Include Front Door ID in ARM template IPRestriction

Question

In Azure Portal when setting up access restrictions on an Azure Web Application there is now functionality to use service tags and include certain headers that must be present to allow access. We have configured the following setup which restricts access to the web app to only come from our specific front door instance:

However when trying to reflect the same configuration in ARM I have not been able to get things working. There seems to be a distinct lack of examples of this or documentation and exporting template in azure portal does not include the front door ID header check. The following is what I came up with, but after successful deployment the access restriction is there but does not have the front door ID set up.

{
            "type": "Microsoft.Web/sites/config",
            "apiVersion": "2020-12-01",
            "name": "[concat(variables('myApp'), '/web')]",
            "location": "[parameters('location')]",
            "dependsOn": [
                "[resourceId('Microsoft.Web/sites', variables('myApp'))]"
            ],
            "properties": {
                "ipSecurityRestrictions": [
                    {
                        "ipAddress": "AzureFrontDoor.Backend",
                        "action": "Allow",
                        "tag": "ServiceTag",
                        "priority": 300,
                        "name": "Restrict-FrontDoor",
                        "headers": {"X-Azure-FDID": "[parameters('frontDoorID')]"}
                    }
                ]
            }
        }

Answer 1

Each header accepts an array of object, something likes that should work for you:

{
  "type": "Microsoft.Web/sites/config",
  "apiVersion": "2020-12-01",
  "name": "[concat(variables('myApp'), '/web')]",
  "location": "[parameters('location')]",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('myApp'))]"
  ],
  "properties": {
    "ipSecurityRestrictions": [
      {
        "ipAddress": "AzureFrontDoor.Backend",
        "action": "Allow",
        "tag": "ServiceTag",
        "priority": 300,
        "name": "Restrict-FrontDoor",
        "headers": {
          "x-azure-fdid": [
            "[parameters('frontDoorID')]"
          ]
        }
      }
    ]
  }
}