Merge pull request #10416 from MicrosoftDocs/main

Auto Publish – main to live - 2025-12-20 02:00 UTC

Author: learn-build-service-prod[bot]

support/azure/app-service/socket-forbidden-access-permissions-message.md

@@ -0,0 +1,40 @@
+---
+title: An Attempt was Made to Access a Socket in a Way Forbidden by its Access Permissions Message 
+description: This article discusses possible causes and solutions for the message "An attempt was made to access a socket in a way forbidden by its access permissions" in Azure App Service.
+author: JarrettRenshaw
+manager: dcscontentpm
+ms.topic: troubleshooting-general
+ms.date: 12/19/2025
+ms.author: jarrettr
+ms.reviewer: v-ryanberg
+ms.service: azure-app-service
+ms.custom: sap:Availability, Performance, and Application Issues
+---
+# "An attempt was made to access a socket in a way forbidden by its access permissions" message
+
+This article discusses possible causes and solutions for the message "An attempt was made to access a socket in a way forbidden by its access permissions" in Azure App Service.
+
+## Symptom
+
+You see the message "An attempt was made to access a socket in a way forbidden by its access permissions."
+
+## Cause 1
+
+This error typically occurs if the outbound TCP connections on the virtual machine (VM) instance are exhausted. In App Service, limits are enforced for the maximum number of outbound connections that can be made for each VM instance. 
+
+## Solution 1
+
+For more information, see [Cross-VM numerical limits](https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox#cross-vm-numerical-limits).
+
+## Cause 2
+
+This error might also occur if you try to access a local address from your application. 
+
+## Solution 2
+
+For more information, see [Local address requests](https://github.com/projectkudu/kudu/wiki/Azure-Web-App-sandbox#local-address-requests).
+
+## Resources
+
+For more information about outbound connections in your web app, see the blog post about [outgoing connections to Azure websites](https://www.freekpaans.nl/2015/08/starving-outgoing-connections-on-windows-azure-web-sites/). 
+

support/azure/app-service/toc.yml

@@ -17,6 +17,8 @@ items:
           href: ./capture-memory-dumps-app-service.md
         - name: Availability, performance, and application FAQs
           href: web-apps-performance-faqs.md
+        - name: An attempt was made to access a socket in a way forbidden by its access permissions message
+          href: socket-forbidden-access-permissions-message.md   
         - name: ASP.NET Core applications hosted in App Service stop responding
           href: asp-net-core-apps-stop-responding.md  
         - name: Error 403 - This web app is stopped message

support/azure/virtual-machines/windows/windows-azure-guest-agent-tools-vmassist.md

@@ -111,7 +111,7 @@ The following table lists the current checks and findings together with any pote
 | Check for binaries | Verifies that the guest agent .exe files (WindowsAzureGuestAgent.exe and WaAppAgent.exe) exist and is also used to help determine that the Guest Agent was installed.<br><br>If this check doesn't exist, it's likely that the guest agent has to be installed. |
 | Status of agent services | Verifies that the guest agent services (WindowsAzureGuestAgent and RdAgent) exist. Also used to help determine whether the guest agent was installed.<br><br>If this check doesn't exist, it's likely that the guest agent has to be installed. If it is installed, make sure that it's set to `Running` and that the StartType is `Automatic`. |
 | Status of `winmgmt` service | Verifies that the winmgmt service is running. |
-| Status of `KeyIso` service | Verifies that the `KeyIso (CNG Key Isolation)` service is running.<br><br> See [Needs to be Public](windows-azure-guest-agent#remote-procedure-call-rpc-issues---rdcrypt-initialization-failed). |
+| Status of `KeyIso` service | Verifies that the `KeyIso (CNG Key Isolation)` service is running.<br><br>See [Solution: Start the CNG Key Isolation service](windows-azure-guest-agent#solution-start-the-cng-key-isolation-service). |
 | Check if agent services/processes have crashed | This checks whether the Guest Agent services and processes have failed during the past day. If the incident is only a one-time event, it might not be important unless it occurs at the time when the issue is reported. However, if the services constantly fail, the incident must be investigated.<br><br>Start the investigation by looking in the WaAppAgent.log and system and application event logs. |
 | Checks if `stdregprov` is working | The VM agent MSI uses WMI StdRegProv to access the registry. If WMI isn't working correctly, the MSI can't set the RdAgent service path from the registry, and the MSI installation fails. <br><br> See [Guest Agent installation fails because of faulty WMI](windows-azure-guest-agent#guest-agent-installation-fails-because-of-faulty-wmi). |
 | Agent is installed | Returns True if the guest agent is installed. Otherwise, the guest agent has to be installed. |