Azure App Service PaaS: scalable hosting for web apps, APIs, and mobile backends with CI/CD, autoscale, and enterprise security.

Key Points

• Managed OS and runtime images for Linux and Windows.
• Automatic platform maintenance keeps environments secure.
• Built-in load balancing with health probes and instance healing.
• Production-grade SLA with Premium/Isolated tiers.

Troubleshooting: Quick Wins

• Verify platform-level incidents in Azure Service Health.
• Compare app logs vs. platform events in Log Analytics.
• Use App Service Diagnostics (“Diagnose and solve problems” blade) for guided checks.

PowerShell: Create Plan + Web App

# Requires Az.Resources, Az.Websites modules
$rg = "rg-appsvc-demo"
$loc = "EastUS"
$plan = "asp-prod-p1v3"
$app  = "webapp-prod-001"

New-AzResourceGroup -Name $rg -Location $loc
New-AzAppServicePlan -Name $plan -ResourceGroupName $rg -Location $loc -Tier "PremiumV3" -WorkerSize "P1v3" -NumberofWorkers 2 -Linux
New-AzWebApp -Name $app -ResourceGroupName $rg -Location $loc -AppServicePlan $plan -Runtime "DOTNET:8"
      

Tip: Size up or down the plan without redeploying the app code.

Key Points

• Pick a runtime stack + version in Configuration.
• Use custom container if you need system dependencies.
• Node/Java apps can specify startup commands or scripts.

Azure CLI: Create Node.js App

rg=rg-appsvc-demo
loc=eastus
plan=asp-web-prod
app=web-node-001

az group create -n $rg -l $loc
az appservice plan create -n $plan -g $rg --sku P1v3 --is-linux
az webapp create -g $rg -p $plan -n $app --runtime "NODE|20-lts"
az webapp config appsettings set -g $rg -n $app --settings NODE_ENV=production ENABLE_ORYX_BUILD=true
      

Key Points

• Enable ARR Affinity only when sticky sessions are required.
• Use Azure API Management in front of APIs for throttling, auth, and versioning.
• Cache layer: Azure Cache for Redis to reduce load.

Kudu Zip Deploy (PowerShell)

$user = "$(Get-AzWebAppPublishingProfile -Name webapi-001 -ResourceGroupName rg-appsvc | Select-Object -ExpandProperty PublishingUserName)"
$pass = "$(Get-AzWebAppPublishingProfile -Name webapi-001 -ResourceGroupName rg-appsvc | Select-Object -ExpandProperty PublishingPassword)"
$pair = "$($user):$($pass)"
$base64 = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes($pair))
$hdr = @{ Authorization = "Basic $base64" }
Invoke-RestMethod -Uri "https://webapi-001.scm.azurewebsites.net/api/zipdeploy" -Method POST -Headers $hdr -InFile ".\drop.zip" -ContentType "application/zip"
      

Key Points

• Zero-downtime deployment using slots + health checks.
• Oryx builds auto-detect language & lock dependency versions.
• Use staged rollouts with slot traffic (% based).

PowerShell: Create Slots + Swap

$rg="rg-appsvc-demo"; $app="webapp-prod-001"
New-AzWebAppSlot -Name $app -ResourceGroupName $rg -Slot "staging"
# Deploy to 'staging' (via your pipeline), then swap:
Switch-AzWebAppSlot -Name $app -ResourceGroupName $rg -SourceSlotName "staging" -DestinationSlotName "production"
      

Azure CLI: Set Up Deployment from GitHub

az webapp deployment source config \
  --name webapp-prod-001 --resource-group rg-appsvc-demo \
  --repo-url https://github.com/yourorg/yourrepo --branch main --manual-integration
      

