0Pricing
Cloud & IT Cert Prep · Lesson

App Service Authentication and Networking

Enable built-in authentication providers (Entra ID, Google, GitHub) for your web app, and restrict inbound traffic using VNet Integration and access restrictions.

App Service Authentication and Networking is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Built-In Authentication in App Service

Azure App Service provides a built-in authentication and authorisation module (sometimes called EasyAuth) that handles sign-in flows, token validation, and session management without any code changes to your application. You can enable it directly in the Azure portal and choose from multiple identity providers. This is ideal for quickly adding authentication to an API or internal tool without implementing OAuth flows yourself.

Supported Identity Providers

App Service authentication supports several identity providers out of the box: Microsoft Entra ID (for enterprise/corporate logins), Google, Facebook, Twitter/X, GitHub, and any OpenID Connect compatible provider. You register your app with the chosen provider to obtain a client ID and secret, then configure these in App Service. Multiple providers can be enabled simultaneously, letting users choose how to sign in.

# Enable Microsoft Entra ID authentication via CLI
az webapp auth microsoft update \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --client-id '<Entra-App-Client-ID>' \
  --client-secret '<Client-Secret>' \
  --issuer 'https://sts.windows.net/<TenantId>/'

# Set action when unauthenticated (redirect or 401)
az webapp auth update \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --unauthenticated-client-action RedirectToLoginPage

Token Store and Accessing User Claims

When authentication is enabled, App Service stores validated tokens in the token store — a persistent store per user session. Your application code can access the authenticated user's claims through special HTTP request headers injected by the EasyAuth module: X-MS-CLIENT-PRINCIPAL-NAME (email/UPN), X-MS-CLIENT-PRINCIPAL-ID (object ID), and X-MS-TOKEN-AAD-ACCESS-TOKEN for the raw access token.

// Node.js: read user identity from EasyAuth headers
app.get('/profile', (req, res) => {
  const userName = req.headers['x-ms-client-principal-name'];
  const userId = req.headers['x-ms-client-principal-id'];
  res.json({ name: userName, id: userId });
});

// Or decode the full claims JSON from the header
const principalHeader = req.headers['x-ms-client-principal'];
const claims = JSON.parse(Buffer.from(principalHeader, 'base64').toString());

VNet Integration for Outbound Traffic

VNet Integration allows an App Service app to make outbound calls to resources inside an Azure Virtual Network — such as VMs, SQL databases, and internal APIs — without exposing those resources to the public internet. The app gets a virtual NIC in a delegated subnet of the VNet and can reach any resource the VNet can reach, including on-premises resources via VPN or ExpressRoute. VNet Integration is available from Standard tier upward.

# Enable VNet Integration
az webapp vnet-integration add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --vnet MyVNet \
  --subnet AppServiceSubnet

# Route ALL traffic through the VNet (including internet)
az webapp config appsettings set \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --settings WEBSITE_VNET_ROUTE_ALL=1

Private Endpoints for Inbound Traffic

While VNet Integration handles outbound traffic, a private endpoint handles inbound traffic — it makes your App Service accessible only from inside your VNet via a private IP address. External internet access to azurewebsites.net is blocked when a private endpoint is the only access method. This is used for internal APIs and admin portals that should never be exposed to the public internet.

# Create a private endpoint for the web app
az network private-endpoint create \
  --name MyWebAppPE \
  --resource-group MyRG \
  --vnet-name MyVNet \
  --subnet PrivateEndpointSubnet \
  --private-connection-resource-id \
    '/subscriptions/.../providers/Microsoft.Web/sites/MyUniqueWebApp' \
  --group-id sites \
  --connection-name MyWebAppConnection

Access Restrictions

Access restrictions in App Service let you define an IP allow or deny list for inbound traffic. Rules are evaluated in priority order (lower number = higher priority). You can restrict access to specific IP ranges (e.g., your office VPN egress IP), Azure service tags (e.g., AzureLoadBalancer), or specific VNet subnets. Use access restrictions to lock down your staging slot so only your team's IP range can reach it.

