Merge pull request #127312 from cephalin/issue#51039

rewrite doc from feedback

Author: PMEds28

articles/app-service/overview-inbound-outbound-ips.md

@@ -2,24 +2,30 @@
 title: Inbound/Outbound IP addresses
 description: Learn how inbound and outbound IP addresses are used in Azure App Service, when they change, and how to find the addresses for your app.
 ms.topic: article
-ms.date: 06/06/2019
+ms.date: 08/25/2020
 ms.custom: seodec18
 
 ---
 
 # Inbound and outbound IP addresses in Azure App Service
 
-[Azure App Service](overview.md) is a multi-tenant service, except for [App Service Environments](environment/intro.md). Apps that are not in an App Service environment (not in the [Isolated tier](https://azure.microsoft.com/pricing/details/app-service/)) share network infrastructure with other apps. As a result, the inbound and outbound IP addresses of an app can be different, and can even change in certain situations. 
+[Azure App Service](overview.md) is a multi-tenant service, except for [App Service Environments](environment/intro.md). Apps that are not in an App Service environment (not in the [Isolated tier](https://azure.microsoft.com/pricing/details/app-service/)) share network infrastructure with other apps. As a result, the inbound and outbound IP addresses of an app can be different, and can even change in certain situations.
 
 [App Service Environments](environment/intro.md) use dedicated network infrastructures, so apps running in an App Service environment get static, dedicated IP addresses both for inbound and outbound connections.
 
+## How IP addresses work in App Service
+
+An App Service app runs in an App Service plan, and App Service plans are deployed into one of the deployment units in the Azure infrastructure (internally called a webspace). Each deployment unit is assigned up to five virtual IP addresses, which includes one public inbound IP address and four outbound IP addresses. All App Service plans in the same deployment unit, and app instances that run in them, share the same set of virtual IP addresses. For an App Service Environment (an App Service plan in [Isolated tier](https://azure.microsoft.com/pricing/details/app-service/)), the App Service plan is the deployment unit itself, so the virtual IP addresses are dedicated to it as a result.
+
+Because you're not allowed to move an App Service plan between deployment units, the virtual IP addresses assigned to your app usually remain the same, but there are exceptions.
+
 ## When inbound IP changes
 
 Regardless of the number of scaled-out instances, each app has a single inbound IP address. The inbound IP address may change when you perform one of the following actions:
 
-- Delete an app and recreate it in a different resource group.
-- Delete the last app in a resource group _and_ region combination and recreate it.
-- Delete an existing TLS binding, such as during certificate renewal (see [Renew certificate](configure-ssl-certificate.md#renew-certificate)).
+- Delete an app and recreate it in a different resource group (deployment unit may change).
+- Delete the last app in a resource group _and_ region combination and recreate it (deployment unit may change).
+- Delete an existing IP-based TLS/SSL binding, such as during certificate renewal (see [Renew certificate](configure-ssl-certificate.md#renew-certificate)).
 
 ## Find the inbound IP
 
@@ -35,9 +41,13 @@ Sometimes you might want a dedicated, static IP address for your app. To get a s
 
 ## When outbound IPs change
 
-Regardless of the number of scaled-out instances, each app has a set number of outbound IP addresses at any given time. Any outbound connection from the App Service app, such as to a back-end database, uses one of the outbound IP addresses as the origin IP address. You can't know beforehand which IP address a given app instance will use to make the outbound connection, so your back-end service must open its firewall to all the outbound IP addresses of your app.
+Regardless of the number of scaled-out instances, each app has a set number of outbound IP addresses at any given time. Any outbound connection from the App Service app, such as to a back-end database, uses one of the outbound IP addresses as the origin IP address. The IP address to use is selected randomly at runtime, so your back-end service must open its firewall to all the outbound IP addresses for your app.
+
+The set of outbound IP addresses for your app changes when you perform one of the following actions:
 
-The set of outbound IP addresses for your app changes when you scale your app between the lower tiers (**Basic**, **Standard**, and **Premium**) and the **Premium V2** tier.
+- Delete an app and recreate it in a different resource group (deployment unit may change).
+- Delete the last app in a resource group _and_ region combination and recreate it (deployment unit may change).
+- Scale your app between the lower tiers (**Basic**, **Standard**, and **Premium**) and the **Premium V2** tier (IP addresses may be added to or subtracted from the set).
 
 You can find the set of all possible outbound IP addresses your app can use, regardless of pricing tiers, by looking for the `possibleOutboundIpAddresses` property or in the **Additional Outbound IP Addresses** field in the **Properties** blade in the Azure portal. See [Find outbound IPs](#find-outbound-ips).