Skip to content

Commit 905dc2a

Browse files
v-regandownerv-regandowner
authored
Merge pull request #313113 from GitHubber17/544920-j
Freshness Pass: App Service
2 parents 69b63e8 + a8dd128 commit 905dc2a

6 files changed

Lines changed: 159 additions & 61 deletions

File tree

‎articles/app-service/environment/configure-network-settings.md‎

Lines changed: 156 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,48 @@
11
---
2-
title: Configure App Service Environment v3 network settings
3-
description: Configure network settings that apply to the entire Azure App Service environment. Learn how to do it with Azure Resource Manager templates.
2+
title: Configure App Service Environment Networking Settings
3+
description: Configure networking settings for an Azure App Service environment, including FTP access, private endpoint creation, and remote debugging. Use the Azure CLI, Azure Resource Manager templates, or the Azure portal.
44
author: seligj95
55
keywords: ASE, ASEv3, ftp, remote debug
6-
7-
ms.topic: tutorial
6+
ms.topic: how-to
87
ms.custom: devx-track-arm-template, devx-track-azurecli
9-
ms.date: 03/29/2022
8+
ms.date: 03/13/2026
109
ms.author: jordanselig
1110
ms.service: azure-app-service
11+
#customer intent: As an App Service developer, I want to configure networking settings for my App Service environments, so I can control FTP access, private endpoint creation, and remote debugging.
1212
---
1313

14-
# Network configuration settings
14+
# Configure networking settings for App Service Environments
15+
16+
App Service Environment v3 provides a fully isolated and dedicated environment for securely running App Service apps. This article describes how to configure the networking settings for an App Service Environment, including FTP access, private endpoint creation, and remote debugging. Procedures are provided to configure the settings by using the Azure CLI or an Azure Resource Manager template (ARM template), and by updating the resource directly in the Azure portal.
17+
18+
## Prerequisites
19+
20+
- An App Service Environment v3. To create a new environment, follow the steps in [Quickstart: Create an App Service Environment](creation.md).
21+
22+
## Review networking settings
23+
24+
The App Service Environment networking settings are located in a single ARM template subresource:
25+
26+
`Microsoft.Web/hostingEnvironments/{aseName}/configurations/networking`
1527

16-
Because App Service Environments are isolated to the individual customer, there are certain configuration settings that can be applied exclusively to App Service Environments. This article documents the various specific network customizations that are available for App Service Environment v3.
28+
The `networking` subresource configures three properties for the App Service Environment:
1729

18-
If you don't have an App Service Environment, see [How to Create an App Service Environment v3](./creation.md).
30+
- `allowNewPrivateEndpointConnections`
31+
- `ftpEnabled`
32+
- `remoteDebugEnabled`
1933

20-
App Service Environment network customizations are stored in a subresource of the *hostingEnvironments* Azure Resource Manager entity called networking.
34+
All of the properties are of type `bool` and are set to false (disabled) by default.
2135

22-
The following abbreviated Resource Manager template snippet shows the **networking** resource:
36+
## Use ARM template for repeatable deployment
37+
38+
When you configure networking settings for an App Service Environment by using an ARM template, you create a configuration that's available for repeatable deployment of the same environment or other App Service Environments.
39+
40+
The following snippet shows an abbreviated ARM template with configurations for the networking settings:
2341

2442
```json
2543
"resources": [
2644
{
27-
"apiVersion": "2021-03-01",
45+
"apiVersion": "2023-03-01",
2846
"type": "Microsoft.Web/hostingEnvironments",
2947
"name": "[parameter('aseName')]",
3048
"location": ...,
@@ -50,76 +68,156 @@ The following abbreviated Resource Manager template snippet shows the **networki
5068
}
5169
```
5270

53-
The **networking** resource can be included in a Resource Manager template to update the App Service Environment.
71+
## Configure properties with the Azure CLI
5472

55-
## Configure using Azure Resource Explorer
56-
Alternatively, you can update the App Service Environment by using [Azure Resource Explorer](https://resources.azure.com).
73+
If you plan to use the Azure CLI to configure the networking settings, keep in mind that the `az appservice ase update` command doesn't issue a PATCH against the individual properties. Instead, the command performs a PUT-style update against the entire `networking` subresource object. If you use the `az appservice ase update` command to configure a single property, the other networking properties revert to the default setting (false, disabled).
5774

