You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend…

The proposed solution is incorrect. Relying on IP address restrictions for Azure Front Door's backend is not a secure or reliable method. The backend IP addresses for the Front Door service are dynamic and shared among many customers. Using the AzureFrontDoor.Backend service tag in an access restriction rule would allow traffic from any Front Door instance, not just your specific instance.

The correct and recommended method is to configure the App Service to validate the X-Azure-FDID HTTP header. This header contains the unique ID of your specific Front Door instance, ensuring that the App Service only accepts traffic that has been routed through it. An even more secure alternative is to use Azure Private Link to connect Front Door Premium to the App Service, removing public internet access to the origin entirely.

A. Yes: This is incorrect because using IP-based restrictions is not a reliable or secure method to lock down access to a specific Front Door instance, as the IP ranges are shared and subject to change.

1. Microsoft Learn. (2023). Secure traffic to Azure App Service. "The IP address range for Front Door's backends might change... We don't recommend using IP address restriction rules for this purpose. Instead

we recommend that you use service tag-based rules or use the X-Azure-FDID header."

2. Microsoft Learn. (2023). Restrict access to a specific Azure Front Door instance. "To lock down your application to accept traffic only from your specific Front Door instance

you should filter based on the X-Azure-FDID HTTP header that Front Door sends... You can configure this in your origin web server to restrict traffic based on the value of this header."

3. Microsoft Learn. (2023). Use Private Link with Azure Front Door Premium. "By using the Private Link feature

you can secure your origins in Azure Front Door Premium... When you use Private Link

traffic between Azure Front Door and your application traverses over the Microsoft backbone network

eliminating exposure from the public internet."