I am trying to set up a Front door for an app service. The goal here is allow traffic to the App service only from the Front door . But once I restrict the app service networking to allow access only from the Front door , I keep getting error 403 when accessing the app service Front door URL. Here's App Service network restriction

@Jagruti Mohanty , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you are facing 403 error with your Application behind Azure Front Door. I see that your App Service application uses Azure Entra Authentication And you are accessing the AFD via the default domain. This is not recommended, see Preserve the original HTTP host name between a reverse proxy and its back-end web application Your exact situation is documented here I would suggest you use a custom domain name across both App Service and AFD to circumvent this issue Please let us know if we can be of any further assistance here. Thanks, Kapil Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

403 response from App service after routing traffic from Azure Front Door

Accepted answer

KapilAnanth-MSFT 48,771 Reputation points Microsoft Employee

2024-03-14T12:08:04.3+00:00
@Jagruti Mohanty ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing 403 error with your Application behind Azure Front Door.

I see that your App Service application uses Azure Entra Authentication

And you are accessing the AFD via the default domain.

This is not recommended, see Preserve the original HTTP host name between a reverse proxy and its back-end web application

Your exact situation is documented here

I would suggest you use a custom domain name across both App Service and AFD to circumvent this issue

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.
Jagruti Mohanty 20 Reputation points Microsoft Employee

2024-03-15T06:59:17.9633333+00:00

Hi , After deploying custom domain and adding redirects to azure Ad , we are seeing a response code 302 from the azure front door.

To test out I removed all the restrictions from the app service and the app service URL is accessible directly but when we access the azure front door url with or without network restriction on app service we are getting a 302.

KapilAnanth-MSFT 48,771 Reputation points Microsoft Employee

2024-03-18T10:01:16.6533333+00:00

@Jagruti Mohanty ,

Please make sure the Redirection URI is properly added as the custom domain's

And the custom domain is validated in the App Service.

Cheers,

Kapil

Jagruti Mohanty 20 Reputation points Microsoft Employee

2024-03-28T04:25:49.7933333+00:00

Custom domain was already present for afd and app service.

Fixed the redirect url to add only the custom domain.

Backend Host Header field should be kept empty.

Salla Sakari 0 Reputation points

2025-03-03T06:23:32.07+00:00

I think I am facing the same problem; we have a custom domain on the AFD that points to the site.azurebesites.net and we are using entra authentication. When I apply the access restrictions on the web app with AzureFrontdoor.Backend service tag I get a 403 response. How can I add a custom domain name for both the App Service and AFD with the same name when the cname record is already taken by the other service?

KapilAnanth-MSFT 48,771 Reputation points Microsoft Employee

2025-03-03T06:34:02.3933333+00:00

Salla Sakari,

CNAME should be pointing to the reverse proxy - AFD in this case.

From the backend origin (App Service)- you are only required to verify the custom domain once.

Once verified, you can modify the CNAME record to point to the AFD's endPoint

Cheers,

Kapil

Salla Sakari 0 Reputation points

2025-03-03T07:18:35.61+00:00

That did the trick, thank you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

403 response from App service after routing traffic from Azure Front Door

0 additional answers

Your answer