58-
1. In Resource Explorer, go to the node for the App Service Environment (**subscriptions** > **{your Subscription}** > **resourceGroups** > **{your Resource Group}** > **providers** > **Microsoft.Web** > **hostingEnvironments** > **App Service Environment name** > **configurations** > **networking**).
59-
2. Select **Read/Write** in the upper toolbar to allow interactive editing in Resource Explorer.
60-
3. Select the blue **Edit** button to make the Resource Manager template editable.
61-
4. Modify one or more of the settings ftpEnabled, remoteDebugEnabled, allowNewPrivateEndpointConnections, that you want to change.
62-
5. Select the green **PUT** button that's located at the top of the right pane to commit the change to the App Service Environment.
63-
6. You may need to select the green **GET** button again to see the changed values.
64-
65-
The change takes effect within a minute.
75+
To ensure all `networking` properties are configured as expected, specify settings for all the networking properties in a single command.
6676

6777
## Allow new private endpoint connections
6878

69-
For apps hosted on both ILB and External App Service Environment, you can allow creation of private endpoints. The setting is default disabled. If private endpoint has been created while the setting was enabled, they won't be deleted and will continue to work. The setting only prevents new private endpoints from being created.
79+
If your app is hosted on both an Internal Load Balancer (ILB) App Service Environment and an External App Service Environment, you can allow creation of private endpoints with the `allow-new-private-endpoint-connection` setting. The ability to create new private endpoint connections is disabled by default.
7080

71-
The following Azure CLI command will enable allowNewPrivateEndpointConnections:
81+
If a private endpoint is created while the `allow-new-private-endpoint-connection` setting is enabled, and you then disable the setting, the existing private endpoint continues to work. When you disable the `allow-new-private-endpoint-connection` setting, you only prevent the creation of new private endpoints.
7282

73-
```azurecli
74-
ASE_NAME="[myAseName]"
75-
RESOURCE_GROUP_NAME="[myResourceGroup]"
76-
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-new-private-endpoint-connection true
83+
# [Azure portal](#tab/azure-portal)
7784

78-
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query allowNewPrivateEndpointConnections
79-
```
85+
You can enable new private endpoint connections for the App Service Environment in the Azure portal.
8086

81-
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
87+
1. In the [Azure portal](https://portal.azure.com), go to your **App Service Environment** resource.
8288

83-
:::image type="content" source="./media/configure-network-settings/configure-allow-private-endpoint.png" alt-text="Screenshot from Azure portal of how to configure your App Service Environment to allow creating new private endpoints for apps.":::
89+
1. In the left menu, select **Settings** > **Configuration**.
8490

85-
## FTP access
91+
1. Locate the **Networking settings** group, and select the **Allow new private endpoints** checkbox.
8692

87-
This ftpEnabled setting allows you to allow or deny FTP connections are the App Service Environment level. Individual apps will still need to configure FTP access. If you enable FTP at the App Service Environment level, you may want to [enforce FTPS](../deploy-ftp.md?tabs=cli#enforce-ftps) at the individual app level. The setting is default disabled.
93+
:::image type="content" source="./media/configure-network-settings/configure-allow-private-endpoint.png" alt-text="Screenshot that shows how to allow new private endpoint connections for an App Service Environment in the Azure portal.":::
8894

89-
If you want to enable FTP access, you can run the following Azure CLI command:
95+
1. Select **Apply** for your changes to take effect.
9096

91-
```azurecli
92-
ASE_NAME="[myAseName]"
93-
RESOURCE_GROUP_NAME="[myResourceGroup]"
94-
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-incoming-ftp-connections true
97+
# [Azure CLI](#tab/azure-cli)
9598

96-
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query ftpEnabled
97-
```
98-
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
99+
Run the following Azure CLI commands to enable new private endpoint connections for an App Service Environment:
99100

100-
:::image type="content" source="./media/configure-network-settings/configure-allow-incoming-ftp-connections.png" alt-text="Screenshot from Azure portal of how to configure your App Service Environment to allow incoming ftp connections.":::
101+
1. Set the `<placeholder>` command parameters to the values for your App Service Environment:
101102

102-
In addition to enabling access, you need to ensure that you have [configured DNS if you are using ILB App Service Environment](./networking.md#dns-configuration-for-ftp-access) and that the [necessary ports](./networking.md#ports-and-network-restrictions) are unblocked.
103+
```azurecli
104+
ASE_NAME="<App-Service-Environment>"
105+
RESOURCE_GROUP_NAME="<Resource-Group>"
106+
```
103107

104-
## Remote debugging access
108+
1. Enable FTP access for the App Service Environment by using the `--allow-incoming-ftp-connections` parameter:
105109

106-
Remote debugging is default disabled at the App Service Environment level. You can enable network level access for all apps using this configuration. You'll still have to [configure remote debugging](../configure-common.md?tabs=cli#configure-general-settings) at the individual app level.
110+
```azurecli
111+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-new-private-endpoint-connection true
112+
```
107113

108-
Run the following Azure CLI command to enable remote debugging access:
114+
1. List IP addresses for the App Service Environment that allow creation of new private endpoint connections:
109115

