Others

How to Route SMTP Traffic from Azure Container Apps with Restricted Outbound Access

Huda Qurayshi Oct 9, 2026 868 views

Question details

The user needs to connect Azure Container Apps to smtp.office365.com under restricted outbound access rules without opening traffic to the 0.0.0.0/0 destination.

How to Route SMTP Traffic from Azure Container Apps with Restricted Access

Product: Azure Container Apps
Device & OS: not provided
Scenario: Routing outbound email traffic from containerized applications to Office 365 SMTP servers in a highly restricted network environment.
Observed behavior: Outbound traffic is currently blocked by a subnet-level network security group, preventing direct connection to the SMTP server without allowing all outbound internet traffic.

Before you start

Ensure you have the necessary Azure Role-Based Access Control (RBAC) permissions to create and manage Route Tables and configure your Network Virtual Appliance.

Solution 1Recommended

Configure a User-Defined Route via Network Virtual Appliance

Use a User-Defined Route (UDR) to securely direct outbound SMTP traffic through a Network Virtual Appliance (NVA) or Virtual Network Gateway instead of allowing unrestricted 0.0.0.0/0 outbound traffic.

By configuring a UDR, you can control the exact flow of outbound traffic from your Container Apps subnet. The NVA or Virtual Network Gateway will then act as a firewall or proxy, allowing you to explicitly permit traffic only to smtp.office365.com on the required ports.

Create a Route Table

Log in to the Azure Portal, search for 'Route Tables' in the global search bar, and click 'Create' to provision a new route table in your resource group.

Add a User-Defined Route

Open your new Route Table, select 'Routes' from the left navigation pane, and click 'Add'. Specify the destination type as 'IP Addresses' or 'Service Tag' (if applicable), and set the next hop type to 'Virtual Appliance'.

Associate with Container Apps Subnet

Navigate to the 'Subnets' section under the Route Table menu, click 'Associate', and select the specific Virtual Network and Subnet hosting your Azure Container Apps.

Configure NVA Firewall Rules

Access the management interface of your Network Virtual Appliance or Gateway. Add an outbound firewall rule that explicitly permits TCP traffic on port 587 (or port 25) to the destination address of smtp.office365.com.

Configure a User-Defined Route via Network Virtual Appliance

Traffic Routed Successfully: Once the UDR propagates, your container apps will route SMTP requests through the NVA, maintaining strict outbound security policies while successfully connecting to Office 365.

Free Microsoft Office alternative

Looking for a Lightweight Alternative to Microsoft Office?

While resolving complex enterprise network configurations for Microsoft 365 services, you might be seeking a simpler, cost-effective office suite for daily document workflows. WPS Office provides a powerful, locally installable alternative with robust compatibility and zero complex cloud administration required.

Fully compatible with Microsoft Word, Excel, and PowerPoint formatsRequires no complex cloud or network security group configurationsLightweight installation with an intuitive, familiar user interfaceBuilt-in PDF editing, merging, and conversion toolsSeamless migration from Microsoft Office for offline and local work

microsoft office alternative - wps office

Frequently Asked Questions

Why shouldn't I just allow 0.0.0.0/0 for outbound traffic in Azure?

Allowing 0.0.0.0/0 opens all outbound internet traffic from your subnet. This violates the principle of least privilege and introduces severe security risks, such as data exfiltration or malware communicating with external command servers.

Which port does smtp.office365.com require for outbound emails?

For secure email transmission, smtp.office365.com typically requires port 587 using STARTTLS encryption. Port 25 may also be used in specific enterprise relay configurations, but port 587 is the standard for client submissions.

Can I use an Azure NAT Gateway instead of a Network Virtual Appliance?

An Azure NAT Gateway provides general outbound internet connectivity but lacks Layer 7 firewall capabilities. It cannot filter outbound traffic specifically by domain (like smtp.office365.com) or port, making an NVA necessary for granular outbound restrictions.

Office Quick Solutions