diff --git a/.changeset/tidy-cooks-mix.md b/.changeset/tidy-cooks-mix.md
new file mode 100644
index 0000000000..41a2220547
--- /dev/null
+++ b/.changeset/tidy-cooks-mix.md
@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-azure-sites-backend': minor
+'@backstage/plugin-azure-sites-common': minor
+'@backstage/plugin-azure-sites': minor
+---
+
+Implemented Permission framework to protect start and stop `Azure sites`.
diff --git a/plugins/azure-sites-backend/api-report.md b/plugins/azure-sites-backend/api-report.md
index 751ff3f033..b8d8f23c13 100644
--- a/plugins/azure-sites-backend/api-report.md
+++ b/plugins/azure-sites-backend/api-report.md
@@ -9,6 +9,7 @@ import { AzureSiteStartStopRequest } from '@backstage/plugin-azure-sites-common'
 import { Config } from '@backstage/config';
 import express from 'express';
 import { Logger } from 'winston';
+import { PermissionEvaluator } from '@backstage/plugin-permission-common';
 
 // @public (undocumented)
 export class AzureSitesApi {
@@ -21,6 +22,8 @@ export class AzureSitesApi {
   start(request: AzureSiteStartStopRequest): Promise<void>;
   // (undocumented)
   stop(request: AzureSiteStartStopRequest): Promise<void>;
+  // (undocumented)
+  validateSite(annotationName: string, siteName: string): Promise<boolean>;
 }
 
 // @public (undocumented)
@@ -55,6 +58,8 @@ export interface RouterOptions {
   azureSitesApi: AzureSitesApi;
   // (undocumented)
   logger: Logger;
+  // (undocumented)
+  permissions: PermissionEvaluator;
 }
 
 // (No @packageDocumentation comment for this package)
diff --git a/plugins/azure-sites-common/api-report.md b/plugins/azure-sites-common/api-report.md
index 64b4275085..7eb88da1c8 100644
--- a/plugins/azure-sites-common/api-report.md
+++ b/plugins/azure-sites-common/api-report.md
@@ -3,6 +3,12 @@
 > Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).
 
 ```ts
+import { Entity } from '@backstage/catalog-model';
+import { ResourcePermission } from '@backstage/plugin-permission-common';
+
+// @public (undocumented)
+export const AZURE_WEB_SITE_NAME_ANNOTATION = 'azure.com/microsoft-web-sites';
+
 // @public (undocumented)
 export type AzureSite = {
   href: string;
@@ -29,11 +35,18 @@ export type AzureSiteListResponse = {
   items: AzureSite[];
 };
 
+// @public (undocumented)
+export const azureSitesActionPermission: ResourcePermission<'catalog-entity'>;
+
+// @public (undocumented)
+export const azureSitesPermissions: ResourcePermission<'catalog-entity'>[];
+
 // @public (undocumented)
 export type AzureSiteStartStopRequest = {
   subscription: string;
   resourceGroup: string;
   name: string;
+  entity?: Entity;
 };
 
 // (No @packageDocumentation comment for this package)
diff --git a/yarn.lock b/yarn.lock
index 5ed31502a5..8fe6c1c3ee 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -26733,6 +26733,7 @@ __metadata:
     "@backstage/plugin-auth-node": "workspace:^"
     "@backstage/plugin-azure-devops-backend": "workspace:^"
     "@backstage/plugin-azure-sites-backend": "workspace:^"
+    "@backstage/plugin-azure-sites-common": "workspace:^"
     "@backstage/plugin-badges-backend": "workspace:^"
     "@backstage/plugin-catalog-backend": "workspace:^"
     "@backstage/plugin-catalog-backend-module-scaffolder-entity-model": "workspace:^"