IP restrictions and allowing access between two Azure Web Apps

Question

We're deploying multiple Azure Web Apps, and we need to allow access between two of them (auth and api), while still restricting the external access by IP address.

We've defined the allows IPs against each app (auth and api), but how can we identify that any Azure WebApp (or other Azure infrastructure) can access this app?

Our apps are Linux Docker containers, so the vNet Integration option is only in Preview, and not supported for production use.

I can successfully get a VM to securely access a Web App by using the Access Restrictions by Virtual Network.

Is there a way to achieve this? Is there something like 0.0.0.0/32 or similar to act as a shortcut?

Answer 1

At this time it is not supported for production but as you stated it will be possible when it becomes GA. In the interim you can use something like app gateway in the middle which exists in a VNET to lock down access. See the example below:

https://learn.microsoft.com/en-us/azure/app-service/networking-features#service-endpoints