You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/environment/app-service-app-service-environment-custom-settings.md
+17-22Lines changed: 17 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,21 +5,19 @@ author: seligj95
5
5
6
6
ms.assetid: 1d1d85f3-6cc6-4d57-ae1a-5b37c642d812
7
7
ms.topic: tutorial
8
-
ms.date: 03/06/2024
8
+
ms.date: 08/20/2025
9
9
ms.author: jordanselig
10
10
ms.custom: mvc, devx-track-arm-template
11
11
ms.service: azure-app-service
12
12
---
13
13
14
14
# Custom configuration settings for App Service Environments
15
15
16
-
## Overview
17
-
18
16
Because App Service Environments are isolated to a single customer, there are certain configuration settings that can be applied exclusively to App Service Environments. This article documents the various specific customizations that are available for App Service Environments.
19
17
20
-
If you do not have an App Service Environment, see [How to Create an App Service Environment v3](./creation.md).
18
+
If you don't have an App Service Environment, see [How to Create an App Service Environment v3](./creation.md).
21
19
22
-
You can store App Service Environment customizations by using an array in the new **clusterSettings** attribute. This attribute is found in the "Properties" dictionary of the *hostingEnvironments* Azure Resource Manager entity.
20
+
You can store App Service Environment customizations by using an array in the **clusterSettings** attribute. This attribute is found in the "Properties" dictionary of the *hostingEnvironments* Azure Resource Manager entity.
23
21
24
22
The following abbreviated Resource Manager template snippet shows the **clusterSettings** attribute:
25
23
@@ -43,24 +41,13 @@ The following abbreviated Resource Manager template snippet shows the **clusterS
43
41
}
44
42
```
45
43
46
-
The **clusterSettings** attribute can be included in a Resource Manager template to update the App Service Environment.
47
-
48
-
## Use Azure Resource Explorer to update an App Service Environment
49
-
50
-
Alternatively, you can update the App Service Environment by using [Azure Resource Explorer](https://resources.azure.com).
51
-
52
-
1. In Resource Explorer, go to the node for the App Service Environment (**subscriptions** > **{your Subscription}** > **resourceGroups** > **{your Resource Group}** > **providers** > **Microsoft.Web** > **hostingEnvironments**). Then click the specific App Service Environment that you want to update.
53
-
2. In the right pane, click **Read/Write** in the upper toolbar to allow interactive editing in Resource Explorer.
54
-
3. Click the blue **Edit** button to make the Resource Manager template editable.
55
-
4. Scroll to the bottom of the right pane. The **clusterSettings** attribute is at the very bottom, where you can enter or update its value.
56
-
5. Type (or copy and paste) the array of configuration values you want in the **clusterSettings** attribute.
57
-
6. Click the green **PUT** button that's located at the top of the right pane to commit the change to the App Service Environment.
44
+
The **clusterSettings** attribute can be included in a Resource Manager template or with the Azure CLI to update the App Service Environment. Certain settings are available in the Azure portal.
58
45
59
-
However you submit the change, the change is not immediate and it can take up to 24 hours for the change to take full effect. Some settings have specific details on the time and impact of configuring the specific setting.
46
+
However you submit the change, the change isn't immediate and it can take up to 24 hours for the change to take full effect. Some settings have specific details on the time and effect of configuring the specific setting.
60
47
61
48
## Enable internal encryption
62
49
63
-
The App Service Environment operates as a black box system where you cannot see the internal components or the communication within the system. To enable higher throughput, encryption is not enabled by default between internal components. The system is secure as the traffic is inaccessible to being monitored or accessed. If you have a compliance requirement though that requires complete encryption of the data path from end to end, there is a way to enable encryption of the complete data path with a clusterSetting.
50
+
The App Service Environment operates as a black box system where you can't see the internal components or the communication within the system. To enable higher throughput, encryption isn't enabled by default between internal components. The system is secure as the traffic is inaccessible to being monitored or accessed. If you have a compliance requirement though that requires complete encryption of the data path from end to end, there's a way to enable encryption of the complete data path with a clusterSetting.
