Azure App Service

Azure App Service Skill

Manage and analyze Azure App Service web apps using az webapp commands.

Discovery-First Rule

ALWAYS discover before acting. Never assume web app names, resource groups, or plan names.

# Discover web apps
az webapp list --output json \
  --query "[].{name:name, rg:resourceGroup, state:state, defaultHostName:defaultHostName, kind:kind, httpsOnly:httpsOnly}"

Parallel Execution Requirement

ALL independent operations MUST run in parallel using background jobs (&) and wait.

for app in $(echo "$apps" | jq -c '.[]'); do
  {
    name=$(echo "$app" | jq -r '.name')
    rg=$(echo "$app" | jq -r '.rg')
    az webapp show --name "$name" --resource-group "$rg" --output json
  } &
done
wait

Helper Functions

# Get web app configuration
get_webapp_config() {
  local name="$1" rg="$2"
  az webapp config show --name "$name" --resource-group "$rg" --output json \
    --query "{alwaysOn:alwaysOn, linuxFxVersion:linuxFxVersion, javaVersion:javaVersion, pythonVersion:pythonVersion, nodeVersion:nodeVersion, phpVersion:phpVersion, ftpsState:ftpsState, http20Enabled:http20Enabled, minTlsVersion:minTlsVersion, webSocketsEnabled:webSocketsEnabled}"
}

# Get app service plan details
get_plan_details() {
  local plan_id="$1"
  az appservice plan show --ids "$plan_id" --output json \
    --query "{name:name, sku:sku.name, tier:sku.tier, workers:numberOfWorkers, maxWorkers:maximumElasticWorkerCount, isLinux:reserved, zoneRedundant:zoneRedundant}"
}

# List deployment slots
list_slots() {
  local name="$1" rg="$2"
  az webapp deployment slot list --name "$name" --resource-group "$rg" --output json \
    --query "[].{name:name, state:state, defaultHostName:defaultHostName}"
}

# Get health check status
get_health_metrics() {
  local resource_id="$1"
  az monitor metrics list --resource "$resource_id" \
    --metric "HealthCheckStatus" "Http5xx" "Http4xx" "AverageResponseTime" "Requests" \
    --interval PT5M --aggregation Average Total --output json
}

Common Operations

1. Web App Health Overview

apps=$(az webapp list --output json --query "[].{name:name, rg:resourceGroup}")
for app in $(echo "$apps" | jq -c '.[]'); do
  {
    name=$(echo "$app" | jq -r '.name')
    rg=$(echo "$app" | jq -r '.rg')
    az webapp show --name "$name" --resource-group "$rg" --output json \
      --query "{name:name, state:state, httpsOnly:httpsOnly, clientCertEnabled:clientCertEnabled, availabilityState:availabilityState, hostNames:hostNames, outboundIpAddresses:outboundIpAddresses}"
    get_webapp_config "$name" "$rg"
  } &
done
wait

2. Deployment Slot Management

# List slots with traffic percentages
az webapp traffic-routing show --name "$APP" --resource-group "$RG" --output json

# Show slot differences
az webapp deployment slot list --name "$APP" --resource-group "$RG" --output json
for slot in $(az webapp deployment slot list --name "$APP" --resource-group "$RG" --query "[].name" -o tsv); do
  {
    echo "Slot: $slot"
    az webapp config show --name "$APP" --resource-group "$RG" --slot "$slot" --output json
  } &
done
wait

3. Scaling Configuration

# Check current plan and scaling
plan_id=$(az webapp show --name "$APP" --resource-group "$RG" --query "appServicePlanId" -o tsv)
az appservice plan show --ids "$plan_id" --output json \
  --query "{name:name, sku:sku, workers:numberOfWorkers, maxWorkers:maximumElasticWorkerCount}"

# Check autoscale settings
az monitor autoscale list --resource-group "$RG" --output json \
  --query "[?targetResourceUri=='$plan_id'].{name:name, enabled:enabled, profiles:profiles[].{name:name, capacity:capacity, rules:rules[].{metric:metricTrigger.metricName, operator:metricTrigger.operator, threshold:metricTrigger.threshold, direction:scaleAction.direction, cooldown:scaleAction.cooldown}}}"

4. Application Configuration Audit

# Security-relevant settings
az webapp show --name "$APP" --resource-group "$RG" --output json \
  --query "{httpsOnly:httpsOnly, clientCertEnabled:clientCertEnabled, clientCertMode:clientCertMode}"
get_webapp_config "$APP" "$RG"

# Connection strings (names only, not values)
az webapp config connection-string list --name "$APP" --resource-group "$RG" --output json \
  --query "[].{name:name, type:type}"

# App settings (names only)
az webapp config appsettings list --name "$APP" --resource-group "$RG" --output json \
  --query "[].{name:name, slotSetting:slotSetting}"

5. Performance Metrics

resource_id=$(az webapp show --name "$APP" --resource-group "$RG" --query "id" -o tsv)
az monitor metrics list --resource "$resource_id" \
  --metric "CpuPercentage" "MemoryPercentage" "AverageResponseTime" "Http5xx" "Requests" "HealthCheckStatus" \
  --interval PT1H --aggregation Average Total Max --output json

Output Format

Present results as a structured report:

Azure App Service Report
════════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Anti-Hallucination Rules

1. NEVER assume resource names — always discover via CLI/API in Phase 1 before referencing in Phase 2.
2. NEVER fabricate metric names or dimensions — verify against the service documentation or --help output.
3. NEVER mix CLI commands between service versions — confirm which version/API you are targeting.
4. ALWAYS use the discovery → verify → analyze chain — every resource referenced must have been discovered first.
5. ALWAYS handle empty results gracefully — an empty response is valid data, not an error to retry.

Counter-Rationalizations

Common Pitfalls

1. Slot-sticky settings: App settings and connection strings marked as slotSetting=true do not swap. Verify before slot swap.
2. Always On: Free and Shared tiers do not support Always On. The app will idle after inactivity, causing cold starts.
3. Plan sharing: Multiple apps can share one App Service Plan. Scaling the plan affects all apps on it.
4. HTTPS enforcement: httpsOnly=true only redirects HTTP to HTTPS at the App Service level. Check Front Door or Application Gateway if using reverse proxy.
5. Health check path: If healthCheckPath is set, App Service removes unhealthy instances. Ensure the health endpoint is lightweight and reliable.