How to authorized only traffic from my Frontdoor to my Web App private endpoint?

Question

We have a frontdoor with 2 Web App in the backend.

We want to authorized access to the Web App only traffics from the frontdoor so we though about using Web App Private Endpoint.

However, when we redirect the traffic to the private endpoint, we still have "error 403 - forbidden" using the frontdoor.

Please help

Answer 1

Azure Front Door documentation explicitly states that the back-end service (Web App in this case) must have a public end-point to be accessible:

Backends and backend pools:

Front Door backends refers to the host name or public IP of your application that serves your client requests.

Backend pools can be composed of Storage, Web App, Kubernetes instances, or any other custom hostname that has public connectivity. Azure Front Door requires that the backends are defined either via a public IP or a publicly resolvable DNS hostname. Members of backend pools can be across zones, regions, or even outside of Azure as long as they have public connectivity.

If the Web App service has a private end-point, it is advised to put an Application Gateway in front of the service, which exposes a public end-point for the Front Door.

Keeping this in mind, as far as I know, there is no solution for being able to restrict traffic to the Web App from the Front Door only.