# Allow only a specific IP range
az webapp config access-restriction add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --priority 100 \
  --action Allow \
  --ip-address 203.0.113.0/24 \
  --rule-name 'OfficeRange'

# Allow Azure Front Door service tag
az webapp config access-restriction add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --priority 200 \
  --action Allow \
  --service-tag AzureFrontDoor.Backend \
  --rule-name 'FrontDoor'

Hybrid Connections

Hybrid Connections (from BizTalk) allow App Service to reach on-premises resources without requiring VNet Integration or a VPN gateway. A lightweight relay agent installed on-premises establishes an outbound connection to Azure Service Bus; your app connects through the relay. Hybrid Connections work at the TCP level and support any port — useful for connecting to legacy on-premises databases or APIs that cannot be moved to Azure.

# Add a Hybrid Connection to reach on-prem SQL
az webapp hybrid-connection add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --namespace myServiceBusNS \
  --hybrid-connection on-prem-sql-relay

# The Hybrid Connection Manager agent must be installed
# and configured on the on-premises server to complete the relay

Managed Identity for App Service

Assign a managed identity to your App Service app so it can authenticate to other Azure services (Key Vault, Blob Storage, SQL Database) without storing credentials anywhere. Azure automatically manages the identity's credentials. Use a system-assigned identity (tied to the app lifecycle) or a user-assigned identity (shared across multiple apps). Grant the identity RBAC roles on the target resources.

# Enable system-assigned managed identity
az webapp identity assign \
  --name MyUniqueWebApp \
  --resource-group MyRG

# Grant the identity access to Key Vault secrets
az keyvault set-policy \
  --name MyKeyVault \
  --object-id $(az webapp identity show \
      --name MyUniqueWebApp \
      --resource-group MyRG \
      --query principalId -o tsv) \
  --secret-permissions get list

Enabling CORS

Cross-Origin Resource Sharing (CORS) controls which domains can make browser-based API calls to your App Service app. Configure allowed origins in the CORS settings — do not return wildcard (*) in production for authenticated APIs. App Service's built-in CORS support adds the Access-Control-Allow-Origin response headers automatically, eliminating the need for CORS middleware in your application code for simple cases.

# Allow specific origin
az webapp cors add \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --allowed-origins https://www.contoso.com

# View current CORS settings
az webapp cors show \
  --name MyUniqueWebApp \
  --resource-group MyRG

# Remove a CORS origin
az webapp cors remove \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --allowed-origins https://old.contoso.com

App Service Environments (ASE)

An App Service Environment (ASE) is a fully isolated, dedicated deployment of App Service that runs inside your own VNet. It provides the highest level of network isolation, scalability (up to 200 instances), and compliance alignment. ASE v3 removes the need for a dedicated public IP and supports private endpoints natively. The trade-off is significantly higher cost — ASE is for enterprise workloads with strict isolation requirements.

Security Best Practices Summary

For a secure App Service deployment: enforce HTTPS-only, use access restrictions to limit inbound IPs, enable managed identity to avoid secrets in config, store secrets in Key Vault with Key Vault references, apply minimum TLS version 1.2, enable Defender for App Service for threat detection, and regularly review Azure Security Center recommendations for the app resource.

# Enforce HTTPS and minimum TLS version
az webapp update \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --https-only true

az webapp config set \
  --name MyUniqueWebApp \
  --resource-group MyRG \
  --min-tls-version '1.2' \
  --ftps-state Disabled

Quick Check

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

Lesson Recap

In this lesson you learned: built-in authentication (EasyAuth) adds identity provider login without code changes, VNet Integration routes outbound traffic through your virtual network while private endpoints lock down inbound traffic, and managed identity enables passwordless authentication to other Azure services. Next up we explore Azure Container Registry.

Frequently asked questions

Is the “App Service Authentication and Networking” lesson free?

Yes — the full text of “App Service Authentication and Networking” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.

What will I learn in “App Service Authentication and Networking”?

Enable built-in authentication providers (Entra ID, Google, GitHub) for your web app, and restrict inbound traffic using VNet Integration and access restrictions. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cloud & IT Cert Prep?

No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “App Service Authentication and Networking” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cloud & IT Cert Prep lesson?

Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Creating an App Service Plan and Web App
  2. Deployment Slots and Swap
  3. Autoscaling and Custom Domains
  4. App Service Authentication and Networking
← Back to Cloud & IT Cert Prep