1

I'm trying to enable Azure DocumentDB firewall by enabling the "Enable IP Access Control".

I managed to allow connections from my App Service. However the webjobs that reside on the app service does not have access to the Azure DocumentDB.

Is there a way to allow web job access to the DocumentDB? thanks

Andrew Liu
  • 7,577
  • 33
  • 45
Ismi Ammar
  • 33
  • 7

1 Answers1

0

Is there a way to allow web job access to the DocumentDB?

In short, no. If we want to enable firewall blocked access policy, we need to add the allowed list of IP addresss or IP address ranges.We can get more info from document. But the Azure WebApp IP is not static.

all of access to your Azure Cosmos DB database account from machines outside the configured allowed list of IP address ranges are blocked

I managed to allow connections from my App Service

If it is meaning that you have turn Allow access to Azure Portal on. If it is that case, it doesn't mean that we can access DocumentDB from Azure other services, it means that we can peform operations on the collections or docuemtns within account from azure portal.

Without portal access enabled, you will not be able to perform any operations on collections or documents within this account from the portal

In summary, if we want to allow web job access to the DocumentDB then we need to trun Enable IP Access Control off. Or we could use Azure cloudservice or virtual machine to instead of WebJob.

Edit:

According to your comment, if we want to use the same IP as WebApp, we could use the outbound IP, we can get them from the azure resources(https://resources.azure.com/) then add the outboundIpAddresses to the DocumentDB allowed IP list. Then webjob could access to the DocumentDB.

enter image description here

Note: The outboundIpAddresses are not static ips, they may be changed when we restart the WebApp or change WebApp service plan.

Tom Sun - MSFT
  • 22,436
  • 3
  • 23
  • 40
  • thanks for the answer. i thought the same ip address apply to the web job that resides on the App Service. Is there other way to enable firewall and open access to the web job? – Ismi Ammar May 26 '17 at 01:51
  • I have updated the answer, we could use the outbound ipaddress to let webjob to access the documentDB, but the IP are not static – Tom Sun - MSFT May 26 '17 at 02:44
  • I've tried this outbound IP address as well but seems to work only for the web app. web jobs still can't go through. I guess this still a no..thank you Tom. appreciate your answer. :) – Ismi Ammar May 26 '17 at 04:07
  • I do a demo with Webjob, it works correctly on my side. Please wait 30-60s to let the firewall work – Tom Sun - MSFT May 26 '17 at 05:02
  • I see. I'll try again ..thank you for your feedback. – Ismi Ammar May 29 '17 at 01:00