Showing posts from Azure category
How to Configure keyVaultReferenceIdentity in Azure App Service?
Overview This guide shows you how to fix a critical Azure App Service configuration issue where the `keyVaultReferenceIdentity` property is hidden from the Azure Portal but required for accessing Key Vault secrets. Symptoms Developers encountering this issue typically observe: - Key Vault references returning empty values instead of secret content - Configuration entries showing "Not Resolved" error messages - Application settings failing to fetch secret values from Key Vault - Authentication errors when attempting to access protected secrets - 401/403 errors from App Service attempting to validate Key Vault access Why This Happens Azure App Service uses Managed Identity authentication to access Key Vault secrets, but the `keyVaultReferenceIdentity` property is deliberately hidden from standard Azure Portal interfaces. This property only exists at the Azure Resource Manager (ARM) level, making it invisible through the typical Azure management UI. Technical Architecture ``` App Service → Managed Identity → Azure AD → Key Vault Access Policy → Secret Store ``` 1. App Service attempts to authenticate using its assigned Managed Identity 2. Azure needs explicit permission through the `keyVaultReferenceIdentity` property 3. This permission exists only in the underlying ARM configuration 4. Without this configuration, the authentication chain breaks 5. Key Vault references resolve to empty values or error messages Why Portal Visibility is Limited Microsoft implements this design choice for several reasons: - **Security**: Keeps identity-to-Key Vault mappings out of standard management interfaces - **Simplicity**: Prevents accidental misconfigurations that could cause security issues - **Audit Trail**: Ensures all identity configurations go through proper change management - **Resource Provider**: Some properties require ARM-level configuration for consistency Prerequisites Required Azure Resources - **Azure Subscription**: Active subscription with appropriate permissions - **Azure App Service**: Existing Linux or Windows App Service - **User-Assigned Managed Identity**: Pre-created Managed Identity for the App Service - **Azure Key Vault**: Key Vault with access policies configured for the Managed Identity Required Tools and Permissions - **Azure CLI**: Version 2.0+ installed locally - **PowerShell**: Azure Az module installed - **RBAC Permissions**: - `Contributor` or `Owner` role on App Service resource - `Reader` role minimum for resource listing - Key Vault access policies granting `Get Secret` permissions Environment Setup ```bash Install required Azure CLI extensions az extension add --name keyvault Verify Azure CLI installation az --version Login to Azure (if not already authenticated) az login ``` Step-by-Step Solution Guide Step 1: Prepare Your PowerShell Environment Initialize your PowerShell session and clear any cached authentication tokens: ```powershell Connect to Azure (if not already connected) Connect-AzAccount Clear any cached authentication tokens Clear-AzTokenCache Verify current authentication status Get-AzContext ``` Step 2: Target the Correct Azure Subscription Set the correct subscription context for your infrastructure: ```powershell List all accessible subscriptions Get-AzSubscription | Select-Object Name, Id, State Set your target subscription Set-AzContext -SubscriptionId "YOUR-SUBSCRIPTION-ID" ``` Step 3: Execute the ARM Fix Script Apply the required KeyVault Reference Identity configuration: ```powershell ========================================================================= FIX: App Service KeyVault Reference Identity Configuration Script ========================================================================= 1. Configure your deployment variables $subscriptionId = "YOUR-SUBSCRIPTION-ID" $resourceGroup = "your-resource-group-name" $identityName = "your-managed-identity-name" $appName = "your-app-service-name" 2. Construct the User-Assigned Identity Resource URL $identityUrl = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$identityName" 3. Retrieve the App Service's resource ID $appUrl = Get-AzWebApp -ResourceGroupName $resourceGroup -Name $appName | Select-Object -ExpandProperty Id 4. Prepare the ARM PATCH request payload $uriPath = "{0}?api-version=2021-01-01" -f $appUrl $payload = @{ properties = @{ keyVaultReferenceIdentity = $identityUrl } } | ConvertTo-Json -Depth 3 5. Execute the API update request $response = Invoke-AzRestMethod -Method PATCH -Path $uriPath -Payload $payload 6. Verify successful execution $response.Content | ConvertFrom-Json ``` Step 4: Complete Verification Process After script execution, complete these validation steps: Restart App Service - **Azure Portal**: Navigate to App Service → Overview → Restart button - **PowerShell**: `Restart-AzWebApp -ResourceGroupName $resourceGroup -Name $appName` - **Purpose**: Force reload of new identity configuration Validate Application Settings 1. Access your App Service in Azure Portal 2. Navigate to Settings → Configuration → Application Settings 3. Locate Key Vault reference entries 4. Confirm green checkmarks (✅) indicate successful resolution 5. Verify secrets display values like `@Microsoft.KeyVault(VaultName={your-key-vault-name},SecretName={your-secret-name})` Test Secret Access 1. Check application logs for resolution status 2. Verify actual secret values are accessible 3. Confirm application functionality with Key Vault integration Success Checklist - [ ] User-Assigned Managed Identity assigned to App Service - [ ] PowerShell script executed without errors - [ ] App Service restarted successfully - [ ] Green checkmarks visible in Application Settings - [ ] Secret values properly resolved - [ ] Application functions normally  Common Issues and Troubleshooting Issue: "Not Resolved" Errors Persist **Root Cause**: User-Assigned Managed Identity not attached to App Service **Solution**: Verify identity assignment in Azure Portal: 1. Open your App Service in Azure Portal 2. Navigate to Identity → User assigned → Assigned identities 3. Confirm your Managed Identity is listed and enabled Issue: Permission Denied **Root Cause**: Insufficient RBAC permissions **Solution**: Grant required permissions: - Navigate to your App Service → Access control (IAM) - Add Contributor role for comprehensive permissions - Alternative: Grant specific `Microsoft.Web/sites/write` permission Issue: Cross-Subscription Access **Root Cause**: Key Vault, Managed Identity, and App Service in different subscriptions **Solution**: Ensure all resources in same subscription: - Deploy all resources to identical subscription - Verify Key Vault access policies allow Managed Identity from current subscription - Use cross-tenant access if working across subscriptions Security Considerations Required RBAC Permissions The script requires these specific Azure permissions: | Permission | Required For | Description | |------------|--------------|-------------| | `Microsoft.Web/sites/read` | Get-AzWebApp | Read App Service properties | | `Microsoft.Web/sites/write` | PATCH operation | Update App Service configuration | | `Microsoft.ManagedIdentity/userAssignedIdentities/read` | Identity reference | Read Managed Identity details | Security Best Practices 1. **Principle of Least Privilege**: Use Contributor role instead of Owner when possible 2. **Identity Lifecycle Management**: Regularly review and rotate Managed Identity access 3. **Audit Compliance**: Enable diagnostic settings for tracking configuration changes 4. **Access Policy Configuration**: Configure Key Vault access policies with specific permissions 5. **Secret Rotation**: Implement automated Key Vault secret rotation policies Alternative Implementation Methods Azure CLI Solution ```bash az webapp update --resource-group your-resource-group \ --name your-app-name \ --set properties.keyVaultReferenceIdentity="/subscriptions/YOUR-SUBSCRIPTION-ID/resourceGroups/your-resource-group/providers/Microsoft.ManagedIdentity/userAssignedIdentities/your-identity-name" Verify the update az webapp show --resource-group your-resource-group --name your-app-name --query properties.keyVaultReferenceIdentity ``` Infrastructure as Code (Bicep) ```bicep @description('App Service name') param appServiceName string @description('Resource group name') param resourceGroupName string @description('Location for all resources') param location string @description('User-Assigned Managed Identity ID') param keyVaultReferenceIdentityId string resource appService 'Microsoft.Web/sites@2021-01-01' = { name: appServiceName location: location resourceGroupName: resourceGroupName kind: 'linux' properties: { serverFarmId: appServicePlanId keyVaultReferenceIdentity: keyVaultReferenceIdentityId } } ``` Infrastructure as Code (Terraform) ```hcl resource "azurerm_app_service" "example" { name = "your-app-name" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name app_service_plan_id = azurerm_app_service_plan.example.id kind = "linux" site_config { min_tls_version = "1.2" } identity { type = "UserAssigned" identity_ids = [azurerm_user_assigned_identity.example.id] } lifecycle { ignore_changes = all } } resource "azurerm_key_vault" "example" { name = "your-keyvault-name" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name tenant_id = data.azurerm_client_config.current.tenant_id sku_name = "standard" enabled_for_template_deployment = true access_policy { tenant_id = azurerm_app_service.example.identity.0.tenant_id object_id = azurerm_app_service.example.identity.0.principal_id secret_permissions = ["get", "list"] } } ``` Technical Limitations and Considerations Current Limitations 1. **Portal Invisibility**: The `keyVaultReferenceIdentity` property cannot be managed through Azure Portal 2. **API Version Dependency**: Uses ARM API version 2021-01-01 3. **Resource Provider Constraints**: Requires `Microsoft.Web/sites` resource provider availability 4. **Manual Configuration**: Requires PowerShell or CLI interaction for setup Performance Impact - **App Service Restart**: Required for configuration changes to take effect - **Authentication Overhead**: Additional identity validation adds minimal latency - **Resource Consumption**: No significant performance impact on secret retrieval Common Implementation Mistakes Mistake 1: Premature Script Execution **Problem**: Running configuration script before identity assignment **Solution**: Always assign Managed Identity first, then execute PowerShell script Mistake 2: Incorrect Subscription Context **Problem**: Script running in wrong Azure subscription **Solution**: Verify subscription context with `Get-AzContext` before running Mistake 3: Incomplete Identity URLs **Problem**: Missing subscription ID or resource group in identity URL **Solution**: Ensure complete resource URL construction in script SEO Optimization Keywords - Azure App Service KeyVault Reference Identity - Azure Key Vault access with App Service - Azure Managed Identity for App Service - Azure Key Vault references configuration - Azure App Service secret management - Azure KeyVault integration with App Service - Azure Resource Manager ARM configuration - Azure App Service Key Vault fix - Azure Web Apps KeyVault identity - Azure App Service Managed Identity configuration Related Documentation - [Use Key Vault references as app settings in Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli) - [Site.KeyVaultReferenceIdentity Property](https://learn.microsoft.com/en-us/dotnet/api/microsoft.azure.powershell.cmdlets.functions.models.site.keyvaultreferenceidentity?view=az-ps-latest) - [User-Assigned Managed Identity Overview](https://learn.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview) - [Bicep KeyVaultReferenceIdentity in Function App](https://stackoverflow.com/questions/77941574/bicep-keyvaultreferenceidentity-in-function-app) - [Azure App Service Key Vault Reference: User Assigned Managed Identity](https://learn.microsoft.com/en-us/answers/questions/2281797/azure-app-service-key-vault-reference-user-assigne) Quick Reference Commands PowerShell Commands ```powershell Check current subscription context Get-AzContext List all available subscriptions Get-AzSubscription | Select-Object Name, Id, State Set subscription context Set-AzContext -SubscriptionId "your-subscription-id" Retrieve App Service information Get-AzWebApp -ResourceGroupName "your-rg" -Name "your-app-name" Restart App Service to apply changes Restart-AzWebApp -ResourceGroupName "your-rg" -Name "your-app-name" Get diagnostic logs Get-AzWebAppLog -ResourceGroupName "your-rg" -Name "your-app-name" ``` Verification Commands ```powershell Verify KeyVaultReferenceIdentity configuration Get-AzWebApp -ResourceGroupName "your-rg" -Name "your-app-name" | Select-Object -ExpandProperty KeyVaultReferenceIdentity Check App Service identity status Get-AzWebApp -ResourceGroupName "your-rg" -Name "your-app-name" | Select-Object -ExpandProperty Identity ``` Success Metrics Track these indicators to confirm successful implementation: - **Configuration Status**: Green checkmarks in Application Settings - **Secret Resolution**: Keys display `@Microsoft.KeyVault(...)