We have function apps hosted in standard app service plan. To secure the function apps, we integrated it to VNet and allowed traffic only from API Management service. Now, we want to allow traffic from Event Grid (it has IoTHub and SignalR subscription) which has function app endpoint web-hook.
One option we have is white-listing all Event Grid IP ranges. Second option we tried is allowing Event-Grid service tag using Network Security Group. However azure doesn't allow inbound rules in an NSG to VNet. Is there any other clean way other than white-list all Event-Grid IP ranges.