Skip to content

Commit ee63bff

Browse files
v-aljev-alje
committed
Merge branch 'main' into release-aio-2603
2 parents 2d29d1d + 4f8e521 commit ee63bff

82 files changed

Lines changed: 2038 additions & 1263 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎articles/app-service/configure-ssl-certificate-in-code.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ ms.custom:
1717

1818
[!INCLUDE [app-service-managed-certificate](./includes/managed-certs/managed-certs-note.md)]
1919

20-
In your application code, you can access both [public key certificates and certificates that contain a private key that you add to Azure App Service.](configure-ssl-certificate.md). Your app code might act as a client and access an external service that requires certificate authentication. It might also need to perform cryptographic tasks. This article shows how to use public or private certificates in your application code.
20+
In your application code, you can access both [public key certificates and certificates that contain a private key that you add to Azure App Service.](configure-ssl-certificate.md). Your app code might act as a client and access an external service that requires certificate authentication. It might also need to perform cryptographic tasks. This article shows how to use publicly or privately signed certificates in your application code.
2121

2222
This approach to using certificates in your code makes use of the Transport Layer Security (TLS) functionality in App Service, which requires your app to be in the Basic tier or higher. If your app is in the Free or Shared tier, you can [include the certificate file in your app repository](#load-a-certificate-from-a-file).
2323

@@ -111,7 +111,7 @@ For languages that don't support or offer insufficient support for the Windows c
111111

112112
## Load a certificate from a file
113113

114-
If you need to load a certificate file that you upload manually, it's better to upload the certificate by using [File Transfer Protocol Secure (FTPS)](deploy-ftp.md) instead of [Git](deploy-local-git.md), for example. Keep sensitive data like a private certificate out of source control.
114+
If you need to load a certificate file that you upload manually, it's better to upload the certificate by using [File Transfer Protocol Secure (FTPS)](deploy-ftp.md) instead of [Git](deploy-local-git.md), for example. Keep sensitive data like certificate private keys out of source control.
115115

116116
ASP.NET and ASP.NET Core on Windows must access the certificate store even if you load a certificate from a file. To load a certificate file in a Windows .NET app, load the current user profile with the following command in <a target="_blank" href="https://shell.azure.com" >Cloud Shell</a>:
117117

@@ -140,7 +140,7 @@ To see how to load a TLS/SSL certificate from a file in Node.js, PHP, Python, or
140140

141141
The `WEBSITE_LOAD_CERTIFICATES` app setting makes the specified certificates accessible to your Windows or Linux custom containers (including built-in Linux containers) as files. The files are found under the following directories:
142142

143-
| Container platform | Public certificates | Private certificates |
143+
| Container platform | Public certificate files (no private key) | Certificate files that include a private key |
144144
| - | - | - |
145145
| Windows container | `C:\appservice\certificates\public` | `C:\appservice\certificates\private` |
146146
| Linux container | `/var/ssl/certs` | `/var/ssl/private` |

‎articles/app-service/environment/app-service-app-service-environment-geo-distributed-scale.md‎

Lines changed: 77 additions & 62 deletions
Large diffs are not rendered by default.

‎articles/app-service/environment/configure-network-settings.md‎

Lines changed: 156 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,48 @@
11
---
2-
title: Configure App Service Environment v3 network settings
3-
description: Configure network settings that apply to the entire Azure App Service environment. Learn how to do it with Azure Resource Manager templates.
2+
title: Configure App Service Environment Networking Settings
3+
description: Configure networking settings for an Azure App Service environment, including FTP access, private endpoint creation, and remote debugging. Use the Azure CLI, Azure Resource Manager templates, or the Azure portal.
44
author: seligj95
55
keywords: ASE, ASEv3, ftp, remote debug
6-
7-
ms.topic: tutorial
6+
ms.topic: how-to
87
ms.custom: devx-track-arm-template, devx-track-azurecli
9-
ms.date: 03/29/2022
8+
ms.date: 03/13/2026
109
ms.author: jordanselig
1110
ms.service: azure-app-service
11+
#customer intent: As an App Service developer, I want to configure networking settings for my App Service environments, so I can control FTP access, private endpoint creation, and remote debugging.
1212
---
1313

