Permit access only from Azure Front Door to Azure App Service as simply as possible

Published 12-17-2020 07:52 PM 3,985 Views
Microsoft

[As of December 18, 2020]

Some customer asked me about the following topic.

 

"We use App Service for hosting applications and Azure Front Door as global L7 load balancer. We would like to permit access only from Azure Front Door to Azure App Service as simply as possible. Could you please share good solution with us?"

 

By default, each App Service has a public IP address and is accessible via FQDN from across the globe. If you simply deploy App Service(s) behind Azure Front Door, everyone can access App Service directly without using Azure Front Door. Therefore, we have to configure permit only access from Azure Front Door at App Service. If you were me, what do you think is a good solution?

 

What is Azure Front Door?

If you are not familiar with Azure Front Door, please read the following document.

 

What is Azure Front Door?
https://docs.microsoft.com/azure/frontdoor/front-door-overview

 

Access restrictions in App Service

The following document covers the topic I would like to know, but description is so simple that it would be hard to understand how to restrict access.

 

Access restrictions
https://docs.microsoft.com/azure/app-service/networking-features#access-restrictions

 

Solution

I would like to walk through how to configure access restriction from other than Azure Front Door to App Service. If you can access Azure environment, I recommend doing it by yourself. In this article, I use quick start tutorial for Azure Front Door.

 

Quickstart: Create a Front Door for a highly available global web application
https://docs.microsoft.com/azure/frontdoor/quickstart-create-front-door
https://docs.microsoft.com/azure/frontdoor/quickstart-create-front-door-powershell
https://docs.microsoft.com/azure/frontdoor/quickstart-create-front-door-cli
https://docs.microsoft.com/azure/frontdoor/quickstart-create-front-door-template

 

Note that ...

  • We can choose several options to configure Azure Front Door - Azure Portal, CLI, PowerShell, and ARM template. In this article, I use Azure Portal to configure access restriction.
  • Even if we don't create two App Service instances, we can test access restriction. You may follow the quick start tutorial dutifully, of course.:smile:

 

Create App Service instance

Following the tutorial, we can create simple App Service instances for backend service. Nothing special configuration is required. At this point, you should be able to access the instances via FQDN.

App Service 1.png

 

 

Configure Front Front Door

Following the tutorial, you can configure Azure Front Door. Note that we have to specify "App Service" when choosing "Backend host type".

FrontDoor 1.png

After specifying backend host type, we should see the following image.

FrontDoor 2.png

When all configuration is ready, click "Create" and wait a minute. When Azure Front Door is ready, we can test if access via Azure Front Door is available.

FrontDoor 3.png

 

At this point, we can still access App Service instances directly via FQDN since we have not configured access restrictions yet.

 

Configure access restriction for App Service instances

We open App Service instances created in the previous step in Azure Portal. And, we select "Settings" > "Networking" > "Access Restrictions" > "Configure Access Restrictions".

App Service 2.png

 

Clicking "Add rule", some screen appears from righthand where we create access restriction rule. 

We can specify some attributes as we like , e.g. name, priority, and description. And then, this the most important thing in this article! We have to choose "Service Tag (preview)" among several options of "type". When choosing "Service Tag (preview)", we can choose a service tag among options. In this case, we have to pick up "AzureFrontDoor.Backend" among them, and click "Add rule". 

If you create two App Service instances, you have to repeat to do these steps to the other instance.

App Service 4.png

That's it. It's simple, isn't it?

 

Give it a try!

First of all, we test access via Azure Front Door. This access is permitted and we can see the following image.

FrontDoor 4.png

 

How about direct access to App Service? This access is restricted and HTTP 403 returns. 

App Service 5.png

 

Conclusion

In this article, I describe a simple way of access restrictions when using Azure Front Door and App Service. If you would like to lock down the access to backend from only specified Azure Front Door, you have to follow the following passages to lock down.


How do I lock down the access to my backend to only Azure Front Door?

https://docs.microsoft.com/azure/frontdoor/front-door-faq#how-do-i-lock-down-the-access-to-my-backen...

2 Comments

Not really. Now anyone can set up a Front Door instance to access my app service. You'll need to add a further lockdown to restrict access to from only the permitted Front Door resource using the X-Azure-FDID header: Azure Front Door - Frequently Asked Questions | Microsoft Docs.

Microsoft

Thank, Aidan. You are right, and I had not written what you mentioned. I added some points based on your comment.

