ZIP deploy file to Azure Web App using a SAS URL always fails with a 403 Forbidden error

Emma Wang 0

I am trying to publish my web app using the command described in this documentation:

https://learn.microsoft.com/en-us/azure/app-service/deploy-zip?tabs=cli#deploy-to-network-secured-apps

az webapp deploy --resource-group

Siva Nair 735 Reputation points Microsoft External Staff

2025-03-13T18:43:49.4933333+00:00

Hi Emma Wang,

Verify the SAS token’s permissions and expiry—regenerate the token if necessary to ensure it has the required read permissions (sp=r) and a sufficient validity period.

Moreover, ensure that either your storage account allows access from Azure services or that you’ve explicitly permitted the necessary outbound IP ranges for your web app’s deployment environment. review your storage account’s network settings: if network restrictions or firewall rules are enabled, check that the Kudu service’s outbound IP addresses (or “Trusted Microsoft services”) are allowed, or temporarily relax these restrictions to test your deployment.

confirm that the SAS URL has been correctly copied, with the complete token intact and properly encoded. when deploying to network-secured apps, it is essential that the SAS URL is accessible from within the network environment in which your web app operates.

If you have any further assistant, do let me know.

Your answer