A service tag identifies the IP address prefixes used by a category of Azure services. In Azure App Service access restrictions, it lets you allow or deny traffic from that service category instead of maintaining individual address ranges. section 4.5.2
Use service tags with these access-restriction controls:
- Set an Allow or Deny action and assign a priority; the lowest priority takes precedence. section 4.5.2
- Remember that access restrictions control inbound traffic and do not restrict traffic entering through a private endpoint. section 4.5.2
Allow Azure Front Door traffic
Run az webapp config access-restriction add for ContosoWebApp001 with --action Allow, --priority 200, --service-tag AzureFrontDoor.Backend, and the required x-azure-fdid header. The resulting rule records the service tag and header condition.
