Azure web app - restrict access to Sharepoint online

Question

Hi

We have a Sharepoint Online provider hosted app using an Azure web app as the host.

Currently the Azure web app is open to the public, what is the best way to restrict access to it so only Sharepoint Online can talk to it?

Can we do this via Web app --> Networking --> Access restrictions?

We do not have a Vnet in place.

Cheers

Answer 1

If it’s being run on a web app you can use access restrictions to either put in place IP white lists or come up a level and tie in Azure AD authentication at the service level.

IP restrictions: https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions

Authentication: https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad

Word of caution with IP restrictions, you need to stay on top of the ACL if any endpoint users are on dynamic IPs

Answer 2

Hi @Peter Stilgoe ,

I'm agree with @Mark E 's suggestion , you can either restrict IP adress or authentication for the Azure Web App to achieve restrict access.

Restrict public access to your Azure Web Apps with the IPSecurityRestrictions option

Answer 3

Thanks both, the app uses Oauth for authentication.

So guess would need to look at restricting via SPO IP addresses and look at some kind of autmation / alerting to manage it.

Answer 4

Hi @Peter Stilgoe ,

I do absolutely not agree with the given answers of IP restrictions or Authentication.

SharePoint Online is sending remote event calls to PHAs, which are anonymous. Same problem with webhook-event calls.
Therefore, recommending authentication is not applicable.

Regarding IP ranges, here is a link to SPO IP ranges, but MS also says, that Office 365 does not provide IP addresses of all required network endpoints.
And on that page, there is also a changelog, so from time to time, the IPs will change. (!) I don't think, it is a good idea to secure a connection based on the IPs then.

A better approach would probably be, to use some kind of service endpoints or a service tag.

Unfortunately, I did not yet find an applicable service tag yet. It would already help a lot, if SharePoint Online would be included in the existing service tag AzureCloud (--> this service tag contains all datacenter public IP addresses). But I downloaded the list of 'All datacenter public IP addresses' and the first of the SPO IPs (13.107.136.x) was not included there. Hm. :(

I would expect, that Microsoft provides also an endpoint for their M365 services or just for SPO, just as they do for e.g. AzureDevOps as service endpoint. This way, it would be possible to nicely harden web applications or azure functions that should only be reachable by SPO.