DevOps Peach| Topic | Key points |
|---|---|
| Authentication | Anonymous by default; turn on App Service Authentication ("Easy Auth") with Entra ID, Google, GitHub… without code changes |
| Access restrictions | Allow/deny lists by IP/subnet/service tag, evaluated by priority |
| Secrets | Put them in app settings as Key Vault references (@Microsoft.KeyVault(...)) instead of plain text |
| TLS | Certificates (free managed certificates or your own), turn on HTTPS only |
| Custom domains | Create a CNAME (www) or A + TXT (apex) in DNS, then validate in Azure; needs a supporting tier (Basic and above) |
| Backups | Manual/scheduled, covering config, files and linked databases; from Basic (Basic: production slot only); size limits apply; restore to the same or a new app |
flowchart LR
U["Users"] --> AR{"Access restrictions"} --> EA["Easy Auth (Entra ID)"] --> APP["app-devops-lab-01"]
APP --> KV["Key Vault reference"]
APP --> AI["Application Insights<br/>requests, failures, response time"]
APP --> LOG["Log stream"]
Application Insights (part of Azure Monitor): request rate, failure rate, response time, dependencies, page views, users/sessions, exceptions, live metrics.
App settings are the app's environment variables; changing them restarts the app.
| Command | Meaning |
|---|---|
az webapp config appsettings set -g rg-devops-lab -n app-devops-lab-01 --settings LOG_LEVEL=info |
Set an app setting |
az webapp log tail -g rg-devops-lab -n app-devops-lab-01 |
Stream live logs |
az webapp list-runtimes --os linux |
Supported runtimes |
Networking
| Feature | Direction | Use |
|---|---|---|
| VNet integration | Outbound | The app reaches databases and APIs inside a VNet |
| Private endpoint | Inbound | Users reach the app only through a private IP |
| Access restrictions | Inbound | Allow or deny by IP, subnet, or service tag |
| Hybrid Connections | Outbound | Reach a single on-premises host and port without a VPN |
VNet integration needs a dedicated, delegated subnet and does not make the app private by itself; combine it with a private endpoint or access restrictions for that.
Keeping instances healthy
The Health check feature pings a path such as /health on every instance and removes one that keeps failing from the load balancer rotation, replacing it if needed. Always On keeps the app loaded so the first request after idle time is not slow; it requires Basic or higher. Auto-heal can recycle the process when memory or slow-request thresholds are crossed.
Identity and secrets
Give the app a managed identity and grant it roles on Key Vault, storage, or SQL, so connection strings no longer carry passwords. Key Vault references then read secrets through that identity.
Logs and diagnostics
Enable application logging and web server logging, or better, a diagnostic setting that sends AppServiceHTTPLogs, AppServiceConsoleLogs, and AppServiceAppLogs to Log Analytics. Diagnose and solve problems in the portal runs automatic checks for high CPU, crashes, SNAT port exhaustion, and certificate problems, and is usually the fastest first step.
Operating the app
az webapp restart restarts the app on all instances, and az webapp stop stops it, though the plan is still billed. For full network isolation at large scale, an App Service Environment places a dedicated deployment of App Service inside your VNet.