How does the ‘Allow public access from any Azure service within Azure to this server’ option in PaaS firewall settings function from a technical perspective?

@Grant-2223 ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know more about "Allow public access from any Azure service within Azure to this server". Sam Cogan 's answer is correct.

Azure internally maintains the list of IP Addresses for the services and these IP Addresses are added as Exceptions in addition to the Network Rules you configure.

See : Grant access to trusted Azure services

Some Azure services operate from networks that you can't include in your network rules. You can grant a subset of such trusted Azure services access to the storage account, while maintaining network rules for other apps. These trusted services will then use strong authentication to connect to your storage account.

To address your query, "If new ranges are added for a service, is there a chance that customers could experience rejected connections before the changes propagate?"

• No
• The changes are propagated throughout Azure and users should not see any rejected connections because of IP Restriction.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.