` format - **Authentication Success**: Application logs show successful secret retrieval - **Performance**: No increased latency in secret access operations - **Security**: Proper RBAC permissions and access policies in place Conclusion This comprehensive guide resolves Azure App Service KeyVault Reference Identity configuration issues by addressing the hidden `keyVaultReferenceIdentity` property problem. The solution enables proper authentication between Azure App Service and Azure Key Vault through Managed Identity integration. By following this step-by-step approach, developers can successfully: - Configure KeyVault Reference Identity using PowerShell - Verify secret resolution in application settings - Implement proper security and RBAC permissions - Use alternative methods like Azure CLI or infrastructure as code The hidden property may be invisible in the Azure Portal, but with this technical approach, developers can overcome this architectural limitation and maintain secure, compliant secret management for their Azure applications. For ongoing maintenance, remember to review identity assignments quarterly, monitor configuration changes, and implement automated secret rotation policies to ensure continued security and compliance. --- *This article covers advanced Azure administration concepts. Ensure you have proper permissions and understand the implications before making changes to production environments.*
How to configure the TLS and resolve errors related to this on Azure web App!
Today, we are going to discuss and see how to configure the TLS and resolve errors related to this. There are different versions of TLS. | Protocol | Published | |---|---| | TLS 1.0 | 1999 | | TLS 1.1 | 2006 | | TLS 1.2 | 2008 | | TLS 1.3 | 2018 | First, you should know what TLS is, for this, you can refer the below two URLs. 1. [https://en.wikipedia.org/wiki/Transport_Layer_Security](https://en.wikipedia.org/wiki/Transport_Layer_Security) 2. [https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/](https://www.cloudflare.com/learning/ssl/transport-layer-security-tls/) We must configure the right TLS on azure web app and on our security service (in my case I am using Cloudflare), if it is not configured properly then we will get the below error. For testing of app's security, make sure you are using Internet Explorer or Microsoft Edge. ```css .my-link { This might be because the site uses outdated or unsafe TLS security settings. If this keeps happening, try contacting the website's owner.; } ``` In order to resolve this issue, you must follow the below steps. **Step 1:** Check your system's internet options on your local system. **Step 2:** If still facing the same issue then check TLS settings on the Azure web app. **Step 3:** Check TLS settings on your middle-security service (In my case I am using Cloudflare). It should match with Azure TLS or the lower version. Refresh your browser and your app is running properly.
Restart Azure Web App Using Azure Logic App
Introduction In this article, we are going to see how to restart the Azure web app using Azure Logic App. I am considering that you know about the azure logic app. If you want to read more about, what is Azure logic app? How does it work? Then refer the below article. [https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-overview](https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-overview) Prerequisite For Creating Logic App which will restart the Azure web app, you must need the following items and access. 1. Azure portal access where Azure web App is deployed. 2. Tenant Id of your azure account 3. Client_id 4. Client_secret 5. Azure Subscription Id 6. Resource Group 7. App name Steps Restart the Azure web app using the Azure logic app will have three simple steps as shown below. We will discuss all these steps in detail in the following section. Start Designing of the Azure Logic App **Step 1: Get Access Token (HTTP)** First, we need to add the HTTP action in-order to generate and get the access token. This action is having a post method and required tenant_id, client_id, and client_secret. ```json "method": "POST" "uri": "https://login.microsoftonline.com/{tenant_id}/oauth2/token" "body": "grant_type=client_credentials&client_id={client_id}&client_secret={client_secret}&resource=https://management.core.windows.net/" "Content-Type": "application/x-www-form-urlencoded" } ``` After execution, we will get a JSON result which will have a access_token value that is required to restart the app. JSON result looks like as below. **Step 2:** Parse the JSON get the body and define the schema using The sample payload to generate the schema. **Step 3: Restart App (HTTP)** For this HTTP request, we need a subscription ID, resource group, and app name of the azure web app. We need to pass the access_token from the previous step in the Authorization field. ```json "method": "POST" "uri": "https://management.azure.com/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Web/sites/{webApp_name}/restart?api-version=2016-08-01" "Authorization": "Bearer @{body('Parse_JSON')?