How to configure to block suspicious IP address in Azure web service

Hello @Eunsu Park,

Thank you for reaching out on Microsoft Q&A forum.

I understand your Azure Web App has recently encountered multiple 404 errors coming from various external IP addresses. Although an IP lookup may show that these IPs belong to Microsoft, it’s quite common for automated bots or malicious requests to appear this way due to spoofed headers or shared IP infrastructure. These requests are generally not from legitimate Microsoft services.

To block or filter such unwanted traffic, you have several options depending on the scope of the issue.

1.If you only need to block a few specific IP addresses, you can use Access Restrictions directly within your App Service.

You can deny specific IP addresses or ranges directly from the App Service Networking settings.

Steps:

• Go to your App Service in the Azure portal.
• Navigate to Networking → Access Restrictions.
• Click Add rule → choose Deny.
• Enter the suspicious IP (e.g., 4.227.36.9) or CIDR range.
• Save the rule.

Requests from those IPs will now be automatically blocked before reaching your app. You can refer to the official documentation here: Configure IP Restrictions for App Service.

2.If you are observing continuous or global-scale unwanted traffic, it would be more efficient to protect your application using Azure Front Door.

Front Door provides a built-in Web Application Firewall (WAF) that allows you to create custom security rules, such as blocking specific IP addresses or ranges, restricting access based on geographical location, and even implementing rate-limiting or bot protection policies. Placing your App Service behind Azure Front Door helps absorb and filter out malicious traffic before it ever reaches your backend application.

For guidance on setting this up, you can refer to these articles: Create custom WAF rules in Azure Front Door and Protect Azure App Service using Front Door.

Additionally, before applying permanent blocking rules, it’s a good idea to enable diagnostic logging and Application Insights on your web app. This will help confirm where the traffic is coming from and how frequent the requests are. You can review web server logs, request headers, and user agents to understand whether these requests are automated or genuine. Microsoft provides step-by-step guidance here: Enable diagnostics logging for Azure App Service.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Also, could you please share the below information via "Private message" option.

Email ID:

Time zone:

Subscription ID:

Tenand ID:

Thanks