An IP-based access restriction rule protects an Azure App Service workload by comparing each incoming request's originating IP address with configured IPv4 or IPv6 CIDR blocks. Matching requests are allowed or denied according to the rule action. section 4.5.2
Listing 4.7 Creating an IP-based access restriction rule
az webapp config access-restriction add #1 --resource-group myResourceGroup #2 --name ContosoWebApp001 #3 --rule-name 'Allow IP address' #4 --action Allow #5 --ip-address 122.131.144.0/24 #6 --priority 100 #7 #1 The CLI command to create the access restriction rule #2 The resource group name #3 The name of Azure App Service–hosted workload #4 The name of the access restriction rule #5 To allow access, this value needs to be Allow; alternatively, you can deny access with the value Deny. #6 The IPv4 or IPv6 address block in CIDR notation #7 The priority of the access restriction rule; rules are enforced based on their priority, starting with the lowest priority
Create a rule with Azure Cloud Shell by naming the resource group, App Service workload, rule, action, CIDR block, and priority. section 4.5.2
Allowing one address block
For ContosoWebApp001, an Allow rule for 122.131.144.0/24 with priority 100 permits that block. Rules run from lowest priority upward; an implicit highest-priority Deny all rule handles unmatched traffic.
Access restrictions apply only to inbound traffic and cannot control traffic entering through a private endpoint. Changing remote or service IP addresses can make fixed IP rules cumbersome. section 4.5.2
