Whitelist inbound IP address for Azure WebApp?

Question

I would like to restrict access to some Web Apps I am developing on Azure through a whitelist of allowed in-bound IP addresses. I have achieved this using Network Security Group, applied to a VM. I can also see how I can achieve this using a App Service Environment, but this is very costly. Is there any way of applying a Network Security Group to a Web App? Or can I add a Network Security Group to a Virtual Network? Or is there another method that I'm overlooking?

Thanks!

Answer 1

You can restrict IP addresses in the web.config using the ipSecurity element like so:

<system.webServer>
  <security>
     <ipSecurity allowUnlisted="false">
       <add ipAddress="XXX.XXX.XXX.XXX" allowed="true" />
     </ipSecurity>
  </security>
</system.webServer>

Full documentation on the ipSecurity element: https://www.iis.net/configreference/system.webserver/security/ipsecurity

Azure Web App support for the feature: https://azure.microsoft.com/en-us/blog/ip-and-domain-restrictions-for-windows-azure-web-sites/