App Service public network access flipped back on exposes the app to the whole internet

Why it happens

Public network access on App Service is a single property, properties.publicNetworkAccess. Teams lock an app down by setting it to Disabled and routing traffic through a private endpoint, then someone re-enables it during troubleshooting ("the app is unreachable from my laptop") and never sets it back.

Azure treats Enabled as a perfectly valid state, so nothing errors and nothing warns. The app keeps serving traffic, so from the outside everything looks healthy while the private-only guarantee is silently gone.

What it costs / blast radius

This is a security regression, not a line item. With public access back on, the app's *.azurewebsites.net endpoint is reachable from the open internet, so any authentication weakness, unpatched dependency, or exposed admin path is now attacker-reachable rather than confined to your VNet. The private endpoint you paid for and designed around is bypassed. (Azure behavior; the blast radius depends on what the app fronts.)

See it

resource site 'Microsoft.Web/sites@2023-12-01' = {
  name: 'corp-api'
  location: location
  properties: {
    publicNetworkAccess: 'Enabled'   // undoes the private-endpoint lockdown
    // ...private endpoint still exists, but the app also answers the internet
  }
}

resource site 'Microsoft.Web/sites@2023-12-01' = {
  name: 'corp-api'
  location: location
  properties: {
    publicNetworkAccess: 'Disabled'  // inbound traffic only via the private endpoint
  }
}