Discovered this morning that Azure Functions has very strict requirements on what IP addresses it can connect to inside an Azure Virtual Network. https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet calls them out, but basically it's the private ranges described by RFC 1918.
If you have resources not in those ranges in your virtual network, you get timeouts trying to connect to them from Azure Functions.
Note to future self; stop skimming documents and actually read them.