%3CLINGO-SUB%20id%3D%22lingo-sub-2000173%22%20slang%3D%22en-US%22%3EPermit%20access%20only%20from%20Azure%20Front%20Door%20to%20Azure%20App%20Service%20as%20simply%20as%20possible%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2000173%22%20slang%3D%22en-US%22%3E%3CP%3E%5BAs%20of%20December%2018%2C%202020%5D%3C%2FP%3E%0A%3CP%3ESome%20customer%20asked%20me%20about%20the%20following%20topic.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CEM%3E%22We%20use%20App%20Service%20for%20hosting%20applications%20and%20Azure%20Front%20Door%20as%20global%20L7%20load%20balancer.%20We%20would%20like%20to%20permit%20access%26nbsp%3Bonly%20from%20Azure%20Front%20Door%20to%20Azure%20App%20Service%20as%20simply%20as%20possible.%20Could%20you%20please%20share%20good%20solution%20with%20us%3F%22%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22graf%20graf--p%22%3EBy%20default%2C%20each%20App%20Service%20has%20a%20public%20IP%20address%20and%20is%20accessible%20via%20FQDN%20from%20across%20the%20globe.%20If%20you%20simply%20deploy%20App%20Service(s)%20behind%20Azure%20Front%20Door%2C%20everyone%20can%20access%20App%20Service%20directly%20without%20using%20Azure%20Front%20Door.%20Therefore%2C%20we%20have%20to%20configure%20permit%20only%20access%20from%20Azure%20Front%20Door%20at%20App%20Service.%20If%20you%20were%20me%2C%20what%20do%20you%20think%20is%20a%20good%20solution%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1940426192%22%20id%3D%22toc-hId-1940426166%22%20id%3D%22toc-hId-1940426166%22%20id%3D%22toc-hId-1940426166%22%20id%3D%22toc-hId-1940426166%22%20id%3D%22toc-hId-1940426166%22%20id%3D%22toc-hId-1940425264%22%3EWhat%20is%20Azure%20Front%20Door%3F%3C%2FH3%3E%0A%3CP%3EIf%20you%20are%20not%20familiar%20with%20Azure%20Front%20Door%2C%20please%20read%20the%20following%20document.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EWhat%20is%20Azure%20Front%20Door%3F%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Ffront-door-overview%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Ffront-door-overview%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-132971729%22%20id%3D%22toc-hId-132971703%22%20id%3D%22toc-hId-132971703%22%20id%3D%22toc-hId-132971703%22%20id%3D%22toc-hId-132971703%22%20id%3D%22toc-hId-132971703%22%20id%3D%22toc-hId-132970801%22%3EAccess%20restrictions%20in%20App%20Service%3C%2FH3%3E%0A%3CP%20class%3D%22graf%20graf--p%22%3EThe%20following%20document%20covers%20the%20topic%20I%20would%20like%20to%20know%2C%20but%20description%20is%20so%20simple%20that%20it%20would%20be%20hard%20to%20understand%20how%20to%20restrict%20access.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EAccess%20restrictions%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fapp-service%2Fnetworking-features%23access-restrictions%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Fapp-service%2Fnetworking-features%23access-restrictions%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--1674482734%22%20id%3D%22toc-hId--1674482760%22%20id%3D%22toc-hId--1674482760%22%20id%3D%22toc-hId--1674482760%22%20id%3D%22toc-hId--1674482760%22%20id%3D%22toc-hId--1674482760%22%20id%3D%22toc-hId--1674483662%22%3ESolution%3C%2FH3%3E%0A%3CP%3EI%20would%20like%20to%20walk%20through%20how%20to%20configure%20access%20restriction%20from%20other%20than%20Azure%20Front%20Door%20to%20App%20Service.%20If%20you%20can%20access%20Azure%20environment%2C%20I%20recommend%20doing%20it%20by%20yourself.%20In%20this%20article%2C%20I%20use%20quick%20start%20tutorial%20for%20Azure%20Front%20Door.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3EQuickstart%3A%20Create%20a%20Front%20Door%20for%20a%20highly%20available%20global%20web%20application%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door%3C%2FA%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door-powershell%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door-powershell%3C%2FA%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door-cli%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door-cli%3C%2FA%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door-template%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fazure%2Ffrontdoor%2Fquickstart-create-front-door-template%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%20that%20...%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EWe%20can%20choose%20several%20options%20to%20configure%20Azure%20Front%20Door%20-%20Azure%20Portal%2C%20CLI%2C%20PowerShell%2C%20and%20ARM%20template.