Search code examples
azure-web-app-serviceazure-front-door

Restrict App Services to Front Door using Service tag and not IP

I read documention from MS and other blogs-articles and I am still confused on how we can restrict access to AppServices to FrontDoor only.

According documenentation i found we need to apply IPs ACL (I do not talk about the X-FrontDoor-ID). I follow their guidelines and found more than 100 IP to allow.

My question is why can't just use the ServiceTag as below ? Just one rule isn't enough to secure ? enter image description here

Your thoughts ? Thx

Solution

  • Based on my understanding, a service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag frequently. You should use that service tag AzureFrontDoor.Backend in the Azure App Service access restrictions unless the service tag does not match in the Azure IP Ranges and Service Tags. Read this blog for more details. However, it's a rare scenario.