Merge pull request #314607 from MicrosoftDocs/main

Auto Publish – main to live - 2026-04-11 06:00 UTC

Author: learn-build-service-prod[bot]

articles/app-service/configure-ssl-app-service-certificate.md

@@ -59,6 +59,49 @@ Currently, App Service certificates aren't supported in Azure national clouds.
 
 1. After the deployment is finished, select **Go to resource**.
 
+#### Authorize App Service certificate to access Azure Key Vault
+
+By default, the App Service certificate resource provider doesn't have access to your key vault. To store, renew, and rekey a certificate in key vault, you must authorize access for the resource provider (App Service certificate) to the key vault. You can grant access with role-based access control (RBAC) or access policy.
+
+#### [RBAC permissions](#tab/rbac)
+
+| Resource provider | Service principal app ID / assignee | Key Vault RBAC role |
+|--|--|--|
+| Microsoft.Azure.CertificateRegistration | `f3c21649-0979-4721-ac85-b0216b2cf413` | Key Vault Secrets Officer |
+
+The service principal app ID or assignee value is the application (client) ID for the App Service certificate resource provider.
+
+#### [Access policy permissions](#tab/accesspolicy)
+
+| Resource provider | Service principal app ID | Key Vault secret permissions | Key Vault certificate permissions |
+|--|--|--|--|
+| Microsoft.Azure.CertificateRegistration | `f3c21649-0979-4721-ac85-b0216b2cf413` | Get<br/>List<br/>Set<br/>Delete | Get<br/>List<br/>Set<br/>Delete |
+
+The service principal app ID or assignee value is the ID for the App Service certificate resource provider. To learn how to authorize Key Vault permissions for the App Service certificate resource provider by using an access policy, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy?tabs=azure-portal).
+
+---
+
+> [!NOTE]
+> Don't delete these permissions from the key vault. If you do, App Service certificate can't store, renew, or rekey the certificate in key vault.
+
+> [!IMPORTANT]
+> The values in the table are application (client) IDs. If you grant the Key Vault Certificate User role by using infrastructure-as-code (for example, ARM templates or Bicep), you typically must use the object ID of the corresponding enterprise application (service principal) in your Microsoft Entra tenant. Using the application ID works with some tooling (for example, Azure CLI role assignment), but ARM/Bicep role assignments generally require the service principal object ID.
+
+#### [Azure CLI](#tab/azure-cli/rbac)
+
+```azurecli-interactive
+az role assignment create --role "Key Vault Secrets Officer" --assignee "f3c21649-0979-4721-ac85-b0216b2cf413" --scope "/subscriptions/{subscriptionid}/resourcegroups/{resource-group-name}/providers/Microsoft.KeyVault/vaults/{key-vault-name}"
+```
+
+#### [Azure PowerShell](#tab/azure-powershell/rbac)
+
+```azurepowershell
+#Assign by Service Principal ApplicationId
+New-AzRoleAssignment -RoleDefinitionName "Key Vault Secrets Officer" -ApplicationId "f3c21649-0979-4721-ac85-b0216b2cf413" -Scope "/subscriptions/{subscriptionid}/resourcegroups/{resource-group-name}/providers/Microsoft.KeyVault/vaults/{key-vault-name}"
+```
+---
+
+
 #### Store the certificate in Azure Key Vault
 
 [Key Vault](/azure/key-vault/general/overview) is an Azure service that helps safeguard cryptographic keys and secrets used by cloud applications and services. For App Service certificates, we recommend that you use Key Vault. After you finish the certificate purchase process, you must complete a few more steps before you start using the certificate.

articles/app-service/configure-ssl-certificate.md

@@ -81,14 +81,13 @@ The free certificate comes with the following limitations:
 ### [Apex domain](#tab/apex)
 
 - Must have an A record pointing to your web app's IP address.
-- Must be on apps that are publicly accessible.
 - Isn't supported with root domains that are integrated with Azure Traffic Manager.
 - Must meet all the preceding criteria for successful certificate issuances and renewals.
 