110-
```azurecli
111-
ASE_NAME="[myAseName]"
112-
RESOURCE_GROUP_NAME="[myResourceGroup]"
113-
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-remote-debugging true
116+
```azurecli
117+
az appservice ase list-addresses --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query allowNewPrivateEndpointConnections
118+
```
114119

115-
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query remoteDebugEnabled
116-
```
120+
---
121+
122+
## Allow incoming FTP connections
123+
124+
Use the `ftpEnabled` setting to allow or deny FTP connections for an App Service Environment. FTP access is disabled by default.
125+
126+
You still need to configure FTP access for each individual app. If you enable FTP at the App Service Environment level, you might want to [enforce FTPS](../deploy-ftp.md?tabs=cli#enforce-ftps) at the individual app level.
127+
128+
# [Azure portal](#tab/azure-portal)
129+
130+
You can configure FTP access for the App Service Environment in the Azure portal.
131+
132+
1. In the [Azure portal](https://portal.azure.com), go to your **App Service Environment** resource.
133+
134+
1. In the left menu, select **Settings** > **Configuration**.
135+
136+
1. Locate the **Networking settings** group, and select the **Allow incoming FTP connections** checkbox.
137+
138+
:::image type="content" source="./media/configure-network-settings/configure-allow-incoming-ftp-connections.png" alt-text="Screenshot that shows how to enable FTP access for an App Service Environment in the Azure portal.":::
139+
140+
1. Select **Apply** for your changes to take effect.
141+
142+
# [Azure CLI](#tab/azure-cli)
143+
144+
Run the following Azure CLI commands to enable FTP access for an App Service Environment:
145+
146+
1. Set the `<placeholder>` command parameters to the values for your App Service Environment:
147+
148+
```azurecli
149+
ASE_NAME="<App-Service-Environment>"
150+
RESOURCE_GROUP_NAME="<Resource-Group>"
151+
```
117152

118-
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
153+
1. Enable FTP access for the App Service Environment by using the `--allow-incoming-ftp-connections` parameter:
119154

120-
:::image type="content" source="./media/configure-network-settings/configure-allow-remote-debugging.png" alt-text="Screenshot from Azure portal of how to configure your App Service Environment to allow remote debugging.":::
155+
```azurecli
156+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-incoming-ftp-connections true
157+
```
158+
159+
1. List IP addresses for the App Service Environment that allow incoming FTP connections:
160+
161+
```azurecli
162+
az appservice ase list-addresses --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query ftpEnabled
163+
```
164+
165+
---
166+
167+
### Configure DNS and unblock ports
168+
169+
When you enable FTP access for an App Service Environment, prepare your configuration to receive FTP connections:
170+
171+
- If you're using an ILB App Service Environment, verify your [DNS configuration for FTP access](./networking.md#dns-configuration-for-ftp-access).
172+
173+
- Unblock the [necessary ports](./networking.md#ports-and-network-restrictions) and address any restrictions.
174+
175+
## Enable remote debugging
176+
177+
Use the `remoteDebugEnabled` setting to allow or deny incoming FTP connections for an App Service Environment. Remote debugging is disabled by default.
178+
179+
You can enable network-level access for all apps associated with the App Service Environment. However, you still need to [configure remote debugging](../configure-common.md?tabs=cli#configure-general-settings) for each individual app.
180+
181+
# [Azure portal](#tab/azure-portal)
182+
183+
You can configure remote debugging for the App Service Environment in the Azure portal.
184+
185+
1. In the [Azure portal](https://portal.azure.com), go to your **App Service Environment** resource.
186+
187+
1. In the left menu, select **Settings** > **Configuration**.
188+
189+
1. Locate the **Networking settings** group, and select the **Allow remote debugging** checkbox.
190+
191+
:::image type="content" source="./media/configure-network-settings/configure-allow-remote-debugging.png" alt-text="Screenshot that shows how to enable remote debugging for an App Service Environment in the Azure portal.":::
192+
193+
1. Select **Apply** for your changes to take effect.
194+
195+
# [Azure CLI](#tab/azure-cli)
196+
197+
Run the following Azure CLI commands to enable remote debugging access for an App Service Environment:
198+
199+
1. Set the `<placeholder>` command parameters to the values for your App Service Environment:
200+
201+
```azurecli
202+
ASE_NAME="<App-Service-Environment>"
203+
RESOURCE_GROUP_NAME="<Resource-Group>"
204+
```
205+
206+
1. Enable remote debugging for the App Service Environment by using the `--allow-remote-debugging` parameter:
207+
208+
```azurecli
209+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-remote-debugging true
210+
```
211+
212+
1. List IP addresses for the App Service Environment that allow remote debugging:
213+
214+
```azurecli
215+
az appservice ase list-addresses --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query remoteDebugEnabled
216+
```
217+
218+
---
121219

