Reference:
https://docs.microsoft.com/en-us/azure/azure-functions/create-first-function-vs-code-other
https://docs.microsoft.com/en-us/dotnet/architecture/serverless/azure-functions

Reference:
https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-storage-blob-trigger

Scenario: The Shipping Logic App requires secure resources to the corporate VNet and use dedicated storage resources with a fixed costing model.
You can access to Azure Virtual Network resources from Azure Logic Apps by using integration service environments (ISEs).
Sometimes, your logic apps and integration accounts need access to secured resources, such as virtual machines (VMs) and other systems or services, that are inside an Azure virtual network. To set up this access, you can create an integration service environment (ISE) where you can run your logic apps and create your integration accounts.
https://docs.microsoft.com/en-us/azure/logic-apps/connect-virtual-network-vnet-isolated-environment-overview

Explanation

Box 1: Validate JWT
The validate-jwt policy enforces existence and validity of a JWT extracted from either a specified HTTP Header or a specified query parameter.
Scenario: User authentication (see step 5 below)
The following steps detail the user authentication process:
* The user selects Sign in in the website.
* The browser redirects the user to the Azure Active Directory (Azure AD) sign in page.
* The user signs in.
* Azure AD redirects the user's session back to the web application. The URL includes an access token.
* The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token.
* The back-end API validates the access token.
Box 2: Outbound
Reference:
https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies