Configure an inbound access restriction on App1 that explicitly allows the partner ' s public IP address. Azure Functions running on App Service infrastructure support access restriction rules that operate as an inbound network ACL. Microsoft states that these rules can contain individual IPv4/IPv6 addresses or ranges and that once one or more rules are configured, unmatched traffic can be denied. This directly supports the requirement to accept HTTP requests only from the specified partner IP.

The existing virtual network integration does not control inbound access. Microsoft specifically defines VNet integration as an outbound networking capability. Consequently, an NSG associated with the integration subnet affects traffic originating from the Function App but does not filter requests arriving at the Function App ' s public endpoint.

A private endpoint would eliminate normal public access and therefore would not support a partner that connects from a public Internet IP unless additional private connectivity were implemented. Azure Bastion is for administrative connectivity to VMs, while NAT Gateway controls outbound source addressing.

The SC-500 study guide explicitly includes configuring Azure Functions authentication and network access under Secure compute.

===============