There is a command group 'az_functionapp_config_access restriction'. This group of commands could 'methods that show  set  add  and remove access restrictions on a functionapp'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_functionapp_config_access restriction_add'.The syntax is: az functionapp config access-restriction add --priority
                                             [--action {allow, deny}]
                                             [--description]
                                             [--http-headers]
                                             [--ids]
                                             [--ignore-missing-endpoint {false, true}]
                                             [--ip-address]
                                             [--name]
                                             [--resource-group]
                                             [--rule-name]
                                             [--scm-site {false, true}]
                                             [--service-tag]
                                             [--slot]
                                             [--subnet]
                                             [--subscription]
                                             [--vnet-name]
                                             [--vnet-resource-group]. The 1th example of the child command would be to use it to 'add access restriction opening  allow  named developers for ipv4 address 130 220 0 0 27 with priority 200 to main site', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --rule-name developers --action Allow --ip-address 130.220.0.0/27 --priority 200. The 2th example of the child command would be to use it to 'add access restriction opening  allow  named build_server for ipv4 address 192 168 0 0 27 with priority 250 to scm site', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --rule-name build_server --action Allow --ip-address 192.168.0.0/27 --priority 250 --scm-site true. The 3th example of the child command would be to use it to 'add access restriction opening  allow  named app_gateway for subnet app_gw in vnet core_weu with priority 300 to main site', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --rule-name app_gateway --action Allow --vnet-name core_weu --subnet app_gateway --priority 300. The 4th example of the child command would be to use it to 'add access restriction opening  allow  named internal_agents for subnet build_agents in vnet corp01 with priority 500 to scm site  and ignore service endpoint registration on the subnet', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --rule-name internal_agents --action Allow --vnet-name corp01 --subnet build_agents --priority 500 --scm-site true --ignore-missing-endpoint true. The 5th example of the child command would be to use it to 'add access restriction opening  allow  named remote_agents in vnet  corp01  in rg  vnets  with subnet  agents', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --rule-name remote_agents --action Allow --vnet-name corp01 --subnet agents --priority 500 --vnet-resource-group vnets. The 6th example of the child command would be to use it to 'add access restriction opening  allow  named agents in vnet  corp01  in rg  vnets  with subnet  agents   using subnet resource id', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --rule-name remote_agents --action Allow --priority 800 --subnet '/subscriptions/<subscription-id>/resourceGroups/vnets/providers/Microsoft.Network/virtualNetworks/corp01/subnets/agents'. The 7th example of the child command would be to use it to 'add access restriction opening  allow  with no rule name for service tag azurecloud', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --priority 400 --service-tag AzureCloud. The 8th example of the child command would be to use it to 'add access restriction opening  allow  with no rule name for service tag azurefrontdoor backend and http header x azure fdid with value  12345678 abcd 1234 abcd 12345678910a', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --priority 400 --service-tag AzureFrontDoor.Backend --http-header x-azure-fdid=12345678-abcd-1234-abcd-12345678910a. The 9th example of the child command would be to use it to 'add access restriction opening  allow  with multiple http header values for the same header  x azure fdid', the syntax is: az functionapp config access-restriction add -g ResourceGroup -n AppName --priority 400 --service-tag AzureFrontDoor.Backend --http-header x-azure-fdid=12345678-abcd-1234-abcd-12345678910a x-azure-fdid=11111111-abcd-1234-abcd-222222222222. The parameter '--priority -p' is required. It is used to priority of the access restriction rule.. The parameter '--action' is optional. allow or deny access.. The parameter '--description' is optional. description of the access restriction rule.. The parameter '--http-headers' is optional. space-separated http headers in a format of `<name>=<value>`.. The parameter '--ids' is optional. one or more resource ids (space-delimited). it should be a complete resource id containing all information of 'resource id' arguments. you should provide either --ids or other 'resource id' arguments.. The parameter '--ignore-missing-endpoint -i' is optional. create access restriction rule with checking if the subnet has microsoft.web service endpoint enabled.. The parameter '--ip-address' is optional. ip address or cidr range (optional comma separated list of up to 8 ranges).. The parameter '--name -n' is optional. name of the function app.. The parameter '--resource-group -g' is optional. name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--rule-name -r' is optional. name of the access restriction rule to add.. The parameter '--scm-site' is optional. true if access restrictions is added for scm site.. The parameter '--service-tag' is optional. service tag (optional comma separated list of up to 8 tags).. The parameter '--slot -s' is optional. the name of the slot. default to the productions slot if not specified.. The parameter '--subnet' is optional. subnet name (requires vnet name) or subnet resource id.. The parameter '--subscription' is optional. name or id of subscription. you can configure the default subscription using `az account set -s name_or_id`.. The parameter '--vnet-name' is optional. vnet name.. The parameter '--vnet-resource-group' is optional. resource group of virtual network (default is web app resource group).. 