liveBook · Manning

Service tag-based access restriction rule

As explained in Azure Security

A service tag-based access restriction rule limits inbound access according to the IP address prefixes represented by a specified Azure service tag.

A service tag-based access restriction rule limits inbound traffic to an Azure App Service workload by matching IP prefixes represented by an Azure service tag. This filters requests from selected Azure services instead of maintaining individual address ranges. section 4.5.2

Configure the rule with Azure CLI by specifying:

  • An optional HTTP-header condition that further filters matching requests. section 4.5.2

Allow Azure Front Door traffic

For ContosoWebApp001, create an Allow rule with priority 200, the AzureFrontDoor.Backend service tag, and the x-azure-fdid header value 12345678-abcd-1234-abcd-12345678910a. The resulting configuration records the service tag and header restriction.

How Azure Security covers it

How deep it goes
Defines service-tag filtering and demonstrates CLI arguments plus resulting configuration, without detailing service-tag maintenance or evaluation internals.
Examples
Uses ContosoWebApp001, AzureFrontDoor.Backend, priority 200, and an x-azure-fdid header restriction.
What it assumes
Assumes an Azure App Service workload and Azure CLI or Cloud Shell access, then applies service-tag filtering through a concrete command.
What you can do after
Operate/configure an Azure App Service inbound rule with Azure CLI using a service tag, action, priority, and optional HTTP header.
How it connects
Connects Azure App Service access restriction rules with Azure Front Door, service tags, HTTP headers, and rule priorities.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.