Azure Load Testing uses the public IP addresses assigned to the outbound path from the injected load test engine subnet.
For a scenario where a public endpoint has access restrictions and must allow only specific client IPs:
- Deploy a NAT Gateway in the same virtual network and attach it to the subnet where the Azure Load Testing engines are injected.
- Configure the NAT Gateway with one or more public IP addresses or a public IP prefix.
- These configured public IP addresses are the ones used by the load test engine VMs for outbound traffic.
- Provide these NAT Gateway public IP addresses to the security team so they can be allowlisted on the test environment.
This way, regardless of how many engines (for example, 273) are used, all outbound traffic from the engines will appear to come from the NAT Gateway’s public IPs, which can be safely added to the whitelist.
References: