Allow the Functions access only via APIM

Our partner used to access our functions directly, recently we created an APIM and connected our Azure functions with it, and we use some method like JWT to secure it. But we found the partners still can access the functions as usual. Is that possible to decline the access to functions from internet but APIM.

There are 2 ways to restrict access to your Azure functions:

1. Enable the Private Endpoints feature. This will disable all public access and access will be restricted from within the VNET only. This feature will require an unused subnet, which will then be used to allocate an inbound private IP Address. Preferable to create a subnet within the same VNET as the APIM

2. Use Access Restrictions feature and allow access to the subnet, which is used by APIM.

NOTE: Other threads mentioned Regional VNet Integration which isn't correct as that feature is meant for making Outbound Connections. If your App Service needs to make a call to resource hosted within the VNet, then Regional VNet Integration is helpful.