14-
# Network configuration settings
14+
# Configure networking settings for App Service Environments
15+
16+
App Service Environment v3 provides a fully isolated and dedicated environment for securely running App Service apps. This article describes how to configure the networking settings for an App Service Environment, including FTP access, private endpoint creation, and remote debugging. Procedures are provided to configure the settings by using the Azure CLI or an Azure Resource Manager template (ARM template), and by updating the resource directly in the Azure portal.
17+
18+
## Prerequisites
19+
20+
- An App Service Environment v3. To create a new environment, follow the steps in [Quickstart: Create an App Service Environment](creation.md).
21+
22+
## Review networking settings
23+
24+
The App Service Environment networking settings are located in a single ARM template subresource:
25+
26+
`Microsoft.Web/hostingEnvironments/{aseName}/configurations/networking`
1527

16-
Because App Service Environments are isolated to the individual customer, there are certain configuration settings that can be applied exclusively to App Service Environments. This article documents the various specific network customizations that are available for App Service Environment v3.
28+
The `networking` subresource configures three properties for the App Service Environment:
1729

18-
If you don't have an App Service Environment, see [How to Create an App Service Environment v3](./creation.md).
30+
- `allowNewPrivateEndpointConnections`
31+
- `ftpEnabled`
32+
- `remoteDebugEnabled`
1933

20-
App Service Environment network customizations are stored in a subresource of the *hostingEnvironments* Azure Resource Manager entity called networking.
34+
All of the properties are of type `bool` and are set to false (disabled) by default.
2135

22-
The following abbreviated Resource Manager template snippet shows the **networking** resource:
36+
## Use ARM template for repeatable deployment
37+
38+
When you configure networking settings for an App Service Environment by using an ARM template, you create a configuration that's available for repeatable deployment of the same environment or other App Service Environments.
39+
40+
The following snippet shows an abbreviated ARM template with configurations for the networking settings:
2341

2442
```json
2543
"resources": [
2644
{
27-
"apiVersion": "2021-03-01",
45+
"apiVersion": "2023-03-01",
2846
"type": "Microsoft.Web/hostingEnvironments",
2947
"name": "[parameter('aseName')]",
3048
"location": ...,
@@ -50,76 +68,156 @@ The following abbreviated Resource Manager template snippet shows the **networki
5068
}
5169
```
5270

53-
The **networking** resource can be included in a Resource Manager template to update the App Service Environment.
71+
## Configure properties with the Azure CLI
5472

55-
## Configure using Azure Resource Explorer
56-
Alternatively, you can update the App Service Environment by using [Azure Resource Explorer](https://resources.azure.com).
73+
If you plan to use the Azure CLI to configure the networking settings, keep in mind that the `az appservice ase update` command doesn't issue a PATCH against the individual properties. Instead, the command performs a PUT-style update against the entire `networking` subresource object. If you use the `az appservice ase update` command to configure a single property, the other networking properties revert to the default setting (false, disabled).
5774

58-
1. In Resource Explorer, go to the node for the App Service Environment (**subscriptions** > **{your Subscription}** > **resourceGroups** > **{your Resource Group}** > **providers** > **Microsoft.Web** > **hostingEnvironments** > **App Service Environment name** > **configurations** > **networking**).
59-
2. Select **Read/Write** in the upper toolbar to allow interactive editing in Resource Explorer.
60-
3. Select the blue **Edit** button to make the Resource Manager template editable.
61-
4. Modify one or more of the settings ftpEnabled, remoteDebugEnabled, allowNewPrivateEndpointConnections, that you want to change.
62-
5. Select the green **PUT** button that's located at the top of the right pane to commit the change to the App Service Environment.
63-
6. You may need to select the green **GET** button again to see the changed values.
64-
65-
The change takes effect within a minute.
75+
To ensure all `networking` properties are configured as expected, specify settings for all the networking properties in a single command.
6676

6777
## Allow new private endpoint connections
6878

69-
For apps hosted on both ILB and External App Service Environment, you can allow creation of private endpoints. The setting is default disabled. If private endpoint has been created while the setting was enabled, they won't be deleted and will continue to work. The setting only prevents new private endpoints from being created.
79+
If your app is hosted on both an Internal Load Balancer (ILB) App Service Environment and an External App Service Environment, you can allow creation of private endpoints with the `allow-new-private-endpoint-connection` setting. The ability to create new private endpoint connections is disabled by default.
7080

71-
The following Azure CLI command will enable allowNewPrivateEndpointConnections:
81+
If a private endpoint is created while the `allow-new-private-endpoint-connection` setting is enabled, and you then disable the setting, the existing private endpoint continues to work. When you disable the `allow-new-private-endpoint-connection` setting, you only prevent the creation of new private endpoints.
7282

