Azure Devops release pipeline Failed to deploy web package to App Service. Ip Forbidden 403

Question

My release pipeline has started to fail today after working fine for months.. I'm unable to find any information regarding this error. Here is the relevant log after setting System.Debug=true.

2019-06-03T09:12:56.1141807Z Package deployment using ZIP Deploy initiated.
2019-06-03T09:12:56.1227504Z ##[debug][POST]https://$DuoCore__staging:***@xxx-staging.scm.azurewebsites.net/api/zipdeploy?deployer=VSTS&message=%7B%22type%22%3A%22deployment%22%2C%22commitId%22%3A%2241ea351fc04ac594f9a979d19117e494e03c30aa%22%2C%22buildId%22%3A%223477%22%2C%22releaseId%22%3A%221780%22%2C%22buildNumber%22%3A%2220190602.1%22%2C%22releaseName%22%3A%22Release-37%22%2C%22repoProvider%22%3A%22TfsGit%22%2C%22repoName%22%3A%22xxxFront%22%2C%22collectionUrl%22%3A%22https%3A%2F%2Fvectorcuatrogroup.visualstudio.com%2F%22%2C%22teamProject%22%3A%223a39c617-c412-480d-aa54-be5cca265a43%22%2C%22slotName%22%3A%22Staging%22%7D
2019-06-03T09:12:56.2135188Z ##[debug]Could not parse response: {}
2019-06-03T09:12:56.2135454Z ##[debug]Response: undefined
2019-06-03T09:12:56.2137686Z ##[debug]ZIP Deploy response: {"statusCode":403,"statusMessage":"Ip Forbidden","headers":{"content-type":"text/html","server":"Microsoft-IIS/10.0","date":"Mon, 03 Jun 2019 09:12:55 GMT","connection":"close","content-length":"2399"},"body":"<!DOCTYPE html>\r\n<html>\r\n<head>\r\n    <title>Web App - Unavailable</title>\r\n    <style type=\"text/css\">\r\n        html {\r\n            height: 100%;\r\n            width: 100%;\r\n        }\r\n\r\n        #feature {\r\n            width: 960px;\r\n            margin: 95px auto 0 auto;\r\n            overflow: auto;\r\n        }\r\n\r\n        #content {\r\n            font-family: \"Segoe UI\";\r\n            font-weight: normal;\r\n            font-size: 22px;\r\n            color: #ffffff;\r\n            float: left;\r\n            width: 460px;\r\n            margin-top: 68px;\r\n            margin-left: 0px;\r\n            vertical-align: middle;\r\n        }\r\n\r\n            #content h1 {\r\n                font-family: \"Segoe UI Light\";\r\n                color: #ffffff;\r\n                font-weight: normal;\r\n                font-size: 60px;\r\n                line-height: 48pt;\r\n                width: 800px;\r\n            }\r\n\r\n        p a, p a:visited, p a:active, p a:hover {\r\n            color: #ffffff;\r\n        }\r\n\r\n        #content a.button {\r\n            background: #0DBCF2;\r\n            border: 1px solid #FFFFFF;\r\n            color: #FFFFFF;\r\n            display: inline-block;\r\n            font-family: Segoe UI;\r\n            font-size: 24px;\r\n            line-height: 46px;\r\n            margin-top: 10px;\r\n            padding: 0 15px 3px;\r\n            text-decoration: none;\r\n        }\r\n\r\n            #content a.button img {\r\n                float: right;\r\n                padding: 10px 0 0 15px;\r\n            }\r\n\r\n            #content a.button:hover {\r\n                background: #1C75BC;\r\n            }\r\n    </style>\r\n</head>\r\n<body bgcolor=\"#00abec\">\r\n    <div id=\"feature\">\r\n            <div id=\"content\">\r\n                <h1 id=\"unavailable\">Error 403 - This web app is stopped.</h1>\r\n                <p id=\"tryAgain\">The web app you have attempted to reach is currently stopped and does not accept any requests. Please try to reload the page or visit it again soon.</p>\r\n                <p id=\"toAdmin\">If you are the web app administrator, please find the common 403 error scenarios and resolution <a href=\"http://blogs.msdn.com/b/waws/archive/2016/01/05/azure-web-apps-error-403-this-web-app-is-stopped.aspx\" target=\"_blank\">here</a>. For further troubleshooting tools and recommendations, please visit <a href=\"https://portal.azure.com/\">Azure Portal</a>.</p>\r\n        </div>\r\n    </div>\r\n</body>\r\n</html>\r\n"}
2019-06-03T09:12:56.2199524Z ##[error]Failed to deploy web package to App Service.
2019-06-03T09:12:56.2208644Z ##[debug]Processed: ##vso[task.issue type=error;]Failed to deploy web package to App Service.
2019-06-03T09:12:56.2208989Z ##[debug]Deployment Failed with Error: Error: Error: Failed to deploy web package to App Service. Ip Forbidden (CODE: 403)
2019-06-03T09:12:56.2209141Z ##[debug]task result: Failed
2019-06-03T09:12:56.2209425Z ##[error]Error: Error: Failed to deploy web package to App Service. Ip Forbidden (CODE: 403)
2019-06-03T09:12:56.2209663Z ##[debug]Processed: ##vso[task.issue type=error;]Error: Error: Failed to deploy web package to App Service. Ip Forbidden (CODE: 403)
2019-06-03T09:12:56.2210196Z ##[debug]Processed: ##vso[task.complete result=Failed;]Error: Error: Failed to deploy web package to App Service. Ip Forbidden (CODE: 403)
2019-06-03T09:12:56.2210358Z ##[debug]Application Insights is not configured for the App Service. Skipping adding release annotation.
2019-06-03T09:12:56.2210529Z ##[debug][POST]https://management.azure.com/subscriptions/7b86f649-7ce5-4da3-ac60-3ad477c0dd15/resourceGroups/RG_DUO_WEBAPP_PRE/providers/Microsoft.Web/sites/DuoCore/slots/Staging/publishxml?api-version=2016-08-01
2019-06-03T09:12:56.7236671Z ##[debug]Could not parse response: {}
2019-06-03T09:12:56.7237203Z ##[debug]Response: undefined
2019-06-03T09:12:56.7380358Z App Service Application URL: http://duocore-staging.azurewebsites.net
2019-06-03T09:12:56.7381542Z ##[debug]set AppServiceApplicationUrl=http://duocore-staging.azurewebsites.net
2019-06-03T09:12:56.7382651Z ##[debug]Processed: ##vso[task.setvariable variable=AppServiceApplicationUrl;issecret=false;]http://duocore-staging.azurewebsites.net
2019-06-03T09:12:56.7383220Z ##[debug]Deployment failed
2019-06-03T09:12:56.7608716Z ##[section]Finishing: Deploy Azure App Service to Slot

