’s allowlist or claiming the container’s public address is sufficient evidence.\nOfficial references\nMicrosoft Learn: Configure Static Outbound IP. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:34+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify container-group egress identity separately from its inbound address" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 222, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Static Outbound IP - Azure Container Instances | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address" } } ] } }