%20In%20this%20article%2C%20I%20use%20Azure%20Portal%20to%20configure%20access%20restriction.%3C%2FLI%3E%0A%3CLI%3EEven%20if%20we%20don't%20create%20two%20App%20Service%20instances%2C%26nbsp%3Bwe%20can%20test%20access%20restriction.%20You%20may%20follow%20the%20quick%20start%20tutorial%20dutifully%2C%20of%20course.%3CIMG%20class%3D%22lia-deferred-image%20lia-image-emoji%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Fhtml%2Fimages%2Femoticons%2Fsmile_40x40.gif%22%20alt%3D%22%3Asmile%3A%22%20title%3D%22%3Asmile%3A%22%20%2F%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-813030099%22%20id%3D%22toc-hId-813030073%22%20id%3D%22toc-hId-813030073%22%20id%3D%22toc-hId-813030073%22%20id%3D%22toc-hId-813030073%22%20id%3D%22toc-hId-813030073%22%20id%3D%22toc-hId-813029171%22%3ECreate%20App%20Service%20instance%3C%2FH3%3E%0A%3CP%3EFollowing%20the%20tutorial%2C%20we%20can%20create%20simple%20App%20Service%20instances%20for%20backend%20service.%20Nothing%20special%20configuration%20is%20required.%20At%20this%20point%2C%20you%20should%20be%20able%20to%20access%20the%20instances%20via%20FQDN.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22App%20Service%201.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241511iB609210737A0ED3D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22App%20Service%201.png%22%20alt%3D%22App%20Service%201.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--994424364%22%20id%3D%22toc-hId--994424390%22%20id%3D%22toc-hId--994424390%22%20id%3D%22toc-hId--994424390%22%20id%3D%22toc-hId--994424390%22%20id%3D%22toc-hId--994424390%22%20id%3D%22toc-hId--994425292%22%3EConfigure%20Front%20Front%20Door%3C%2FH3%3E%0A%3CP%3EFollowing%20the%20tutorial%2C%20you%20can%20configure%20Azure%20Front%20Door.%20Note%20that%20we%20have%20to%20specify%20%22App%20Service%22%20when%20choosing%20%22Backend%20host%20type%22.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22FrontDoor%201.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241489i300BD047A73FAB0A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22FrontDoor%201.png%22%20alt%3D%22FrontDoor%201.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EAfter%20specifying%20backend%20host%20type%2C%20we%20should%20see%20the%20following%20image.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22FrontDoor%202.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241490i81E595A394803DE5%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22FrontDoor%202.png%22%20alt%3D%22FrontDoor%202.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EWhen%20all%20configuration%20is%20ready%2C%20click%20%22Create%22%20and%20wait%20a%20minute.%20When%20Azure%20Front%20Door%20is%20ready%2C%20we%20can%20test%20if%20access%20via%20Azure%20Front%20Door%20is%20available.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22FrontDoor%203.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241492i255860C033D87A0F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22FrontDoor%203.png%22%20alt%3D%22FrontDoor%203.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAt%20this%20point%2C%20we%20can%20still%20access%20App%20Service%20instances%20directly%20via%20FQDN%20since%20we%20have%20not%20configured%20access%20restrictions%20yet.%3C%2FP%3E%0A%3CDIV%20class%3D%22wp-block-columns%22%3E%0A%3CDIV%20class%3D%22wp-block-column%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3CH3%20id%3D%22toc-hId-1493088469%22%20id%3D%22toc-hId-1493088443%22%20id%3D%22toc-hId-1493088443%22%20id%3D%22toc-hId-1493088443%22%20id%3D%22toc-hId-1493088443%22%20id%3D%22toc-hId-1493088443%22%20id%3D%22toc-hId-1493087541%22%3EConfigure%20access%20restriction%20for%20App%20Service%20instances%3C%2FH3%3E%0A%3CP%3EWe%20open%20App%20Service%20instances%20created%20in%20the%20previous%20step%20in%20Azure%20Portal.%20And%2C%20we%20select%20%22Settings%22%20%26gt%3B%20%22Networking%22%20%26gt%3B%20%22Access%20Restrictions%22%20%26gt%3B%20%22Configure%20Access%20Restrictions%22.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22App%20Service%202.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241496i804AD83977C5C206%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22App%20Service%202.png%22%20alt%3D%22App%20Service%202.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EClicking%20%22Add%20rule%22%2C%20some%20screen%20appears%20from%20righthand%20where%20we%20create%20access%20restriction%20rule.