title: How to connect Azure Web Application (App Service/Website) to Network Security Group?
body: <p>I'm not sure if I'm missing something simple, or if I'm trying to do the impossible.</p>
  
  <p>I have a Tomcat site deployed on Azure using the Web+Mobile App Services model. This is NOT a VM. I would like to be able to apply firewall rules (network security group) to this App Service.</p>
  
  <p>Here is what I have done within my Resource Group:</p>
  
  <ol>
  <li>Taken my existing App Service (Tomcat) and upgraded it to S1 machine size.</li>
  <li>Created a VNET with default settings. This included creating a subnet named "default". All address space suggestions were left at Azure default prompts.</li>
  <li>Used the Network settings blade on the App Service to select the VNET I just created.</li>
  <li>Created a Network Security Group - added an incoming rule to deny  HTTP port 80 from ANY source.</li>
  <li>Associated NSG created above with the default subnet</li>
  <li>Waited for everything to propogate</li>
  <li>Tested hitting the App Service on HTTP Port 80, and got results returned.</li>
  </ol>
  
  <p>This was not what I was hoping to see. To debug this I tested:</p>
  
  <ol>
  <li>Create a Tomcat Virtual Machine</li>
  <li>On the VM Network blade, associated the VM with the "default" subnet, and specifically removed the Network Security Group from the VM (leaving it on the subnet - just making sure it's not explicitly attached to the VM)</li>
  <li>Tested HTTP access to the VM - traffic rejected</li>
  <li>Tested HTTP access to the App Service - traffic still permitted</li>
  <li>Changed the Network Security Group rule to allow</li>
  <li>Tested HTTP access to the VM and traffic permitted</li>
  </ol>
  
  <p>How do I get the App Service to use the Network Security Group the way the Virtual Machine does? Am I missing somewhere how to configure the subnet on the App Service? Is there another way to associate the NSG with the App Service?</p>
  
  <p>I don't have budget/need to build an ASE. All I need to do is put a firewall in front of my App Service to block out the ports I'm not wanting to see used.</p>
  
  <p>Thanks.</p>