64
51
65
52
```json
66
53
"clusterSettings": [
@@ -71,7 +58,11 @@ The App Service Environment operates as a black box system where you cannot see
71
58
],
72
59
```
73
60
74
-
Setting InternalEncryption to true encrypts internal network traffic in your App Service Environment between the front ends and workers, encrypts the pagefile and also encrypts the worker disks. After the InternalEncryption clusterSetting is enabled, there can be an impact to your system performance. When you make the change to enable InternalEncryption, your App Service Environment will be in an unstable state until the change is fully propagated. Complete propagation of the change can take a few hours to complete, depending on how many instances you have in your App Service Environment. We highly recommend that you do not enable InternalEncryption on an App Service Environment while it is in use. If you need to enable InternalEncryption on an actively used App Service Environment, we highly recommend that you divert traffic to a backup environment until the operation completes.
61
+
You can also enable internal encryption using the Azure portal by going to the **Configuration** page for your App Service Environment.
62
+
63
+
:::image type="content" source="./media/app-service-app-service-environment-custom-settings/app-service-environment-portal-internal-encryption.png" alt-text="Screenshot of the Configuration page in the Azure portal for an App Service Environment showing where to enable internal encryption." border="false":::
64
+
65
+
Setting InternalEncryption to true encrypts internal network traffic in your App Service Environment between the front ends and workers, encrypts the pagefile and also encrypts the worker disks. After the InternalEncryption clusterSetting is enabled, there can be an effect to your system performance. When you make the change to enable InternalEncryption, your App Service Environment is in an unstable state until the change is fully propagated. Complete propagation of the change can take a few hours to complete, depending on how many instances you have in your App Service Environment. We highly recommend that you don't enable InternalEncryption on an App Service Environment while it is in use. If you need to enable InternalEncryption on an actively used App Service Environment, we highly recommend that you divert traffic to a backup environment until the operation completes.
75
66
76
67
## Disable TLS 1.0 and TLS 1.1
77
68
@@ -90,9 +81,13 @@ If you want to disable all inbound TLS 1.0 and TLS 1.1 traffic for all of the ap
90
81
91
82
The name of the setting says 1.0 but when configured, it disables both TLS 1.0 and TLS 1.1.
92
83
84
+
You can also disable TLS 1.0 and TLS 1.1 using the Azure portal by going to the **Configuration** page for your App Service Environment and unchecking the checkbox.
85
+
86
+
:::image type="content" source="./media/app-service-app-service-environment-custom-settings/app-service-environment-portal-disable-tls.png" alt-text="Screenshot of the Configuration page in the Azure portal for an App Service Environment showing where to disable TLS 1.0 and TLS 1.1." border="false":::
87
+
93
88
## Change TLS cipher suite order
94
89
95
-
App Service Environment supports changing the cipher suite from the default. The default set of ciphers is the same set that is used in the multi-tenant App Service. Changing the cipher suite is only possible with App Service Environment, the single-tenant offering, not the multi-tenant offering, because changing it affects the entire App Service deployment. There are two cipher suites that are required for an App Service Environment: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Additionally, you should include the following cipher suites, which are required for TLS 1.3: TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256.
90
+
App Service Environment supports changing the cipher suite from the default. The default set of ciphers is the same set that is used in the multitenant App Service. Changing the cipher suite is only possible with App Service Environment, the single-tenant offering, not the multitenant offering, because changing it affects the entire App Service deployment. There are two cipher suites that are required for an App Service Environment: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Additionally, you should include the following cipher suites, which are required for TLS 1.3: TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256.
96
91
97
92
To configure your App Service Environment to use just the ciphers that it requires, modify the **clusterSettings** as shown in the following sample. **Ensure that the TLS 1.3 ciphers are included at the beginning of the list**.
