How to Automate Azure App Service IP Whitelisting with Azure DevOps Pipeline

If you’re managing IP restrictions for an Azure App Service, you’ve likely encountered the need to add, update, or remove IP addresses for access control. Doing this manually can be cumbersome and prone to errors, especially when dealing with multiple environments or services. By using an Azure DevOps (ADO) pipeline, you can automate IP whitelisting, ensuring that changes are applied consistently.

In this guide, I’ll walk you through using the Azure CLI in an Azure DevOps pipeline to manage IP restrictions dynamically. We’ll set up a pipeline that:

Accepts an IP address and rule name as parameters.

Checks if an existing IP restriction with the specified name already exists. Deletes the existing rule if found and adds the new IP restriction with a specified priority. let's dive in!

Prerequisites

Before we get started, make sure you have:

1. Azure CLI installed on your DevOps agent.


2. Azure Service Connection in ADO, allowing access to your Azure subscription.


3. Resource Group and App Service name where you plan to implement IP restrictions.

Step 1: Understanding the Azure CLI Commands

The Azure CLI provides straightforward commands for managing access restrictions. Here’s a quick breakdown:

Add an IP Restriction

This command adds an IP address to the list of allowed addresses for your app service, specifying a priority to manage the order of rules.

az webapp config access-restriction add \

--resource-group <RESOURCE_GROUP> \

--name <APP_SERVICE_NAME> \

--rule-name <RULE_NAME> \

--ip-address <IP_ADDRESS> \

--priority <PRIORITY> \

--action Allow

Remove an IP Restriction by Name

This command deletes an IP restriction by referencing the rule name.

az webapp config access-restriction remove \

--resource-group <RESOURCE_GROUP> \

--name <APP_SERVICE_NAME> \

--rule-name <RULE_NAME>

Step 2: Setting Up the Azure DevOps Pipeline

Now, we’ll create an ADO pipeline that uses these CLI commands. This pipeline will take three parameters: ruleName, ipAddress, and priority. If a rule with the specified name already exists, it will be deleted before adding the new IP restriction.

Here’s the complete YAML file for the pipeline:

trigger: none



parameters:

- name: ruleName

displayName: 'Name of the IP Rule'

type: string

default: ''

- name: ipAddress

displayName: 'IP Address to Allow'

type: string

default: ''

- name: priority

displayName: 'Priority of the Rule'

type: number # Corrected type from 'int' to 'number'

default: 100



jobs:

- job: ManageAppServiceIP

displayName: 'Manage App Service IP Whitelisting'

pool:

vmImage: 'ubuntu-latest'



steps:

- task: AzureCLI@2

displayName: 'Check and Update IP Restriction on App Service'

inputs:

azureSubscription: '<YOUR_AZURE_SERVICE_CONNECTION>'

scriptType: bash

scriptLocation: inlineScript

inlineScript: |

# Define variables

RESOURCE_GROUP="<RESOURCE_GROUP>"

APP_SERVICE_NAME="<APP_SERVICE_NAME>"

RULE_NAME="${{ parameters.ruleName }}"

IP_ADDRESS="${{ parameters.ipAddress }}"

PRIORITY="${{ parameters.priority }}"



echo "Checking if IP restriction rule exists for ${RULE_NAME}..."



# Check if the IP rule with the specified name already exists

EXISTING_RULE=$(az webapp config access-restriction show \

--resource-group $RESOURCE_GROUP \

--name $APP_SERVICE_NAME \

--query "ipSecurityRestrictions[?name=='$RULE_NAME']" \

-o tsv)



# If rule exists, delete it

if [[ -n "$EXISTING_RULE" ]]; then

echo "Rule ${RULE_NAME} exists. Deleting existing rule..."

az webapp config access-restriction remove \

--resource-group $RESOURCE_GROUP \

--name $APP_SERVICE_NAME \

--rule-name $RULE_NAME

echo "Existing rule ${RULE_NAME} deleted."

else

echo "No existing rule found for ${RULE_NAME}. Adding new rule."

fi



# Add the new IP restriction with priority

echo "Adding IP restriction for ${IP_ADDRESS} with name ${RULE_NAME} and priority ${PRIORITY}..."

az webapp config access-restriction add \

--resource-group $RESOURCE_GROUP \

--name $APP_SERVICE_NAME \

--rule-name $RULE_NAME \

--ip-address $IP_ADDRESS \

--priority $PRIORITY \

--action Allow

echo "IP restriction rule ${RULE_NAME} added successfully with priority ${PRIORITY}."

Step 3: Fixing YAML Errors in ADO

When working with YAML files in ADO, you may encounter validation errors. For example, if you receive an error like String does not match the pattern of “^boolean$”, it could indicate a type mismatch.

In our case, the type of priority was initially set to int, which Azure DevOps expects as number. Changing it from int to number resolved the error:

- name: priority

displayName: 'Priority of the Rule'

type: number # Set type to 'number' instead of 'int'

default: 100

Conclusion

Automating IP whitelisting for an Azure App Service saves time and reduces human error. By using an ADO pipeline, you ensure that IP restriction rules are managed consistently across environments. This setup is flexible, allowing you to update IP restrictions simply by providing new inputs when running the pipeline.

Tip: Consider adding notifications or approval steps in ADO if you’re managing critical IP whitelisting to prevent accidental overrides.

Happy automating!