Forum Discussion
Restrict access to an App Registration / Enterprise App to be from just a single IP or server
as per the question title - I would like to be able to restrict access to an AAD App registration / Enterprise App so that just a single server or IP can authenticate and use the app.
The App registration is currently set up to use a client secret for access which is called via python. I have tried setting up conditional access policy to restrict to a named location that contained the single IP address but discovered that CA IP restrictions only apply to user authentication and not to programmatic using secrets.
This is something that is being developed so we can be adaptable and reconfigure things is required but Im struggling to find a way to restrict things in this way to be restricted to a single server. The server is currently on premises but we are migrating everything into Azure anyway, so if there is a solution that requires the server to be in Azure , such as creating and using an endpoint for example, that might work also.
I was also trying to look into the possibility of using a certificate instead but wanted to see if an issued certificate could be configured to only work from a single IP or MAC address for added security.
Hopefully someone will have so ideas that can help me with this.
Thanks for any suggestions
This is not available yet, CAs currently do not apply to app logins.
- SeanGillesCopper Contributor
VasilMichev Hello, it has been a few months since AppRed restriction by IP has been asked, is this available yet? If not, is it on a roadmap? Is there any other way to restrict by IP other than CA?
- Thijs LecomteBronze ContributorThere isn't any update for this.
The UserVoice has been stuck in a same status for a while: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/37867180-restricting-access-of-azure-service-principals-u
- DE-RobinCopper Contributor
Are there news for that feature? Uservoice link is broken.... ;-(
EDIT have found similar question
Conditional Access for cusotm App Registrations ยท Community (azure.com)
Please rate ๐ - Thijs LecomteBronze ContributorWhat we currently do is forward the SP logins to Sentinel and throw an alert when a service principal logs in somewhere else
- PhilRiceUoSBrass Contributor
Thijs Lecomte thanks for the suggestion. We currently do not have sentinel in place but there is an ongoing project planned to set it up so we can look at that then.