liveBook · Manning

Service endpoint-based access restriction rule

As explained in Azure Security

A service endpoint-based access restriction rule limits inbound access to requests originating from a specified virtual network subnet through a service endpoint.

A service endpoint-based access restriction rule limits inbound access to an Azure App Service workload by allowing requests originating from a specified virtual network subnet. It avoids dependence on changing remote IP addresses, but it is not supported for apps hosted in an App Service Environment. section 4.5.2

Configure the restriction with Azure CLI:

  • Assign a priority because rules are evaluated from the lowest priority value; unmatched traffic is implicitly denied. section 4.5.2

Allow traffic from VMSubnet

For ContosoWebApp001, an Allow Subnet Traffic rule with priority 200 targets VMSubnet in Contoso-VNet1. The resulting configuration records the subnet resource ID and leaves the IP address field empty.

How Azure Security covers it

How deep it goes
Defines the rule, demonstrates Azure CLI creation, shows representative output, and notes App Service Environment limitations.
Examples
Uses ContosoWebApp001, Contoso-VNet1, VMSubnet, and an Allow Subnet Traffic rule.
What it assumes
Assumes an Azure App Service workload, virtual network, subnet, resource group, and Azure CLI access.
What you can do after
Operate/configure an Azure App Service restriction with Azure CLI for a selected virtual network subnet.
How it connects
Connects access restrictions with virtual networks, subnets, IP-based rules, service tags, and rule priorities.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.