73-
```azurecli
74-
ASE_NAME="[myAseName]"
75-
RESOURCE_GROUP_NAME="[myResourceGroup]"
76-
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-new-private-endpoint-connection true
83+
# [Azure portal](#tab/azure-portal)
7784

78-
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query allowNewPrivateEndpointConnections
79-
```
85+
You can enable new private endpoint connections for the App Service Environment in the Azure portal.
8086

81-
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
87+
1. In the [Azure portal](https://portal.azure.com), go to your **App Service Environment** resource.
8288

83-
:::image type="content" source="./media/configure-network-settings/configure-allow-private-endpoint.png" alt-text="Screenshot from Azure portal of how to configure your App Service Environment to allow creating new private endpoints for apps.":::
89+
1. In the left menu, select **Settings** > **Configuration**.
8490

85-
## FTP access
91+
1. Locate the **Networking settings** group, and select the **Allow new private endpoints** checkbox.
8692

87-
This ftpEnabled setting allows you to allow or deny FTP connections are the App Service Environment level. Individual apps will still need to configure FTP access. If you enable FTP at the App Service Environment level, you may want to [enforce FTPS](../deploy-ftp.md?tabs=cli#enforce-ftps) at the individual app level. The setting is default disabled.
93+
:::image type="content" source="./media/configure-network-settings/configure-allow-private-endpoint.png" alt-text="Screenshot that shows how to allow new private endpoint connections for an App Service Environment in the Azure portal.":::
8894

89-
If you want to enable FTP access, you can run the following Azure CLI command:
95+
1. Select **Apply** for your changes to take effect.
9096

91-
```azurecli
92-
ASE_NAME="[myAseName]"
93-
RESOURCE_GROUP_NAME="[myResourceGroup]"
94-
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-incoming-ftp-connections true
97+
# [Azure CLI](#tab/azure-cli)
9598

96-
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query ftpEnabled
97-
```
98-
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
99+
Run the following Azure CLI commands to enable new private endpoint connections for an App Service Environment:
99100

100-
:::image type="content" source="./media/configure-network-settings/configure-allow-incoming-ftp-connections.png" alt-text="Screenshot from Azure portal of how to configure your App Service Environment to allow incoming ftp connections.":::
101+
1. Set the `<placeholder>` command parameters to the values for your App Service Environment:
101102

102-
In addition to enabling access, you need to ensure that you have [configured DNS if you are using ILB App Service Environment](./networking.md#dns-configuration-for-ftp-access) and that the [necessary ports](./networking.md#ports-and-network-restrictions) are unblocked.
103+
```azurecli
104+
ASE_NAME="<App-Service-Environment>"
105+
RESOURCE_GROUP_NAME="<Resource-Group>"
106+
```
103107

104-
## Remote debugging access
108+
1. Enable FTP access for the App Service Environment by using the `--allow-incoming-ftp-connections` parameter:
105109

106-
Remote debugging is default disabled at the App Service Environment level. You can enable network level access for all apps using this configuration. You'll still have to [configure remote debugging](../configure-common.md?tabs=cli#configure-general-settings) at the individual app level.
110+
```azurecli
111+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-new-private-endpoint-connection true
112+
```
107113

108-
Run the following Azure CLI command to enable remote debugging access:
114+
1. List IP addresses for the App Service Environment that allow creation of new private endpoint connections:
109115

110-
```azurecli
111-
ASE_NAME="[myAseName]"
112-
RESOURCE_GROUP_NAME="[myResourceGroup]"
113-
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-remote-debugging true
116+
```azurecli
117+
az appservice ase list-addresses --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query allowNewPrivateEndpointConnections
118+
```
114119

115-
az appservice ase list-addresses -n --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query remoteDebugEnabled
116-
```
120+
---
121+
122+
## Allow incoming FTP connections
123+
124+
Use the `ftpEnabled` setting to allow or deny FTP connections for an App Service Environment. FTP access is disabled by default.
125+
126+
You still need to configure FTP access for each individual app. If you enable FTP at the App Service Environment level, you might want to [enforce FTPS](../deploy-ftp.md?tabs=cli#enforce-ftps) at the individual app level.
127+
128+
# [Azure portal](#tab/azure-portal)
129+
130+
You can configure FTP access for the App Service Environment in the Azure portal.
131+
132+
1. In the [Azure portal](https://portal.azure.com), go to your **App Service Environment** resource.
133+
134+
1. In the left menu, select **Settings** > **Configuration**.
135+
136+
1. Locate the **Networking settings** group, and select the **Allow incoming FTP connections** checkbox.
137+
138+
:::image type="content" source="./media/configure-network-settings/configure-allow-incoming-ftp-connections.png" alt-text="Screenshot that shows how to enable FTP access for an App Service Environment in the Azure portal.":::
139+
140+
1. Select **Apply** for your changes to take effect.
141+
142+
# [Azure CLI](#tab/azure-cli)
143+
144+
Run the following Azure CLI commands to enable FTP access for an App Service Environment:
145+
146+
1. Set the `<placeholder>` command parameters to the values for your App Service Environment:
147+
148+
```azurecli
149+
ASE_NAME="<App-Service-Environment>"
150+
RESOURCE_GROUP_NAME="<Resource-Group>"
151+
```
117152