122-
## Next steps
220+
## Related content
123221

124-
> [!div class="nextstepaction"]
125-
> [Deploy your app to Azure App Service using FTP](../deploy-ftp.md)
222+
- [Deploy your app to Azure App Service by using FTP or FTPS](../deploy-ftp.md)
223+
- ['az appservice ase update' command reference](/cli/azure/appservice/ase)

‎articles/app-service/environment/how-to-create-from-template.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,8 +84,8 @@ The following table describes the core properties and other options you can use
8484
| `upgradePreference` | No | Specify your preference for automatic upgrades. There are four possible values:<br> - `None`: (Default) Upgrade automatically during the upgrade process for the region.<br> - `Early`: Upgrade automatically with a high prioritization compared with other resources in the region.<br> - `Late`: Upgrade automatically with a low prioritization compared with other resources in the region.<br> - `Manual`: Receive a notification when an upgrade is available, and start the process within 15 days. After 15 days, the upgrade occurs with other automatic upgrades in the region.<br> For more information, see [Upgrade preference for App Service Environment planned maintenance](how-to-upgrade-preference.md). |
8585
| `clusterSettings` | No | Customize the behavior of the App Service Environment. For more information, see [Custom configuration settings for App Service Environments](app-service-app-service-environment-custom-settings.md). |
8686
| `networkingConfiguration` -> `allowNewPrivateEndpointConnections` | No | Specify whether to allow creation of a new private endpoint connection for an ILB App Service Environment or External App Service Environment. By default, the option is disabled. For more information, see [Network configuration settings > Allow new private endpoint connections](configure-network-settings.md#allow-new-private-endpoint-connections). |
87-
| `networkingConfiguration` -> `remoteDebugEnabled` | No | Specify whether to enable remote debugging for the App Service Environment. By default, the option is disabled. For more information, see [Network configuration settings > Remote debugging access](configure-network-settings.md#remote-debugging-access). |
88-
| `networkingConfiguration` -> `ftpEnabled` | No | Specify whether to allow FTP connections to the App Service Environment. By default, the option is disabled. For more information, see [Network configuration settings > FTP access](configure-network-settings.md#ftp-access). |
87+
| `networkingConfiguration` -> `remoteDebugEnabled` | No | Specify whether to enable remote debugging for the App Service Environment. By default, the option is disabled. For more information, see [Configure networking settings > Enable remote debugging](configure-network-settings.md#enable-remote-debugging). |
88+
| `networkingConfiguration` -> `ftpEnabled` | No | Specify whether to allow FTP connections to the App Service Environment. By default, the option is disabled. For more information, see [Configure networking settings > Allow incoming FTP connections](configure-network-settings.md#allow-incoming-ftp-connections). |
8989
| `networkingConfiguration` -> `inboundIpAddressOverride` | No | Use this setting to create an App Service Environment with your own Azure Public IP address (specify the resource ID) or define a static IP for ILB deployments. This setting can't be changed after the App Service Environment is created. |
9090
| `customDnsSuffixConfiguration` | No | Use this setting to specify a custom domain suffix for the App Service Environment. For more information about the specific parameters, see [Custom domain suffix for App Service Environments](how-to-custom-domain-suffix.md).<br> **Important**: To set this option, you must have an existing key vault, a valid certificate secret from Azure Key Vault, and access with a managed identity for Azure resources through Microsoft Entra ID. |
9191

‎articles/app-service/environment/media/configure-network-settings/configure-allow-incoming-ftp-connections.png‎

-20.1 KB
Loading

‎articles/app-service/environment/media/configure-network-settings/configure-allow-private-endpoint.png‎

80.4 KB
Loading

‎articles/app-service/environment/media/configure-network-settings/configure-allow-remote-debugging.png‎

-20 KB
Loading

‎articles/app-service/environment/networking.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -228,7 +228,7 @@ For FTP access to Internal Load balancer (ILB) App Service Environment v3 specif
228228
1. Create an Azure DNS private zone named `ftp.appserviceenvironment.net`.
229229
1. Create an A record in that zone that points `<App Service Environment-name>` to the inbound IP address.
230230

231-
In addition to setting up DNS, you also need to enable it in the [App Service Environment configuration](./configure-network-settings.md#ftp-access) and at the [app level](../deploy-ftp.md?tabs=cli#enforce-ftps).
231+
In addition to setting up DNS, you also need to enable it in the [App Service Environment - Configure networking settings](./configure-network-settings.md#allow-incoming-ftp-connections) and at the [app level](../deploy-ftp.md?tabs=cli#enforce-ftps).
232232

233233
### DNS configuration from your App Service Environment
234234

0 commit comments

Comments
 (0)