%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20can%20specify%20some%20attributes%20as%20we%20like%20%2C%20e.g.%20name%2C%20priority%2C%20and%20description.%20And%20then%2C%20this%20the%20most%20important%20thing%20in%20this%20article!%26nbsp%3BWe%20have%20to%20choose%20%22Service%20Tag%20(preview)%22%20among%20several%20options%20of%20%22type%22.%20When%20choosing%20%22Service%20Tag%20(preview)%22%2C%20we%20can%20choose%20a%20service%20tag%20among%20options.%20In%20this%20case%2C%20we%20have%20to%20pick%20up%20%22AzureFrontDoor.Backend%22%20among%20them%2C%20and%20click%20%22Add%20rule%22.%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%20create%20two%20App%20Service%20instances%2C%20you%20have%20to%20repeat%20to%20do%20these%20steps%20to%20the%20other%20instance.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22App%20Service%204.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241525i72959046EF165171%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22App%20Service%204.png%22%20alt%3D%22App%20Service%204.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThat's%20it.%20It's%20simple%2C%20isn't%20it%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--314365994%22%20id%3D%22toc-hId--314366020%22%20id%3D%22toc-hId--314366020%22%20id%3D%22toc-hId--314366020%22%20id%3D%22toc-hId--314366020%22%20id%3D%22toc-hId--314366020%22%20id%3D%22toc-hId--314366922%22%3EGive%20it%20a%20try!%3C%2FH3%3E%0A%3CP%3EFirst%20of%20all%2C%20we%20test%20access%20via%20Azure%20Front%20Door.%20This%20access%20is%20permitted%20and%20we%20can%20see%20the%20following%20image.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22FrontDoor%204.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241506i9EC6D29955C98359%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22FrontDoor%204.png%22%20alt%3D%22FrontDoor%204.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHow%20about%20direct%20access%20to%20App%20Service%3F%20This%20access%20is%20restricted%20and%20HTTP%20403%20returns.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22App%20Service%205.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F241508iDDF98E5E027B9375%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22App%20Service%205.png%22%20alt%3D%22App%20Service%205.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId--2121820457%22%20id%3D%22toc-hId--2121820483%22%20id%3D%22toc-hId--2121820483%22%20id%3D%22toc-hId--2121820483%22%20id%3D%22toc-hId--2121820483%22%20id%3D%22toc-hId--2121820483%22%20id%3D%22toc-hId--2121821385%22%3EConclusion%3C%2FH3%3E%0A%3CP%3EIn%20this%20article%2C%20I%20describe%20a%20simple%20way%20of%20access%20restrictions%20when%20using%20Azure%20Front%20Door%20and%20App%20Service.%20Hope%20this%20helps.%3C%2FP%3E%0A%3CFIGURE%20class%3D%22wp-block-image%20size-large%22%3E%0A%3CDIV%20id%3D%22tinyMceEditorLogico_jp_8%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3C%2FFIGURE%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2000173%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EApplication%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EInfrastructure%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2031986%22%20slang%3D%22en-US%22%3ERe%3A%20Permit%20access%20only%20from%20Azure%20Front%20Door%20to%20Azure%20App%20Service%20as%20simply%20as%20possible%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2031986%22%20slang%3D%22en-US%22%3E%3CP%3ENot%20really.%20Now%20anyone%20can%20set%20up%20a%20Front%20Door%20instance%20to%20access%20my%20app%20service.%20You'll%20need%20to%20add%20a%20further%20lockdown%20to%20restrict%20access%20to%20from%20only%20the%20permitted%20Front%20Door%20resource%20using%20the%20X-Azure-FDID%20header%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Ffrontdoor%2Ffront-door-faq%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EAzure%20Front%20Door%20-%20Frequently%20Asked%20Questions%20%7C%20Microsoft%20Docs%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2048543%22%20slang%3D%22en-US%22%3ERe%3A%20Permit%20access%20only%20from%20Azure%20Front%20Door%20to%20Azure%20App%20Service%20as%20simply%20as%20possible%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2048543%22%20slang%3D%22en-US%22%3E%3CP%3EThank%2C%20Aidan.%20You%20are%20right%2C%20and%20I%20had%20not%20written%20what%20you%20mentioned.%20I%20added%20some%20points%20based%20on%20your%20comment.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Jan 11 2021 06:00 PM
Updated by: