How to restrict IP addresses with an Azure App Service / Web App

Question

Does the ipSecurity section in web.config works with Azure App Services?

What are the steps to get a simple IP address blocking (black list) set up with a web app hosted on Azure?

Answer 1

App Service provides UX for this under Networking > Ip Restrictions

From here you can block a specic ip address or a range of address:

If you want to do it through web.config you will need to use XDT Transforms

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.webServer>
    <security>
      <ipSecurity xdt:Transform="RemoveAttributes(allowUnlisted)">
        <add ipAddress="204.79.197.200" allowed="true" xdt:Transform="Insert"/>
      </ipSecurity>
    </security>
  </system.webServer>
</configuration>

You can read more about XDT transforms and app service here: https://github.com/projectkudu/kudu/wiki/Xdt-transform-samples

Answer 2

Yes, ipSecurity section in web.config works with Azure App Services.

What are the steps to get a simple IP address blocking (black list) set up with a web app hosted on Azure?

 <system.webServer>
        <security>
            <ipSecurity>
                <add ipAddress="x.x.x.x" allowed="false" />
            </ipSecurity>
        </security>
    </system.webServer>

We also could connect to a WebApp from IIS manager and we then can config restrict IP easily. More detail info please refer to blog.