CI Deployment with Restricted Access to AppService

Krzysztof Świdrak 166

Hello,
Is there a way for CI/CD deployment from GitHub actions to AppService with enabled Access Restrictions?

As example having site on appservice with appgateway in front and by default restrict public access except the one from appgateway.

As I have seen the actions on GH work with default *.azurewebsites.net domain instead of being able to provide any custom one.

Any hints?

1 answer

brtrach-MSFT 16,686 Reputation points Microsoft Employee

2023-02-09T01:07:45.89+00:00

Yes, you can deploy your code to Azure App Service from a CI/CD pipeline with GitHub Actions while also enabling access restrictions. One way to do this is by using a service principal or Open ID Connect for authentication. You can also use a publish profile, but this method requires more steps.

You can also use service endpoints to restrict access to selected Azure virtual network subnets. You can specify the Subscription, Virtual Network, and Subnet in the Azure portal, and match it with what you want to restrict access to.

Another way to restrict access is by using a service tag-based rule. In the Type drop-down list, select Service Tag. All available service tags are supported in access restriction rules. Each service tag represents a list of IP ranges from Azure services.

A more premium offering is using an App Service Environment to enable publishing to an App Service Environment by installing the GitHub Actions for Azure App Service extension. This extension allows you to deploy to an App Service Environment and configure custom domains.

Please let us know if you have further questions or concerns.
Please sign in to rate this answer.
Krzysztof Świdrak 166 Reputation points

2023-02-24T02:24:05.98+00:00

Hello @brtrach-MSFT thanks for your help!

We use Publish Profile, however we received 403 error from app.azurewebsites.net when action is running.
Before access restriction established it was working - however the webapp was publicly open.

Will the Service Principal authenticate through the Access Restriction?

While using Publish Profile, what have to be done to allow GH Actions to deploy the App

Which Service Tag should be used to allow GH serverplants (its based on Azure Cloud) to access the AppService

I cannot find the information about GitHub Actions deployment with Access Restrictions enabled in official documentation, maybe it is worth to mention something about that in https://learn.microsoft.com/en-us/azure/app-service/deploy-github-actions?tabs=userlevel

brtrach-MSFT 16,686 Reputation points Microsoft Employee

2023-02-24T02:25:18.7566667+00:00

Yes, the service principal can authenticate through the Access Restriction. You can create a service principal with the az ad sp create-for-rbac command in the Azure CLI. The scope in the command is limited to the specific App Service app and not the entire resource group.

To allow GitHub Actions to deploy the App using a publish profile, you need to set up your publish profile as a GitHub secret. You can go to your app service in the Azure portal, select the Overview page, and select Get Publish profile. Save the downloaded file and use the contents of the file to create a GitHub secret.

To allow GH server plants to access the App Service, you can use the Azure App Service service tag. The Azure App Service service tag represents the IP addresses used by the Azure App Service platform. You can use the Azure App Service service tag in your network security group (NSG) rules to allow or deny traffic to your App Service app.

I hope this helps to answer your questions. Let me know if there is anything else we can help you with.

brtrach-MSFT 16,686 Reputation points Microsoft Employee

2023-02-25T04:39:58.6033333+00:00

Please let us know if the above response is helpful by accepting it as the answer. If you have further questions or concerns, please let us know.

AssafL 1 Reputation point

2023-11-30T12:31:07.2333333+00:00

Hi @brtrach-MSFT

Is there a service tag definition for github actions?

I don't see any mentions of it in the documentation or the Azure portal
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

CI Deployment with Restricted Access to AppService

1 answer

Your answer