I'm facing an issue while configuring VNet Integration for an Azure Function App (Premium Plan).

Nagendra Matharasi 20 Reputation points
2026-01-21T21:39:39.1166667+00:00
  • When a NAT Gateway is attached to the integration subnet, VNet integration for the Function App fails with the error: “Delegated subnet cannot be attached to StandardV2 NAT Gateway.”
  • When I remove the NAT Gateway from the subnet, the Function App is able to successfully add and connect to the VNet.
  • However, in this scenario, outbound traffic uses a default dynamic Azure IP instead of the required static IP.
Azure Functions
Azure Functions

An Azure service that provides an event-driven serverless compute platform.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Answer accepted by question author
Rakesh Mishra 11,440 Reputation points Microsoft External Staff Moderator
2026-01-22T00:36:58.2933333+00:00

Hi @Nagendra Matharasi ,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Root cause

The error “Delegated subnet cannot be attached to StandardV2 NAT Gateway” is caused by a limitation in StandardV2 NAT Gateway: StandardV2 cannot be attached to delegated subnets for several Azure services - including Azure Web Apps / App Service (the service behind Functions’ VNet integration).

In other words, the integration subnet for a Function/App is a delegated subnet (Microsoft.Web), and StandardV2 currently isn’t supported on that kind of delegated subnet.

Possible solution
  1. Use a Standard (v1) NAT Gateway attached to the integration subnet. Standard (v1) NAT gateway is compatible with App Service / Function VNet integration and will provide a static outbound IP. This is the simplest, doc-recommended approach.
  2. If you require StandardV2 features (zone redundancy / IPv6) — at present you cannot attach a StandardV2 NAT to an App Service / delegated subnet. Options are:
    • Re-evaluate whether you can accept Standard (v1) NAT (recommended).
    • Use an alternate egress architecture (for example, funnel outbound through an Azure Firewall/egress appliance in a hub and use UDRs), but that is more complex and changes your design.

Note: You must also enable Route All for the webapp/function VNET integration so outbound traffic is sent to the VNET routes.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest