Skip to content

Commit f2f629e

Browse files
bmisbmis
committed
added - Add access restrictions rules programmatically
1 parent 31a8f2b commit f2f629e

File tree

1 file changed

+232
-7
lines changed

1 file changed

+232
-7
lines changed

‎articles/app-service/app-service-ip-restrictions.md

Lines changed: 232 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -189,28 +189,73 @@ PowerShell example:
189189
-HttpHeader @{'x-azure-fdid' = $afd.FrontDoorId}
190190
```
191191

192-
## Manage access restriction rules programmatically
192+
## Manage access restriction programmatically
193193

194-
You can add access restrictions programmatically by doing either of the following:
194+
You can manage access restriction programmatically, below you can find examples of how to add rules to access restrictions and how to change *Unmatched rule action* for both *Main site* and *Advanced tool site*.
195+
196+
### Add access restrictions rules programmatically
197+
198+
You can add access restrictions rules programmatically by doing one of the following options:
199+
200+
### [Azure CLI](#tab/azurecli)
201+
202+
Run the following command in the [Cloud Shell](https://shell.azure.com). Use [the Azure CLI](/cli/azure/webapp/config/access-restriction). For example:
195203

196-
* Use [the Azure CLI](/cli/azure/webapp/config/access-restriction). For example:
197-
198204
```azurecli-interactive
199205
az webapp config access-restriction add --resource-group ResourceGroup --name AppName \
200206
--rule-name 'IP example rule' --action Allow --ip-address 122.133.144.0/24 --priority 100
201207
```
202208

203-
* Use [Azure PowerShell](/powershell/module/Az.Websites/Add-AzWebAppAccessRestrictionRule). For example:
209+
### [PowerShell](#tab/powershell)
204210

211+
To do the same with PowerShell, run the following command in the [Cloud Shell](https://shell.azure.com). Use [Azure PowerShell](/powershell/module/Az.Websites/Add-AzWebAppAccessRestrictionRule). For example:
205212

206213
```azurepowershell-interactive
207214
Add-AzWebAppAccessRestrictionRule -ResourceGroupName "ResourceGroup" -WebAppName "AppName"
208215
-Name "Ip example rule" -Priority 100 -Action Allow -IpAddress 122.133.144.0/24
209216
```
210217

211-
You can also set values manually by doing either of the following:
218+
### [ARM](#tab/arm)
212219

213-
* Use an [Azure REST API](/rest/api/azure/) PUT operation on the app configuration in Azure Resource Manager. The location for this information in Azure Resource Manager is:
220+
For ARM templates, modify the property `ipSecurityRestrictions`. A sample ARM template snippet is provided for you:
221+
222+
```ARM
223+
{
224+
"apiVersion": "2020-06-01",
225+
"name": "[parameters('name')]",
226+
"type": "Microsoft.Web/sites",
227+
"location": "[parameters('location')]",
228+
"tags": {},
229+
"dependsOn": [],
230+
"properties": {
231+
"name": "[parameters('name')]",
232+
"siteConfig": {
233+
"appSettings": [],
234+
"linuxFxVersion": "[parameters('linuxFxVersion')]",
235+
"alwaysOn": "[parameters('alwaysOn')]",
236+
"ftpsState": "[parameters('ftpsState')]",
237+
"ipSecurityRestrictions": [
238+
{
239+
"ipAddress": "122.133.144.0/24",
240+
"action": "Allow",
241+
"priority": 100,
242+
"name": "IP example rule"
243+
}
244+
]
245+
},
246+
"serverFarmId": "[concat('/subscriptions/', parameters('subscriptionId'),'/resourcegroups/', parameters('serverFarmResourceGroup'), '/providers/Microsoft.Web/serverfarms/', parameters('hostingPlanName'))]",
247+
"clientAffinityEnabled": false,
248+
"virtualNetworkSubnetId": null,
249+
"httpsOnly": true
250+
}
251+
}
252+
```
253+
254+
---
255+
256+
You can also set values manually by doing one of the following options:
257+
258+
Use an [Azure REST API](/rest/api/azure/) PUT operation on the app configuration in Azure Resource Manager. The location for this information in Azure Resource Manager is:
214259

215260
management.azure.com/subscriptions/**subscription ID**/resourceGroups/**resource groups**/providers/Microsoft.Web/sites/**web app name**/config/web?api-version=2020-06-01
216261

@@ -253,6 +298,186 @@ You can also set values manually by doing either of the following:
253298
}
254299
}
255300
```
301+
302+
### Change *Unmatched rule action* for *Main site* programmatically
303+
304+
You can change *Unmatched rule action* for *Main site* programmatically by doing one of the following options:
305+
306+
### [Azure CLI](#tab/azurecli)
307+
308+
Run the following command in the [Cloud Shell](https://shell.azure.com). Use [the Azure CLI](https://learn.microsoft.com/cli/azure/resource?view=azure-cli-latest#az-resource-update). Accepted values for `ipSecurityRestrictionsDefaultAction` are `Allow` or `Deny`.
309+
310+
```azurecli-interactive
311+
az resource update --resource-group ResourceGroup --name AppName --resource-type "Microsoft.Web/sites" \
312+
--set properties.siteConfig.ipSecurityRestrictionsDefaultAction=Allow
313+
```
314+
315+
### [PowerShell](#tab/powershell)
316+
317+
To do the same with PowerShell, run the following command in the [Cloud Shell](https://shell.azure.com). Use [Azure PowerShell](https://learn.microsoft.com/powershell/module/az.resources/set-azresource). Accepted values for `ipSecurityRestrictionsDefaultAction` are `Allow` or `Deny`.
318+
319+
```azurepowershell-interactive
320+
$Resource = Get-AzResource -ResourceType Microsoft.Web/sites -ResourceGroupName ResourceGroup -ResourceName AppName
321+
$Resource.Properties.siteConfig.ipSecurityRestrictionsDefaultAction = "Allow"
322+
$Resource | Set-AzResource -Force
323+
```
324+
325+
### [ARM](#tab/arm)
326+
327+
For ARM templates, modify the property `ipSecurityRestrictionsDefaultAction`. Accepted values for `ipSecurityRestrictionsDefaultAction` are `Allow` or `Deny`. A sample ARM template snippet is provided for you:
328+
329+
```ARM
330+
{
331+
"apiVersion": "2020-06-01",
332+
"name": "[parameters('name')]",
333+
"type": "Microsoft.Web/sites",
334+
"location": "[parameters('location')]",
335+
"tags": {},
336+
"dependsOn": [],
337+
"properties": {
338+
"name": "[parameters('name')]",
339+
"siteConfig": {
340+
"appSettings": [],
341+
"linuxFxVersion": "[parameters('linuxFxVersion')]",
342+
"alwaysOn": "[parameters('alwaysOn')]",
343+
"ftpsState": "[parameters('ftpsState')]",
344+
"ipSecurityRestrictionsDefaultAction": "[parameters('ipSecurityRestrictionsDefaultAction')]"
345+
},
346+
"serverFarmId": "[concat('/subscriptions/', parameters('subscriptionId'),'/resourcegroups/', parameters('serverFarmResourceGroup'), '/providers/Microsoft.Web/serverfarms/', parameters('hostingPlanName'))]",
347+
"clientAffinityEnabled": false,
348+
"virtualNetworkSubnetId": null,
349+
"httpsOnly": true
350+
}
351+
}
352+
```
353+
354+
### [Bicep](#tab/bicep)
355+
356+
For Bicep, modify the property `ipSecurityRestrictionsDefaultAction`. A sample Bicep snippet is provided for you:
357+
358+
```bicep
359+
resource appService 'Microsoft.Web/sites@2020-06-01' = {
360+
name: webSiteName
361+
location: location
362+
properties: {
363+
serverFarmId: appServicePlan.id
364+
siteConfig: {
365+
linuxFxVersion: linuxFxVersion
366+
ipSecurityRestrictionsDefaultAction: ipSecurityRestrictionsDefaultAction
367+
scmIpSecurityRestrictionsDefaultAction: scmIpSecurityRestrictionsDefaultAction
368+
}
369+
}
370+
}
371+
```
372+
373+
You can also set values manually by doing one of the following options:
374+
375+
* Use an [Azure REST API](/rest/api/azure/) PUT operation on the app configuration in Azure Resource Manager. The location for this information in Azure Resource Manager is:
376+
377+
management.azure.com/subscriptions/**subscription ID**/resourceGroups/**resource groups**/providers/Microsoft.Web/sites/**web app name**/config/web?api-version=2020-12-01
378+
379+
* Use a Resource Manager template. As an example, you can use resources.azure.com and edit the `ipSecurityRestrictionsDefaultAction` property to change the required value in JSON.
380+
381+
The JSON syntax for the earlier example is:
382+
383+
```json
384+
{
385+
"properties": {
386+
"ipSecurityRestrictionsDefaultAction": "Allow"
387+
}
388+
}
389+
```
390+
391+
392+
### Change *Unmatched rule action* for *Advanced tool site*
393+
394+
