title: Restrict access to non production environments (Azure App Service)
body: <p>Non-production environments like staging, acceptance and testing are slots under a single App Service. I'd like to limit access to these environments to a specific set of users. The goal is to make the website fully functional for these users for testing. So disabling registration is not a simple solution. This is not about the management of the app service in Azure but rather about directly accessing the web application by visiting the web application URL.</p>
  
  <p>I tried using BasicAuth as the first level authentification to access the app service but this did not work due to conflict with the existing authentification.</p>
  
  <p>Then I've tried using <code>ipSecurity</code> rules in Web.Config. However, I cannot find how to only enable these restrictions when the app service is in non-production mode. I do not want a solution in which I have to manually have to add and remove IP rules.</p>
  
  <pre><code>&lt;system.webServer&gt;
    &lt;security&gt;
      &lt;!-- How to disable the following rule in production --&gt;
      &lt;ipSecurity allowUnlisted="false" denyAction="Forbidden"&gt;
        &lt;add allowed="true" ipAddress="203.0.113.0" subnetMask="255.255.255.0"/&gt;
      &lt;/ipSecurity&gt;
    &lt;/security&gt;
    &lt;/system.webServer&gt;
  </code></pre>
  
  <p>Another argument against IP rules is that the users which must have access often connect from dynamic IPs.</p>
  
  <p>Each environment has a unique URL and an application setting with the name of the environment it is in.</p>
  
  <hr>
  
  <p>How can I add another layer of authentication on these non-production environments without having to manually change files?</p>