Harden App Service
Nerdio Manager consists of a number of PaaS services. The entry point into the Nerdio Manager application is the App Service. By default, the Nerdio Manager app service is protected with Azure AD authentication, including MFA and conditional access, and is accessible from any internet location. It is possible to further protect the Nerdio Manager app service by using Access Restrictions or enabling a Private Endpoint.
Note: Azure app services also have FTP services enabled by default. These can be fully disabled for Nerdio Manager.
Requirements
To use VNet integration, in some instances, the App service plan must be Standard, Premium, PremiumV2, or PremiumV3. Please note that some Basic plans support Vnet integration. See this Microsoft article for details. In addition, see Upgrade the Azure App Service for upgrade options.
Configure Access restrictions on the Nerdio Manager App Service
In the Azure portal, locate the Nerdio Manager App Service resource.
Note: It typically has a name in the following format: nmw-app-xxxxxxxxx.
Within the menu on the left-hand side of the App Service blade, scroll down to the Settings section.
Select Networking.
Note: By default, the configuration is to allow all access.
In the Inbound Traffic section, select Access restriction.
Select + Add.
Type the Name and Description of the new rule.
Ensure that Action is set to Allow.
Specify the source IP address block to allow access.
Note: This automatically adds a new "Deny All" rule to the list to prevent access from all other locations.
Select Add rule.
Once all rules have been applied, navigate to the nmw-app-*.scm.azurewebsites.net tab.
Select the Same restrictions as option to restrict access to the administrative console as well.
After a few minutes, only whitelisted IP ranges are able to connect to the Nerdio Manager application.
Create a Private Endpoint on the Nerdio Manager App Service
In the Azure portal, locate the Nerdio Manager App Service resource.
Note: It typically has a name in the following format: nmw-app-xxxxxxxxx.
Within the menu on the left-hand side of the App Service blade, scroll down to the Settings section.
Select Networking.
In the Inbound Traffic section, select Add.
Type a custom Name for the private endpoint.
Choose the Subscription containing your VNet.
Select the VNet and Subnet where the private endpoint should be attached.
Optionally, depending on your VNet DNS configuration, you may be able to select the option for Integrate with private DNS zone.
Notes:
Most customers specify custom DNS servers targeting their internal AD environment, in which case this option may be disabled.
If Integrate with private DNS zone is not enabled, be sure that the DNS is properly configured to resolve your private endpoint. See Azure Private Endpoint DNS Configuration for details.
Select OK to save the private endpoint.
After a few minutes, any connections to Nerdio Manager's app service routing to the public IP addresses is rejected. Only connections that resolve your Nerdio Manager URL to the private endpoint IP address succeed.
Disable FTP Services on the Nerdio Manager App Service
In the Azure portal, locate the Nerdio Manager App Service resource.
Note: It typically has a name in the following format: nmw-app-xxxxxxxxx.
Within the menu on the left-hand side of the App Service blade, scroll down to the Settings section.
Select Configuration.
Navigate to the General settings tab.
On the FTP state selector, change the option from All allowed (default) to Disabled.
Select Save.
FTP services are now disabled for Nerdio Manager's app service.