You can change *Unmatched rule action* for *Advanced tool site* programmatically by doing one of the following options:
395+
396+
### [Azure CLI](#tab/azurecli)
397+
398+
Run the following command in the [Cloud Shell](https://shell.azure.com). Use [the Azure CLI](https://learn.microsoft.com/cli/azure/resource?view=azure-cli-latest#az-resource-update). Accepted values for `scmIpSecurityRestrictionsDefaultAction` are `Allow` or `Deny`.
399+
400+
```azurecli-interactive
401+
az resource update --resource-group ResourceGroup --name AppName --resource-type "Microsoft.Web/sites" \
402+
--set properties.siteConfig.scmIpSecurityRestrictionsDefaultAction=Allow
403+
```
404+
405+
### [PowerShell](#tab/powershell)
406+
407+
To do the same with PowerShell, run the following command in the [Cloud Shell](https://shell.azure.com). Use [Azure PowerShell](https://learn.microsoft.com/powershell/module/az.resources/set-azresource). Accepted values for `scmIpSecurityRestrictionsDefaultAction` are `Allow` or `Deny`.
408+
409+
```azurepowershell-interactive
410+
$Resource = Get-AzResource -ResourceType Microsoft.Web/sites -ResourceGroupName ResourceGroup -ResourceName AppName
411+
$Resource.Properties.siteConfig.scmIpSecurityRestrictionsDefaultAction = "Allow"
412+
$Resource | Set-AzResource -Force
413+
```
414+
415+
### [ARM](#tab/arm)
416+
417+
For ARM templates, modify the property `scmIpSecurityRestrictionsDefaultAction`. Accepted values for `scmIpSecurityRestrictionsDefaultAction` are `Allow` or `Deny`. A sample ARM template snippet is provided for you:
418+
419+
```ARM
420+
{
421+
"apiVersion": "2020-06-01",
422+
"name": "[parameters('name')]",
423+
"type": "Microsoft.Web/sites",
424+
"location": "[parameters('location')]",
425+
"tags": {},
426+
"dependsOn": [],
427+
"properties": {
428+
"name": "[parameters('name')]",
429+
"siteConfig": {
430+
"appSettings": [],
431+
"linuxFxVersion": "[parameters('linuxFxVersion')]",
432+
"alwaysOn": "[parameters('alwaysOn')]",
433+
"ftpsState": "[parameters('ftpsState')]",
434+
"scmIpSecurityRestrictionsDefaultAction": "[parameters('scmIpSecurityRestrictionsDefaultAction')]"
435+
},
436+
"serverFarmId": "[concat('/subscriptions/', parameters('subscriptionId'),'/resourcegroups/', parameters('serverFarmResourceGroup'), '/providers/Microsoft.Web/serverfarms/', parameters('hostingPlanName'))]",
437+
"clientAffinityEnabled": false,
438+
"virtualNetworkSubnetId": null,
439+
"httpsOnly": true
440+
}
441+
}
442+
```
443+
444+
### [Bicep](#tab/bicep)
445+
446+
For Bicep, modify the property `scmIpSecurityRestrictionsDefaultAction`. A sample Bicep snippet is provided for you:
447+
448+
```bicep
449+
resource appService 'Microsoft.Web/sites@2020-06-01' = {
450+
name: webSiteName
451+
location: location
452+
properties: {
453+
serverFarmId: appServicePlan.id
454+
siteConfig: {
455+
linuxFxVersion: linuxFxVersion
456+
scmIpSecurityRestrictionsDefaultAction: scmIpSecurityRestrictionsDefaultAction
457+
}
458+
}
459+
}
460+
```
461+
462+
---
463+
464+
You can also set values manually by doing one of the following options:
465+
466+
* Use an [Azure REST API](/rest/api/azure/) PUT operation on the app configuration in Azure Resource Manager. The location for this information in Azure Resource Manager is:
467+
468+
management.azure.com/subscriptions/**subscription ID**/resourceGroups/**resource groups**/providers/Microsoft.Web/sites/**web app name**/config/web?api-version=2020-12-01
469+
470+
* Use a Resource Manager template. As an example, you can use resources.azure.com and edit the `scmIpSecurityRestrictionsDefaultAction` property to change the required value in JSON.
471+
472+
The JSON syntax for the earlier example is:
473+
474+
```json
475+
{
476+
"properties": {
477+
"scmIpSecurityRestrictionsDefaultAction": "Deny"
478+
}
479+
}
480+
```
256481
## Set up Azure Functions access restrictions
257482

258483
Access restrictions are also available for function apps with the same functionality as App Service plans. When you enable access restrictions, you also disable the Azure portal code editor for any disallowed IPs.

0 commit comments

Comments
 (0)