I had verified my connection from Devops, it's ok.

Please verify whether the SPN expired first, just validate once from service endpoint is ok. — Mengdi Liang
– Mengdi Liang, Commented Jun 3, 2019 at 7:21
@MerlinLiang-MSFT Thanks. I had verified the connection, it's working fine, I had updated my question with this step. Anything else to check? — Oscar
– Oscar, Commented Jun 3, 2019 at 7:34
If convenient, could you set debug=true and update the detailed log here? — Mengdi Liang
– Mengdi Liang, Commented Jun 3, 2019 at 8:24
Thanks @MerlinLiang-MSFT, I had updated my question with debug log. WWe're using deployment slots for deploying, in the first task the slot is created succesfully, but it then fails when deploying to it. I can confirm that the slot is created succesfully from the Azure portal. — Oscar
– Oscar, Commented Jun 3, 2019 at 9:45
You are so welcome@Oscar. I think you'd better confirm that did anyone change your app service's access restrictions in azure. Please try with remove all access restrictions and deploy again. — Mengdi Liang
– Mengdi Liang, Commented Jun 3, 2019 at 15:06

andyhammar · Accepted Answer · 2021-01-27 13:48:00Z

6

Solution: make sure there's no IP restriction on .scm.azurewebsites.net

Had the same error, finally figured out why. I had configured the firewall on the function app to only allow a few IPs through, and mistakenly ticked the box to use the same settings for .SCM.azurewebsite.net too.

answered Jan 27, 2021 at 13:48

andyhammar

1,44313 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Tobi · Accepted Answer · 2021-04-01 13:39:21Z

1

If you have strict firewall rules, you may deactivate those during deployment. I do in CI Pipeline via:

az webapp config access-restriction set -g ResourceGroup -n AppName --use-same-restrictions-for-scm-site false

And after deployment:

az webapp config access-restriction set -g ResourceGroup -n AppName --use-same-restrictions-for-scm-site true

Of course you can do it even more detailed, and deactivate specific firewall rules. az webapp config access-restriction

answered Apr 1, 2021 at 13:39

Tobi

1811 gold badge1 silver badge13 bronze badges

Comments

Ben · Accepted Answer · 2024-07-09 15:58:54Z

0

I had this same issue, and as it turns out SCM basic auth is disabled by default and will cause the deployment(s) to fail with the error reported above. I enabled it and deployments worked:

answered Jul 9, 2024 at 15:58

Ben

1,0928 silver badges19 bronze badges

Collectives™ on Stack Overflow

Azure Devops release pipeline Failed to deploy web package to App Service. Ip Forbidden 403

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related