Home / Azure

AzureChecklistBeginner

Running a single-region App Service app in production: the baseline

Plan sizing, deployment slots, health checks, private access, identity and monitoring for an App Service web app that runs in one region without surprises.

Deepak Bhardwaj2 min read

Applies toAzure App Service (Premium v3 / Premium v4 plans), Windows and Linux

Plan and scale

  • Premium v3/v4 plan for production (better performance per core, zone redundancy option, more slots).
  • At least 2 instances even in a "standalone" design. One instance means every platform upgrade or instance recycle is visible to users.
  • Autoscale rules on CPU or HTTP queue length, with a sensible maximum.
  • Always On enabled (otherwise the app unloads when idle and the first request is slow).
az appservice plan update -g rg-web -n asp-web-prod --sku P1v3 --number-of-workers 2
az webapp config set -g rg-web -n app-web-prod --always-on true --http20-enabled true --min-tls-version 1.2

Health check

az webapp config set -g rg-web -n app-web-prod --generic-configurations '{"healthCheckPath": "/healthz"}'

The platform removes unhealthy instances from the load balancer and replaces them after repeated failures. The /healthz endpoint should check the app's own dependencies quickly (under a few seconds) and not call slow downstream systems on every probe.

Deployment slots

  • Deploy to a staging slot, warm it up, then swap.
  • Mark environment-specific settings as slot settings (connection strings for staging vs production).
  • Use swap with preview for risky changes, so you can roll back by swapping again.
az webapp deployment slot swap -g rg-web -n app-web-prod --slot staging --target-slot production

Security

  • Managed identity + Key Vault references for secrets (@Microsoft.KeyVault(SecretUri=...)).
  • VNet integration for outbound calls to private resources; private endpoint or access restrictions for inbound.
  • HTTPS only, FTP disabled, SCM basic auth disabled.
  • Front Door or Application Gateway with WAF for internet-facing apps.

Monitoring

  • Application Insights connected (auto-instrumentation where supported).
  • Alerts: Http5xx, response time, health check status, CPU/memory of the plan.
  • Diagnostic logs (AppServiceHTTPLogs, AppServiceConsoleLogs) to Log Analytics.

Backup

  • App Service backups (or simply redeployable code + config in Git, which is the better DR source).
  • Database backups handled separately (App Service backup of a database is limited).

Moving up later

Single-region with 2+ instances protects against instance failures. For zone failures, enable zone redundancy (needs a minimum of 3 instances, set at plan creation on many plan types). For region failures, see the multi-region App Service with Front Door post.

Related fixes