Microsoft AZ-104 - Microsoft Azure Administrator - Deploy and manage Azure Compute Resources - Azure App Services

brencronin

29 minutes ago

4 min read

Create and configure Azure App Service

Provision an App Service plan
Configure scaling for an App Service plan
Create an App Service
Configure certificates and Transport Layer Security (TLS) for an App Service
Map an existing custom DNS name to an App Service
Configure backup for an App Service
Configure networking settings for an App Service
Configure deployment slots for an App Service

1. Provision an App Service plan

Choose the region, Windows/Linux OS, pricing tier, and instance size.
The plan supplies compute; web apps run on that compute.
Apps sharing a plan share its resources. Dedicated-plan instances are billed even when an app is stopped. Microsoft Learn

2. Configure scaling

Scale up/down: Change instance size or pricing tier.
Scale out/in: Change the number of instances.
Azure Monitor autoscale: Metric-based or scheduled rules; Standard tier and above.
App Service automatic scaling: HTTP-demand-based scaling on supported Premium tiers; distinct from Azure Monitor autoscale.

3. Create an App Service

Create a Web App, select code or container deployment, and choose a compatible runtime and plan.
Deploy the application; configure environment variables, managed identity, and monitoring.
Web app = application. App Service plan = hosting capacity.

4. Configure certificates and TLS

Bind a certificate to each custom hostname that requires HTTPS.
Use an eligible free managed certificate, or import a certificate, including supported Key Vault integration.
Enable HTTPS Only, configure the minimum TLS version, and verify renewal. Managed certificates renew automatically while prerequisites remain satisfied.

5. Map an existing custom DNS name

Typically use a CNAME for a subdomain or an A record for an apex domain.
Add the required asuid TXT verification record, then validate and bind the hostname in App Service.
Add a TLS certificate binding separately, DNS mapping alone does not secure HTTPS.

6. Configure backup

Use supported automatic backups or configure custom backups to Azure Storage.
Check plan eligibility, content-storage restrictions, schedule, and retention.
Protect databases separately and test restoration; an app backup is not a complete disaster recovery plan.

7. Configure networking

Private endpoint: Private inbound access to the app; requires appropriate DNS.
VNet Integration: Outbound access from the app to private resources.
Use access restrictions for public-endpoint filtering; explicitly configure public network access as required.
Private endpoints and VNet Integration use separate subnets.

8. Configure deployment slots

Use Standard, Premium, or Isolated tiers.
Deploy to staging, test and warm up, then swap with production.
Mark environment-specific values as deployment slot settings so they remain with the slot.
Slots share plan resources. Swapping back does not undo database changes.

Other Azure App Service concepts

1. Move an App Service web app to another resource group

Scenario: RG1 contains a web app named appservice1 that uses a TLS/SSL certificate. You need to move RG1’s resources to RG2.

Correct selections:

Delete the SSL certificate from RG1 and upload it to RG2.
Move all the resources from RG1 to RG2.

For an uploaded certificate, preserve the certificate file and private key, remove the affected bindings and certificate, move the resources, then upload and rebind the certificate in the destination. Plan for possible HTTPS disruption during this process.

You do not need to create a replacement web app or App Service plan. A resource-group move changes resource IDs and management scope; it does not relocate the app to another Azure region.

Important distinctions:

A free App Service managed certificate must be deleted and recreated, rather than exported and uploaded.
Microsoft’s explicit requirement to move all App Service resources together applies to cross-subscription moves. Do not generalize that restriction to every same-subscription resource-group move.
The scenario does not specify the certificate type; the supplied answer assumes an uploaded certificate. Microsoft Learn

Exam tip: Moving existing resources is different from recreating them. Check certificate handling and move dependencies before starting.

2. Connect App Service to an on-premises database with Hybrid Connections

App Service Hybrid Connections lets an application access a specific on-premises TCP hostname and port, such as a SQL Server endpoint, without deploying a site-to-site VPN.

It uses Azure Relay and a Hybrid Connection Manager installed on a supported machine that can reach the target endpoint. The manager establishes outbound connectivity to Azure, avoiding the need to expose the database through a new inbound internet firewall rule.

Hybrid Connections provides access to configured endpoints—not general connectivity to the entire on-premises network. Database authentication and authorization are still required; configure database TLS where appropriate.

Exam tip: Access to one on-premises TCP endpoint without a VPN points toward Hybrid Connections.

3. Use modular templates for repeatable App Service deployments

Use ARM nested or linked templates, or Bicep modules, to divide an application deployment into reusable components—for example, hosting, networking, monitoring, and identity.

Parameters supply environment-specific values such as names, regions, and pricing tiers.
Dependencies ensure resources are deployed in the required order.
Conditions control whether optional resources are deployed.
Outputs pass resource identifiers or other results between components.

Nested ARM templates embed another deployment definition; linked templates reference a separate template. Bicep modules provide a simpler modular authoring approach and compile into ARM deployments.

Templates support consistent security configuration, but modularity alone does not establish regulatory compliance. Combine reviewed templates with Azure Policy, appropriate permissions, validation, and monitoring.

Exam tip: Reusable deployment logic plus environment-specific configuration points toward modules/templates with parameters.