title: How to restrict access to an App Service using a setting inside the Azure Portal
body: <p>We have a web app that is deployed as an App Service in Azure. We would like to restrict access to it by having a white list of IP addresses that can be done in some Azure App Service setting and not in <code>web.config</code> that we have inside the project.</p>
  
  <p>Currently, this is how we do IP address restriction in our environments.</p>
  
  <ul>
  <li><strong>Production:</strong> We have VNet Integration setup for the App Service. We attached an <code>NSG</code> to the <code>VNet's</code> <code>Subnet</code> and from the <code>NSG</code> we can control inbound and outbound access. </li>
  <li><p><strong>Staging:</strong> We have the following block of configuration in our <code>web.config</code> that contains the whitelisted IP addresses that are allowed to access the App Service in our staging server.</p>
  
  <pre><code>&lt;security&gt;
      &lt;ipSecurity allowUnlisted="false" denyAction="NotFound"&gt;
          &lt;add allowed="true" ipAddress="some ip address" subnetMask="255.255.255.254"&gt;&lt;/add&gt;
          &lt;add allowed="true" ipAddress="some ip address" subnetMask="255.255.255.254"&gt;&lt;/add&gt;
      &lt;/ipSecurity&gt;
  &lt;/security&gt;
  </code></pre></li>
  <li><p><strong>Development(local):</strong> We have to uncomment the <code>&lt;security&gt;</code> configuration block in our local development machines coz we don't really need it. And it causes an error, please see screenshot below.</p></li>
  </ul>
  
  <p><a href="https://i.stack.imgur.com/kFW4h.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kFW4h.png" alt="enter image description here"></a></p>
  
  <p>This is some the contents of the HttpFailre_09-07-33.html</p>
  
  <pre><code>Module         IpRestrictionModule
  Notification   BeginRequest
  Handler        aspNetCore
  Error Code     0x80070021
  Config Error   This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".
  </code></pre>
  
  <p>We would like to completely remove this <code>&lt;security&gt;</code> block from web.config because for another reason, we don't want the IP addresses to reach production.</p>
  
  <p>And also, we are not allowed to do VNet Integration in our Staging server (management stuff, duh! cost-cutting whatever!).</p>
  
  <p>So is there a way to restrict IP addresses in Azure App Service?</p>