['access_token']}", "Content-Type": "application/json" } ``` Run Logic App Your logic app is ready and now run this and see results in history. The Activity Log of the Web App Check the web App activity log. You might need to wait for 1-2 mins in order to update this. Expected Result The Logic app has been configured properly and worked as expected. It is restarting the Azure web app, we can configure this on-demand and set it scheduled. For on-demand, we can use an email receiving event and restart it on receiving an email with a specific subject line. This is as given below. Automate the Logic App on Email Receiving To make this process automated, we can configure the above logic app on receiving an email with some defined text in the subject. Now whenever you receive an email with a defined subject the logic app will run automatically. Summary In the above article, we see how to restart the Azure web app using the logic app. We also see the use of email receiving an event to restart the app. Apart from the restart, we can perform many more operations like stop, start, etc. For more trigger APIs to refer the below URL and configure those in the above logic app accordingly. [https://docs.microsoft.com/en-us/rest/api/appservice/webapps/stop](https://docs.microsoft.com/en-us/rest/api/appservice/webapps/stop)
Setup Azure CI/CD Pipelines using Visual Studio
Introduction Today, we are going to see how to configure Azure DevOps CI/CD and setup Azure Pipeline using visual studio. Not spending the time on what is Azure DevOps and its feature, we are directly moving to CI/CD. How can we configure this using visual studio? We will see this step by step. Once we set up the Azure Pipeline then on each check-in it will build the application and deploy the changes on App Service. In this article, we will see how to configure the CI/CD for a single project in one solution. In the next article, we will see how to configure the CI/CD for multiple projects in one solution. To know about Azure DevOps and its other features, you can refer to the below blog. [Introducing Azure DevOps](https://azure.microsoft.com/en-in/blog/introducing-azure-devops) Prerequisite For configuring the Azure DevOps CI/CD, you need the following tools. 1. Azure DevOps Account 2. Azure Portal Account 3. Visual Studio 2012+ (in my example I am using VS 2019) Steps We will see how to configure CI/CD and setup Azure Pipeline using Azure DevOps. **Step 1:** Create a new project by using the Azure DevOps account. I am using Team Foundation version control, but you can use Git too. **Step 2:** Configure the newly created project in Visual Studio source control on your local system. **Step 3:** Create a new project with a solution in Visual Studio and add this in DevOps Source Control then check in the changes. **Step 4:** Set up Azure Pipelines under the publish settings of your solution. **Step 5:** Wait for a few minutes and then go to the pipelines under Azure DevOps. You will see a new Pipeline created and the build of the project has started. **Step 6:** Check the Deployment Center on the Azure portal for your App Service, for which you have set up the Azure Pipeline in step 4. **Step 7:** If there is no error in the build, then after some time your build has succeeded. It takes a few minutes. In my example, it takes up to 1min 21 sec. **Step 8:** As the build succeeds the new release will be created and started pushing the release changes on the App service. **Step 9:** Check the App by using the URL and you will see the application has deployed. **Step 10:** Change anything in the application, check the changes, and see if Azure DevOps will build the solution and release the changes. After the build was completed the Release was created. Summary This article provides a step-by-step guide to configuring Continuous Integration and Continuous Deployment (CI/CD) pipelines using Azure DevOps and Visual Studio. It outlines the process of creating a new project, setting up source control, and configuring Azure Pipelines to automate builds and deployments to an Azure App Service. By following this guide, developers can streamline their workflow, ensuring every code check-in triggers a build and deployment. The tutorial focuses on a single-project setup, with plans for a multi-project guide in a future article.