 ### [Subdomain](#tab/subdomain)
 
 - Must have CNAME mapped _directly_ to `<app-name>.azurewebsites.net` or [trafficmanager.net](configure-domain-traffic-manager.md#enable-custom-domain). Mapping to an intermediate CNAME value blocks certificate issuance and renewal.
-- Must be on apps that are publicly accessible.
+- If using Azure Traffic Manager, the site must be configured as an [Azure endpoint](/azure/traffic-manager/traffic-manager-endpoint-types#azure-endpoints).
 - Must meet all the preceding criteria for successful certificate issuance and renewals.
 
 ---
@@ -144,9 +143,6 @@ By default, the App Service resource provider doesn't have access to your key va
 
 The service principal app ID or assignee value is the application (client) ID for the App Service resource provider.
 
-> [!IMPORTANT]
-> The values in the table are application (client) IDs. If you grant the Key Vault Certificate User role by using infrastructure-as-code (for example, ARM templates or Bicep), you typically must use the object ID of the corresponding enterprise application (service principal) in your Microsoft Entra tenant. Using the application ID works with some tooling (for example, Azure CLI role assignment), but ARM/Bicep role assignments generally require the service principal object ID.
-
 ### [Access policy permissions](#tab/accesspolicy)
 
 | Resource provider | Service principal app ID | Key Vault secret permissions | Key Vault certificate permissions |
@@ -155,12 +151,13 @@ The service principal app ID or assignee value is the application (client) ID fo
 
 The service principal app ID or assignee value is the ID for the App Service resource provider. To learn how to authorize Key Vault permissions for the App Service resource provider by using an access policy, see [Assign a Key Vault access policy](/azure/key-vault/general/assign-access-policy?tabs=azure-portal).
 
-Don't delete these access policy permissions from the key vault. If you do, App Service can't sync your web app with the latest Key Vault certificate version.
-
 ---
 
 > [!NOTE]
-> If Key Vault is configured to disable public access, select the **Allow trusted Microsoft services to bypass this firewall** checkbox to ensure that Microsoft services are allowed access. For more information, see [Key Vault firewall-enabled trusted services only](/azure/key-vault/general/network-security?WT.mc_id=Portal-Microsoft_Azure_KeyVault#key-vault-firewall-enabled-trusted-services-only).
+> Don't delete these permissions from Key Vault. If you do, App Service can't sync your web app with the latest Key Vault certificate version.
+
+> [!IMPORTANT]
+> The values in the table are application (client) IDs. If you grant the Key Vault Certificate User role by using infrastructure-as-code (for example, ARM templates or Bicep), you typically must use the object ID of the corresponding enterprise application (service principal) in your Microsoft Entra tenant. Using the application ID works with some tooling (for example, Azure CLI role assignment), but ARM/Bicep role assignments generally require the service principal object ID.
 
 #### [Azure CLI](#tab/azure-cli/rbac)
 
@@ -175,11 +172,11 @@ az role assignment create --role "Key Vault Certificate User" --assignee "abfa0a
 New-AzRoleAssignment -RoleDefinitionName "Key Vault Certificate User" -ApplicationId "abfa0a7c-a6b6-4736-8310-5855508787cd" -Scope "/subscriptions/{subscriptionid}/resourcegroups/{resource-group-name}/providers/Microsoft.KeyVault/vaults/{key-vault-name}"
 ```
 
-> [!NOTE]
-> Don't delete these RBAC permissions from Key Vault. If you do, App Service can't sync your web app with the latest Key Vault certificate version.
-
 ---
 
+> [!NOTE]
+> If Key Vault is configured to disable public access, select the **Allow trusted Microsoft services to bypass this firewall** checkbox to ensure that Microsoft services are allowed access. For more information, see [Key Vault firewall-enabled trusted services only](/azure/key-vault/general/network-security?WT.mc_id=Portal-Microsoft_Azure_KeyVault#key-vault-firewall-enabled-trusted-services-only).
+
 ### Import a certificate from your vault to your app
 
 1. In the [Azure portal](https://portal.azure.com), on the left pane, select **App Services** > *\<app-name>*.