##[error]Error: Failed to list path 'site/wwwroot/UserCreation' from Kudu. Error: Ip Forbidden (CODE: 403)

Question

Hi,

I am deploying a .NET 10 microservices application to an Azure App Service (Windows) using an Azure DevOps YAML pipeline.

Our architecture is:

Azure App Service (Windows)

Azure DevOps CI/CD

Microsoft Hosted Agent (windows-latest)

Single App Service

Multiple microservices deployed as Virtual Applications using Configuration → Path Mapping

Virtual Application: /UserCreation

The CI pipeline completes successfully:

Restore

Build

Publish

Publish Pipeline Artifact

The deployment fails during the Azure App Service Deploy task with the following error:

Got service connection details for Azure App Service: 'api-uat-sudonelogin'

##[error] Error: Failed to list path 'site/wwwroot/UserCreation' from Kudu.

Error: IP Forbidden (CODE: 403)

##[warning] Error: Failed to update deployment history.

Error: IP Forbidden (CODE: 403)

Current App Service networking:

Public Network Access: Disabled

VNet Integration: Configured

Private Endpoint: Configured and Approved

Private DNS Zone: Configured

Deployment is using an Azure Resource Manager service connection.

My questions are:

What does "IP Forbidden (403) from Kudu" indicate in this scenario?

Can a Microsoft Hosted Agent deploy to an App Service with Public Network Access disabled and a Private Endpoint?

Is additional configuration required for the SCM/Kudu endpoint?

Could this be related to Access Restrictions, Private Endpoint configuration, or Virtual Applications?

Our infrastructure team mentioned they may whitelist the App Service FQDN. Should both the App Service FQDN and the SCM (*.scm.azurewebsites.net) endpoint be considered?

Answer 1

Hello @Shruti Sharma

Welcome to the Microsoft Q&A and thank you for reaching out.

Based on the information you've shared, the IP Forbidden (403) error appears to be related to network connectivity rather than the Virtual Application configuration or deployment permissions.

Since your App Service has Public Network Access disabled and is configured with a Private Endpoint, the Kudu/SCM endpoint (https://<app>.scm.azurewebsites.net) is also accessible only through the private network.

Because you're using a Microsoft-hosted Azure DevOps agent, the deployment originates from a public IP address. As a result, the SCM endpoint rejects the request with a 403 (IP Forbidden) error. This is expected behavior in this network configuration, which is why the CI stages (complete successfully, but the deployment step fails when it tries to connect to Kudu.

To deploy to an App Service secured with a Private Endpoint, we recommend using a self-hosted Azure DevOps agent (or an Azure VM/VMSS agent) that has network connectivity to the App Service VNet (or a peered VNet).

Additionally, ensure that the privatelink.azurewebsites.net Private DNS zone is linked to the VNet where the deployment agent is running, so that both the application and SCM endpoints resolve to the Private Endpoint IP address:

<app>.privatelink.azurewebsites.net → A → <Private Endpoint IP>

<app>.scm.privatelink.azurewebsites.net → A → <Private Endpoint IP>

You should continue using the standard App Service hostname (<app>.scm.azurewebsites.net) in your deployment. Azure Private Link automatically handles the DNS resolution through CNAME records.

As a final validation, from the deployment agent, run the following command:

nslookup <app>.scm.azurewebsites.net

The hostname should resolve to the Private Endpoint IP address. If it does, rerun the pipeline and verify whether the deployment succeeds.

To answer your Questions:

1. What does the 403 from Kudu mean? It means the deployment agent cannot reach the Kudu/SCM endpoint (<app>.scm.azurewebsites.net).
2. Can a Microsoft-hosted agent deploy to an App Service with Public Network Access disabled? Generally, no. Since the App Service is accessible only through a Private Endpoint, a Microsoft-hosted agent (which runs from public IPs) cannot access the SCM endpoint.
3. Is additional SCM/Kudu configuration required? Yes. Ensure the deployment agent has network connectivity to the Private Endpoint and that the Private DNS zone is configured so both the app and SCM endpoints resolve to the Private Endpoint IP.
4. Could this be related to Access Restrictions, Private Endpoint, or Virtual Applications? It is most likely related to the Private Endpoint, DNS, or SCM Access Restrictions, rather than the Virtual Application configuration.
5. Should both the App Service and SCM endpoints be considered? Yes. Since deployments are performed through the SCM (Kudu) endpoint, both the application endpoint and the SCM endpoint should be reachable and correctly resolved.

https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint#dns

https://learn.microsoft.com/en-us/azure/app-service/overview-access-restrictions

Kindly let us know if this helps or need more assistance. Thanks