Search code examples
azuresecurityazure-webjobsnetwork-security

Remove or Secure Webhook from Azure Webjob on public web

Whenever an Azure webjob is created a webhook is also created along with it that if used can be used to trigger that webjob. The webjob in question is triggered on a timer and has no need for a webhook. Can this web-hook be disabled ?

Concern: If this URL is available on the public web, someone will try to call this or worse brute force this method of triggering the webjob.

Solution

  • We found a couple of ways of doing it

    1. Add Access Restrictions directly on the resource. This is specified here.
    2. Add the resource in a vNet (requires a premium plan) and apply the restrictions there.

    Note: To add a Deny All rule, you need to create at least one custom rule and Azure will add the Deny All rule automatically (see link above for details)