118-
The setting is also available for configuration through Azure portal at the App Service Environment configuration:
153+
1. Enable FTP access for the App Service Environment by using the `--allow-incoming-ftp-connections` parameter:
119154

120-
:::image type="content" source="./media/configure-network-settings/configure-allow-remote-debugging.png" alt-text="Screenshot from Azure portal of how to configure your App Service Environment to allow remote debugging.":::
155+
```azurecli
156+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-incoming-ftp-connections true
157+
```
158+
159+
1. List IP addresses for the App Service Environment that allow incoming FTP connections:
160+
161+
```azurecli
162+
az appservice ase list-addresses --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query ftpEnabled
163+
```
164+
165+
---
166+
167+
### Configure DNS and unblock ports
168+
169+
When you enable FTP access for an App Service Environment, prepare your configuration to receive FTP connections:
170+
171+
- If you're using an ILB App Service Environment, verify your [DNS configuration for FTP access](./networking.md#dns-configuration-for-ftp-access).
172+
173+
- Unblock the [necessary ports](./networking.md#ports-and-network-restrictions) and address any restrictions.
174+
175+
## Enable remote debugging
176+
177+
Use the `remoteDebugEnabled` setting to allow or deny incoming FTP connections for an App Service Environment. Remote debugging is disabled by default.
178+
179+
You can enable network-level access for all apps associated with the App Service Environment. However, you still need to [configure remote debugging](../configure-common.md?tabs=cli#configure-general-settings) for each individual app.
180+
181+
# [Azure portal](#tab/azure-portal)
182+
183+
You can configure remote debugging for the App Service Environment in the Azure portal.
184+
185+
1. In the [Azure portal](https://portal.azure.com), go to your **App Service Environment** resource.
186+
187+
1. In the left menu, select **Settings** > **Configuration**.
188+
189+
1. Locate the **Networking settings** group, and select the **Allow remote debugging** checkbox.
190+
191+
:::image type="content" source="./media/configure-network-settings/configure-allow-remote-debugging.png" alt-text="Screenshot that shows how to enable remote debugging for an App Service Environment in the Azure portal.":::
192+
193+
1. Select **Apply** for your changes to take effect.
194+
195+
# [Azure CLI](#tab/azure-cli)
196+
197+
Run the following Azure CLI commands to enable remote debugging access for an App Service Environment:
198+
199+
1. Set the `<placeholder>` command parameters to the values for your App Service Environment:
200+
201+
```azurecli
202+
ASE_NAME="<App-Service-Environment>"
203+
RESOURCE_GROUP_NAME="<Resource-Group>"
204+
```
205+
206+
1. Enable remote debugging for the App Service Environment by using the `--allow-remote-debugging` parameter:
207+
208+
```azurecli
209+
az appservice ase update --name $ASE_NAME -g $RESOURCE_GROUP_NAME --allow-remote-debugging true
210+
```
211+
212+
1. List IP addresses for the App Service Environment that allow remote debugging:
213+
214+
```azurecli
215+
az appservice ase list-addresses --name $ASE_NAME -g $RESOURCE_GROUP_NAME --query remoteDebugEnabled
216+
```
217+
218+
---
121219

122-
## Next steps
220+
## Related content
123221

124-
> [!div class="nextstepaction"]
125-
> [Deploy your app to Azure App Service using FTP](../deploy-ftp.md)
222+
- [Deploy your app to Azure App Service by using FTP or FTPS](../deploy-ftp.md)
223+
- ['az appservice ase update' command reference](/cli/azure/appservice/ase)

0 commit comments

Comments
 (0)