PowerShell: Autoscale Rules

$rg="rg-appsvc-demo"; $plan="asp-prod-p1v3"
$profile = New-AzAutoscaleProfile -Name "default" -DefaultCapacity 2 -MinimumCapacity 2 -MaximumCapacity 10
$scaleOut = New-AzAutoscaleRule -MetricName "CpuPercentage" -MetricResourceId (Get-AzAppServicePlan -Name $plan -ResourceGroup $rg).Id `
  -Operator GreaterThan -MetricStatistic Average -Threshold 70 -TimeGrain 00:01:00 -TimeWindow 00:05:00 -ScaleActionDirection Increase -ScaleActionValue 1 -ScaleActionCooldown 00:05:00
$scaleIn = New-AzAutoscaleRule -MetricName "CpuPercentage" -MetricResourceId (Get-AzAppServicePlan -Name $plan -ResourceGroup $rg).Id `
  -Operator LessThan -MetricStatistic Average -Threshold 35 -TimeGrain 00:01:00 -TimeWindow 00:10:00 -ScaleActionDirection Decrease -ScaleActionValue 1 -ScaleActionCooldown 00:10:00
Add-AzAutoscaleSetting -Name "asp-autoscale" -ResourceGroup $rg -Location "EastUS" -TargetResourceId (Get-AzAppServicePlan -Name $plan -ResourceGroup $rg).Id -AutoscaleProfile $profile -AutoscaleRule $scaleOut,$scaleIn
      

Key Points

• Warmup settings reduce cold starts after scale out.
• Set Health Check Path to route around bad instances.
• Use Min instance floor to absorb traffic spikes.

Key Points

• Active/active with Front Door + health probes.
• Blue/green per region with independent slots.
• Geo-replicate state (database/storage) appropriately.

CLI: Deploy Same App Name in Multiple Regions

for r in "eastus" "westeurope"; do
  az group create -n rg-$r -l $r
  az appservice plan create -g rg-$r -n asp-$r --is-linux --sku P1v3
  az webapp create -g rg-$r -p asp-$r -n myapp-$r --runtime "NODE|20-lts"
done
      

PowerShell: Bind Certificate

$rg="rg-appsvc-demo"; $app="webapp-prod-001"
# Upload PFX (if not using Key Vault)
$bytes = [IO.File]::ReadAllBytes(".\tls.pfx")
$enc = [Convert]::ToBase64String($bytes)
New-AzWebAppSSLBinding -WebAppName $app -ResourceGroupName $rg -CertificateFilePath ".\tls.pfx" -CertificatePassword (Read-Host "PFX Password" -AsSecureString) -Name "www.contoso.com"
      

Key Points

• Use free managed certs for basic TLS; rotate automatically.
• Prefer Key Vault references for enterprise key management.
• Redirect HTTP to HTTPS in app or via rewrite rules.

CLI: Health Check Path

az webapp config set -g rg-appsvc-demo -n webapp-prod-001 --health-check-path "/health"
      

Key Points

• Instrument /health to verify DB/cache connectivity.
• Use Always On to prevent idle unloads.
• Warmup slots before swapping to reduce cold starts.

PowerShell: Slot Settings

$rg="rg-appsvc-demo"; $app="webapp-prod-001"
$settings = @{ "ASPNETCORE_ENVIRONMENT"="Staging"; "FeatureFlag__NewUI"="true" }
Set-AzWebAppSlot -Name $app -ResourceGroupName $rg -Slot "staging" -AppSettings $settings -ConnectionStrings @()
      

Key Points

• Mark secrets as slot-specific where values differ.
• Use Swap with Preview to validate after warmup.
• Rollback instantly by swapping back.

Enable Logs (CLI)

az webapp log config -g rg-appsvc-demo -n webapp-prod-001 --application-logging filesystem --level Information --docker-container-logging filesystem
az webapp log tail -g rg-appsvc-demo -n webapp-prod-001
      

KQL: Slow Requests in the Last 1h

requests
| where timestamp > ago(1h)
| where duration > 1000ms
| project timestamp, name, url, duration, resultCode, operation_Id
| order by duration desc

Key Points

• Use Failed request tracing to debug 4xx/5xx.
• Collect app logs to Log Analytics for long-term retention.
• Alert on error rate, latency, and CPU with action groups.

