You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions to allow traffic from the backend IP address of the Front Door instance. Does this meet the goal?

The proposed solution is incorrect. Relying on IP address restrictions for Azure Front Door's backend is not a secure or reliable method. The backend IP addresses for the Front Door service are dynamic and shared among many customers. Using the AzureFrontDoor.Backend service tag in an access restriction rule would allow traffic from any Front Door instance, not just your specific instance. The correct and recommended method is to configure the App Service to validate the X-Azure-FDID HTTP header. This header contains the unique ID of your specific Front Door instance, ensuring that the App Service only accepts traffic that has been routed through it. An even more secure alternative is to use Azure Private Link to connect Front Door Premium to the App Service, removing public internet access to the origin entirely.

A. Yes: This is incorrect because using IP-based restrictions is not a reliable or secure method to lock down access to a specific Front Door instance, as the IP ranges are shared and subject to change.

1. Microsoft Learn. (2023). Secure traffic to Azure App Service. "The IP address range for Front Door's backends might change... We don't recommend using IP address restriction rules for this purpose. Instead, we recommend that you use service tag-based rules or use the X-Azure-FDID header."

2. Microsoft Learn. (2023). Restrict access to a specific Azure Front Door instance. "To lock down your application to accept traffic only from your specific Front Door instance, you should filter based on the X-Azure-FDID HTTP header that Front Door sends... You can configure this in your origin web server to restrict traffic based on the value of this header."

3. Microsoft Learn. (2023). Use Private Link with Azure Front Door Premium. "By using the Private Link feature, you can secure your origins in Azure Front Door Premium... When you use Private Link, traffic between Azure Front Door and your application traverses over the Microsoft backbone network, eliminating exposure from the public internet."