# Verify container-group egress identity separately from its inbound address

> An externally reachable Azure Container Instances address is not the group's outbound source address.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:34+00:00
- Modified: 2026-09-10T01:40:03+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

An externally reachable Azure Container Instances address is not the group's outbound source address.

## Potentially affected

Azure Container Instances groups whose downstream services require a known outbound public address.

## DSE recommendation

Verify the actual egress path and approved source address instead of copying the container group's ingress address into an allowlist.

## Article

## Source facts

Microsoft documents that a container group’s external-facing address accepts inbound connections while the group uses a different outbound address. That default egress address is not exposed programmatically.

Its documented virtual-network design uses Azure Firewall, a user-defined route and firewall rules so ingress and egress use the firewall’s public address. Multiple groups in the subnet can share that egress identity. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address).

## Applicability

Identify the container group, required destination and actual approved outbound design. This is an address-identity review, not a complete firewall deployment procedure.

## DSE recommendation

DSE recommends recording inbound publishing and outbound source requirements as separate entries. If a stable shared egress path is needed, review the supported design with the network owner before requesting a destination-side allowlist change. Account for the other groups using that path when assigning ownership. Use an approved observation endpoint rather than sending application data to an arbitrary public address-checking service.

## Verification

From a controlled container workload, make an authorized request and compare the destination’s observed source with the reviewed egress address. Test inbound access separately where required. Retain the route and rule context with both results. If the addresses differ from the plan, investigate the actual path before broadening the receiving service’s allowlist or claiming the container’s public address is sufficient evidence.

## Official references

[Microsoft Learn: Configure Static Outbound IP](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address). Source retrieved September 9, 2026.

## Primary reference

- Name: Configure Static Outbound IP - Azure Container Instances | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify container-group egress identity separately from its inbound address,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-322-verify-container-group-egress-identity-separately-from-its-inbound-address/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.