Announcing App Service Outbound IPv6 Support in Public Preview

Update 12/3/2025: This post has been updated with the public preview announcement for Linux sites, which were previously not included in this announcement.

We are excited to announce the public preview of IPv6 outbound support in App Service for both Windows and Linux sites! Public preview of outbound IPv6 support for multi-tenant apps is supported on all App Service plan SKUs, Functions Consumption, Functions Elastic Premium, and Logic Apps Standard. This is the next announcement in our series of IPv6 related feature work on App Service.

1. General availability of Inbound IPv6 Support on App Service multi-tenant
2. This announcement: IPv6 (dual-stack) non-vnet outbound support (multi-tenant)
3. Backlog - IPv6 vnet outbound support (multi-tenant and App Service Environment v3)
4. Backlog - IPv6 vnet inbound support (App Service Environment v3 - both internal and external)

Limitations in public preview

• While Linux sites require you to opt-in to enable outbound IPv6, Windows sites are enabled by default.
• Enablement for Linux is done via app settings. App settings are not enforceable by Azure Policy.

How it works

IPv6 outbound allows you to resolve endpoints to IPv6 addresses and call the IPv6 endpoint. There are no changes required in your code to start using IPv6 compatible endpoints. For Windows sites, this feature is enabled by default. But for Linux sites, opt-in via an app setting is required. See the Linux section later in this blog for details on how to enable it.

The first iteration of the implementation does not support virtual network traffic. If your app is integrated with a virtual network and you have application traffic routing, aka "Route All" enabled, you will not be able to resolve or reach IPv6 endpoints. If you are using virtual network integration and disable application traffic routing, you can resolve and reach public IPv6 endpoints directly. Be cautious when changing the routing though as all your public traffic will not be routed through the virtual network at that point.

Testing

To test IPv6 connectivity, you can use the console. You'll also need an IPv6 capable endpoint. In this case, I took advantage of the general availability of inbound IPv6 on App Service and created a web app (named `ipv6`) with inbound IP mode set to "IPv6" and then called these commands ("-6" is optional, but can be used if the endpoint supports both IPv4 and IPv6):

nslookup ipv6.azurewebsites.net 

curl -6 https://ipv6.azurewebsites.net

Important considerations

During public preview, Windows and Linux have different default behaviors when dealing with IPv6.

Windows

For Windows, outbound IPv6 is enabled by default. There are no controls to enable or disable outbound IPv6 for Windows during public preview. Windows will default to IPv4 if the DNS lookup returns both address types. So your app will continue to work without issues with this update.

Linux

Linux, however, when enabled, defaults to IPv6 if the DNS lookup returns both IPv4 and IPv6 address types. Therefore, sites that were previously working fine might experience issues when outbound IPv6 is enabled. If the DNS of your endpoint resolves to an IPv6 address that does not work, your app will also experience this behavior. Additionally, if you have a firewall or network device that blocks IPv6, or your app is not configured to use IPv6 endpoints, you will experience issues when you enable this feature. 

To prevent issues with this default behavior, we have made this feature an opt-in for Linux sites. To enable outbound IPv6 for Linux sites, add the app setting `WEBSITE_NETWORK_LINUX_OUTBOUND_DISABLE_IPV6` with a value of `false`. This app setting defaults to true if not provided, and therefore disables outbound IPv6 for the site. So if you want to completely disable IPv6 outbound on Linux, there's nothing needed.

If you have apps on Linux where you have endpoints with bad IPv6 configurations, we have added the option to remove IPv6 DNS results for specific FQDNs. In addition to the app setting to enable IPv6, you can add an app setting called `WEBSITE_DNS_SUPPRESS_IPV6_RESULT_FQDNS`. For the value, you can add individual FQDNs comma separated or you can simply add `all` in the value to remove all IPv6 results.

Updates coming with GA

For GA, rather than relying on app settings, which are not enforceable or auditable by Azure Policy, we will create site properties to replicate the behavior of the Linux app settings to enable/disable the feature as well as suppress specific FQDNs. These site properties will only apply to Linux sites. If you are currently using the app settings, those will still work when we GA. But if you set the site properties, those will always take precedence.

We want your feedback!

As we continue to evolve App Service to support modern web standards, your feedback is invaluable. Try out IPv6 with your apps and let us know what you think!