CLI: Enable Entra ID Auth (EasyAuth)

az webapp auth set -g rg-appsvc-demo -n webapp-prod-001 \
  --enabled true \
  --action LoginWithAzureActiveDirectory \
  --aad-allowed-token-audiences https://webapp-prod-001.azurewebsites.net/.auth/login/aad/callback
      

Graph API: Sanity-check the Enterprise App (Service Principal)

# Using Microsoft Graph CLI (mgc). Ensure you've consented Directory.Read.All as needed.
mgc login
mgc beta service-principals list --filter "displayName eq 'webapp-prod-001'"
      

Key Points

• Use EasyAuth for quick SSO; bring middleware for custom policies.
• Protect APIs with tokens—validate audience/issuer in code.
• Use App Roles or Groups for authorization.

Key Points

• Private networking only—no public endpoints if desired.
• Best for regulated workloads needing isolation.
• Higher cost but stronger boundaries and capacity.

PowerShell: Add VNet Integration

$rg="rg-appsvc-demo"; $app="webapp-prod-001"
Add-AzWebAppVnetConnection -ResourceGroupName $rg -Name $app -VnetResourceGroupName "rg-network" -VnetName "vnet-apps" -SubnetName "snet-integration"
      

Key Points

• Integration subnet must have enough free IPs; disable subnet delegation conflicts.
• Use private DNS zones for name resolution of private endpoints.
• NSGs and UDRs can control outbound traffic from the integration subnet.

PowerShell: Assign MSI + Grant Key Vault Access

$rg="rg-appsvc-demo"; $app="webapp-prod-001"; $kv="kv-prod-001"
# Assign MSI
$web = Get-AzWebApp -Name $app -ResourceGroupName $rg
$web = Set-AzWebApp -Name $app -ResourceGroupName $rg -AssignIdentity
$principalId = $web.Identity.PrincipalId

# Grant Vault access via RBAC role (recommended)
New-AzRoleAssignment -ObjectId $principalId -RoleDefinitionName "Key Vault Secrets User" -Scope (Get-AzKeyVault -VaultName $kv -ResourceGroupName $rg).ResourceId
      

Code Snippet: Read Secret (C#)

var client = new SecretClient(new Uri("https://kv-prod-001.vault.azure.net/"),
    new DefaultAzureCredential());
var secret = await client.GetSecretAsync("DbPassword");
      

CLI: Configure Container Deploy

az webapp create -g rg-appsvc-demo -p asp-linux -n web-cnt-001 \
  --deployment-container-image-name contoso.azurecr.io/app:1.0.0

az webapp config container set -g rg-appsvc-demo -n web-cnt-001 \
  --docker-custom-image-name contoso.azurecr.io/app:1.0.1 \
  --docker-registry-server-url https://contoso.azurecr.io
      

Key Points

• Use WEBSITES_PORT app setting to expose container port.
• Health check path should hit container liveness endpoint.
• Prefer minimal bases (Alpine/Distroless) for smaller attack surface.

Key Points

• Hybrid Connections are TCP-based; ensure ports are open on-prem.
• For strict security, use VNet Integration + ER/VPN + private endpoints.
• Monitor relay status to detect connectivity issues.

PowerShell: Create Backup

$rg="rg-appsvc-demo"; $app="webapp-prod-001"; $storage="stbackups001"
New-AzWebAppBackup -ResourceGroupName $rg -Name $app -StorageAccountUrl "https://$storage.blob.core.windows.net/backups?<SAS>" -BackupName "on-demand-$(Get-Date -Format yyyyMMddHHmm)"
      

PowerShell: Restore Backup

Restore-AzWebAppBackup -ResourceGroupName $rg -Name $app -StorageAccountUrl "https://$storage.blob.core.windows.net/backups?<SAS>" -BlobName "on-demand-20251102.zip" -Overwrite
      

Key Points

• Test restores quarterly; document RTO/RPO.
• Store DB backups natively; app backup ≠ DB backup.
• Encrypt backup containers; manage SAS rotation.

