Azure WebApp: Restrict access to only users from a specific Microsoft Entra tenant

Question

i, I’m hosting a web application on Azure App Service and want to ensure that only users from our Microsoft Entra tenant can access it.

I’ve tried configuring the Authentication/Authorization blade in the Azure portal, but users from other tenants can still attempt to log in.

Can someone guide me on the correct settings to enforce tenant-level access?

Answer 1

To restrict access to your Azure Web App so that only users from your specific Microsoft Entra tenant can access it, you need to configure the authentication settings properly. Here are the steps you should follow:

1. Configure Authentication Settings: In the Azure portal, navigate to your Azure App Service and go to the Authentication section. Here, you can set up Azure Active Directory (AAD) as your authentication provider.
2. Tenant Requirement: Under the Tenant requirement settings, choose the option to allow requests only from the issuer tenant. This setting ensures that only users from your Microsoft Entra tenant can authenticate and access the application.
3. User Assignment Required: Ensure that the User assignment required? property is set to Yes. This means that only users who are explicitly assigned to the application will be able to sign in.
4. Conditional Access Policies: Consider implementing Conditional Access policies to further control access. You can define policies that restrict access based on user location, device compliance, and other factors.
5. Test the Configuration: After making these changes, test the configuration by attempting to log in with users from both your tenant and external tenants to confirm that access is restricted as intended.

By following these steps, you should be able to enforce tenant-level access to your Azure Web App effectively.

---

References:

• Configure additional checks
• Common considerations for multitenant user management