Question 267487 in Azure Question posted in
The official documentation to get you started can be found here.

What is the minimum access needed in Azure Portal > Networking > Access Restrictions > Advanced Tool Site to allow the Portal access to manage WebJobs

What is the minimum access needed in Azure Portal > Networking > Access Restrictions > Advanced Tool Site to allow the Azure Portal access to manage WebJobs?

enter image description here

I’m getting an error "The scm site for your app is blocked. In order to use webjobs you must allow traffic to the advanced tool site." unless I allow all traffic which has security implications (I want to deny all traffic except required)

enter image description here

The error message when you don’t allow all access has a link https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?tabs=azurecli#manage-access-restriction-rules-in-the-portal to a generic page on access restrictions but nothing specific to this issue.

I want to know specifically how to allow webjobs to be managed (view logs & run) in the Azure Portal without allowing all traffic access to the SCM site (I have tried "Allow All" and it works (as expected)). Is there a service tag? I tried Deny All except IPv4 addresses 0.0.0.0/0 and IPv6 addresses ::/0 but that didn’t work. Also tried allowing the service tag AzurePortal and AzureCloud … none of those worked. The app service is on a vnet so tried granting access to that subnet (didn’t work). None of the above worked so I’m not sure what traffic origin the portal is when it tries to access the WebJobs to manage them (start/stop them, view logs etc).

enter image description here

My WebJobs still run ok, I just can’t manage them via the portal unless I allow all access to the advanced tool site.

Look forward to some insights to what I thought would be a common issue.

Is it just not standard to try and restrict access to the SCM site and potentially any configuration secrets? (yes, should be using Azure Key Vault etc but I’m not currently).

Tags:

2

Answers


  1. 0

    To restrict the access to SCM, initially add Unmatched rule in Advanced Tool site to allow access to IPv4 and IPv6 address, then deny access to everything else.

    • Try applying the same rules to Main Site by enabling Use main site rules under Advanced Tool Site.

    enter image description here

    If it doesn’t work, try to restrict the access for SCM using the az-cli command as mentioned in the MSDOC:

    az webapp config access-restriction add --resource-group <Rg_name> --name <web_app_name> --rule-name 'IP example rule' --action Allow --ip-address 122.133.144.0/24 --priority 100 --scm-site true

    enter image description here

    References:

    Refer the below articles to explore more about site access restrictions:

    1. App Service Access restrictions
    2. Azure App Service Ip restrictions
    Login or Signup to reply.
  2. 0

    I’m facing the same issue here.
    What is the solution?

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search