CLI: Resize Plan

az appservice plan update -g rg-appsvc-demo -n asp-prod-p1v3 --sku P2v3
      

Key Points

• Apps in same plan share compute—watch noisy neighbor effects.
• Isolate critical apps in dedicated plans.
• Use budgets and cost alerts.

CLI: Local Git Deployment

az webapp deployment source config-local-git -g rg-appsvc-demo -n webapp-prod-001
# Then push to the provided Git remote URL
      

Key Points

• Prefer CI pipelines for secrets scanning and quality gates.
• Enforce branch protections and PR checks.
• Use Workload identity for GitHub to avoid publish profiles.

ZIP Run-From-Package (CLI)

az webapp deployment source config-zip -g rg-appsvc-demo -n webapp-prod-001 --src "./drop/app.zip"
      

Key Points

• Run-From-Package mounts the ZIP read-only for consistency.
• Use slots to validate before promote.
• Prefer CI/CD over manual FTP.

Key Points

• Web app handles sync requests; Functions handle async work.
• Share libraries via artifacts or private feeds.
• Use Durable Functions for orchestrations.

CLI: Set Startup Command

az webapp config set -g rg-appsvc-demo -n webapp-prod-001 --startup-file "python /home/site/wwwroot/start.py"
      

Key Points

• Keep startup under ~60–90s to avoid health failures.
• Log progress to STDOUT for troubleshooting.
• Use slots to run migrations before swap.

PowerShell: Process Dump (Windows)

# Via Kudu PowerShell console run procdump when process spikes:
procdump -ma w3wp -accepteula
      

Key Points

• Kudu: https://<app>.scm.azurewebsites.net for tools and APIs.
• Diagnose blade highlights common issues: memory leaks, 5xx spikes, cold starts.
• Download event logs and HTTP logs for offline analysis.

CLI: Queue Length Scale

az monitor autoscale rule create \
  --resource /subscriptions/<subId>/resourceGroups/rg-appsvc-demo/providers/Microsoft.Web/serverfarms/asp-prod-p1v3 \
  --condition "HttpQueueLength > 200 avg 5m" --scale out 1
      

Key Points

• Separate rules for business hours vs. off-hours.
• Use dynamic thresholds to reduce alert noise.
• Always define a max instance cap.

CLI: Bulk Apply Settings

az webapp config appsettings set -g rg-appsvc-demo -n webapp-prod-001 --settings \
  ASPNETCORE_ENVIRONMENT=Production FeatureFlag__NewUI=false Logging__Level__Default=Information
      

Key Points

• Use slot settings where values differ by environment.
• Centralize secrets in Key Vault; reference via app settings.
• Use feature flags to decouple releases from launches.

Key Points

• Offload JWT validation and transformations to APIM policies.
• Use products/subscriptions for external partners.
• Protect backend with private endpoints and VNet.

Key Points

• Prefer Functions for scalable event-driven work; WebJobs for simple co-deployment.
• Schedule via CRON expressions in settings.
• Monitor job logs in Kudu/LogFiles.

Security Controls Checklist

• Private endpoints + VNet egress.
• Managed Identity + Key Vault.
• WAF at edge (Front Door or AppGW).
• Threat detection with Defender for Cloud.
• Code scanning (SAST/DAST) in CI.

PowerShell: Stop Dev Plan Overnight

Stop-AzAppServicePlan -Name asp-dev -ResourceGroupName rg-dev
# In an Automation Account, schedule nightly stop and morning start.
      

Key Points

• Consolidate low-traffic apps on a shared plan.
• Split noisy apps into dedicated plans.
• Use App Insights sampling to control telemetry cost.

Key Points

• Use Event Grid for webhooks and reactive patterns.
• Service Bus for reliable, ordered, transactional messaging.
• Logic Apps for no-code/low-code integrations and workflows.