98
93
@@ -106,7 +101,7 @@ To configure your App Service Environment to use just the ciphers that it requir
106
101
```
107
102
108
103
> [!WARNING]
109
-
> If incorrect values are set for the cipher suite that SChannel cannot understand, all TLS communication to your server might stop functioning. In such a case, you will need to remove the *FrontEndSSLCipherSuiteOrder* entry from **clusterSettings** and submit the updated Resource Manager template to revert back to the default cipher suite settings. Please use this functionality with caution.
104
+
> If incorrect values are set for the cipher suite that SChannel can't understand, all TLS communication to your server might stop functioning. In such a case, you'll need to remove the *FrontEndSSLCipherSuiteOrder* entry from **clusterSettings** and submit the updated Resource Manager template to revert back to the default cipher suite settings. Use this functionality with caution.
Copy file name to clipboardExpand all lines: articles/application-gateway/application-gateway-faq.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -186,7 +186,7 @@ sections:
186
186
answer: |
187
187
Updates initiated to Application Gateway are applied one [update domain](/azure/virtual-machines/availability-set-overview#how-do-availability-sets-work) at a time. As each update domain's instances are being updated, the remaining instances in other update domains continue to serve traffic. Active connections are gracefully drained from the instances being updated for up to 5 minutes to help establish connectivity to instances in a different update domain before the update begins. The update process proceeds to the next set of instances only if the current set of instances were upgraded successfully.
188
188
189
-
Azure Application Gateway also supports MaxSurge ([Rolling Upgrades with MaxSurge](/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-maxsurge)), a capability within Azure Virtual Machine Scale Sets (VMSS) that enables new instances to be provisioned during rolling upgrades without taking existing ones offline. By integrating MaxSurge into the upgrade process, customers can transition to newer gateway versions without any capacity degradation. MaxSurge is automatically enabled on Application Gateway and requires no configuration.
189
+
Azure Application Gateway also supports MaxSurge, a capability that enables new instances to be provisioned during rolling upgrades without taking existing ones offline. It allows customers to transition to newer gateway versions without any capacity degradation. MaxSurge is automatically enabled on Application Gateway and requires no configuration.
190
190
191
191
**Note:** Additional IP space is required to provision the temporary instances used by MaxSurge. If sufficient IP space is not available during an update, Application Gateway will fall back to the traditional upgrade method, which may result in reduced maximum capacity based on the number of instances.
Copy file name to clipboardExpand all lines: articles/azure-netapp-files/azacsnap-cmd-ref-runbefore-runafter.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ services: azure-netapp-files
5
5
author: Phil-Jensen
6
6
ms.service: azure-netapp-files
7
7
ms.topic: reference
8
-
ms.date: 02/20/2025
8
+
ms.date: 08/20/2025
9
9
ms.author: phjensen
10
10
# Customer intent: "As a cloud administrator, I want to use the runbefore and runafter capabilities of the Application Consistent Snapshot tool, so that I can automate command execution for backup and restoration processes with Azure NetApp Files."
11
11
---
@@ -105,6 +105,7 @@ if [ -r "${SAS_KEY_FILE}" ]; then
105
105
source "${SAS_KEY_FILE}"
106
106
else
107
107
echo "Credential file '${SAS_KEY_FILE}' not found, exiting!"
Copy file name to clipboardExpand all lines: articles/azure-netapp-files/configure-network-features.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,9 +70,7 @@ You can edit the network features option of existing volumes from *Basic* to *St
70
70
71
71
### Register the feature
72
72
73
-
Before editing network features on an existing volume, you need to register the feature. Ensure you are using the correct feature name for the change in network features you want to perform.
74
-
75
-
* To upgrade to Standard network features from Basic, use the feature name `ANFBasicToStdNetworkFeaturesUpgrade`.
73
+
Before upgradeing from Basic to Standard network features, you need to register the feature.
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments