Azure Dotnet Webapp

Azure .NET Web App

This skill provides comprehensive patterns for building ASP.NET Core Web API and Blazor applications, hosted on Azure App Service. It covers the full development lifecycle: project scaffolding, authentication with Microsoft Identity Platform, EF Core with Azure SQL and Managed Identity, real-time features with SignalR, OpenAPI documentation, and production deployment with Bicep + CI/CD pipelines.

NuGet Package Versions (as of 2025)

1. Program.cs — Minimal Host

Service registration order and middleware pipeline order both matter in ASP.NET Core.

// Program.cs
var builder = WebApplication.CreateBuilder(args);

// ── Services ─────────────────────────────────────────────────
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddAuthorization();

// EF Core with DefaultAzureCredential (no password in config)
builder.Services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(builder.Configuration.GetConnectionString("AzureSQL")));

builder.Services.AddControllers();          // MVC controllers
// -or-
builder.Services.AddEndpointsApiExplorer(); // Minimal API

builder.Services.AddOpenApi();              // .NET 8+ built-in OpenAPI
builder.Services.AddSwaggerGen();           // Swagger UI (Swashbuckle)

builder.Services.AddSignalR();

builder.Services.AddHealthChecks()
    .AddDbContextCheck<AppDbContext>();

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("fixed", o =>
    {
        o.Window = TimeSpan.FromMinutes(1);
        o.PermitLimit = 100;
    });
});

// Register domain services
builder.Services.AddScoped<IFileInventoryService, FileInventoryService>();

var app = builder.Build();

// ── Middleware pipeline (ORDER MATTERS) ──────────────────────
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();
app.UseRouting();               // Must precede Auth
app.UseAuthentication();        // Must precede Authorization
app.UseAuthorization();
app.UseRateLimiter();

app.MapControllers();
app.MapHub<NotificationHub>("/hubs/notifications");
app.MapHealthChecks("/health");

await app.RunAsync();

2. Minimal API vs. Controllers

Minimal API endpoint group

// Features/FileInventory/FileInventoryEndpoints.cs
public static class FileInventoryEndpoints
{
    public static IEndpointRouteBuilder MapFileInventory(this IEndpointRouteBuilder app)
    {
        var group = app.MapGroup("/api/files")
            .WithTags("FileInventory")
            .RequireAuthorization()
            .RequireRateLimiting("fixed");

        group.MapGet("/", GetAll)
            .WithName("GetFiles")
            .Produces<IEnumerable<FileInventoryDto>>();

        group.MapGet("/{id}", GetById)
            .WithName("GetFileById")
            .Produces<FileInventoryDto>()
            .ProducesProblem(404);

        group.MapPost("/", Create)
            .WithName("CreateFile")
            .Accepts<CreateFileRequest>("application/json")
            .Produces<FileInventoryDto>(201)
            .ProducesValidationProblem();

        return app;
    }

    static async Task<IResult> GetAll(IFileInventoryService svc, CancellationToken ct) =>
        Results.Ok(await svc.GetAllAsync(ct));

    static async Task<IResult> GetById(string id, IFileInventoryService svc, CancellationToken ct)
    {
        var item = await svc.GetByIdAsync(id, ct);
        return item is null ? Results.NotFound() : Results.Ok(item);
    }

    static async Task<IResult> Create(
        CreateFileRequest req, IFileInventoryService svc, CancellationToken ct)
    {
        var created = await svc.CreateAsync(req, ct);
        return Results.CreatedAtRoute("GetFileById", new { id = created.Id }, created);
    }
}

// Program.cs — wire it up
app.MapFileInventory();

3. Microsoft.Identity.Web — Authentication

See deep-dive: references/auth-identity-web.md

Web API (JWT Bearer — machine-to-machine or SPA)

// Program.cs
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

// appsettings.json
{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "<tenant-id>",
    "ClientId": "<client-id>",
    "Audience": "api://<client-id>"
  }
}

Scope validation in controllers/endpoints

[ApiController]
[Route("api/[controller]")]
[Authorize]
public class FilesController(
    IFileInventoryService svc,
    IHttpContextAccessor httpContextAccessor) : ControllerBase
{
    private const string ReadScope = "Files.Read";

    [HttpGet]
    public async Task<ActionResult<IEnumerable<FileInventoryDto>>> GetAll(CancellationToken ct)
    {
        // Validate scope from the JWT token
        HttpContext.VerifyUserHasAnyAcceptedScope(ReadScope);
        return Ok(await svc.GetAllAsync(ct));
    }
}

4. Graph API Integration Pattern

Inject GraphServiceClient from Microsoft.Identity.Web.GraphServiceClient for OBO flow (web app calls Graph on behalf of the signed-in user):

// Program.cs — for Blazor or MVC with user OBO flow
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
    .EnableTokenAcquisitionToCallDownstreamApi(["Files.Read.All"])
    .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
    .AddInMemoryTokenCaches();

// appsettings.json
{
  "MicrosoftGraph": {
    "BaseUrl": "https://graph.microsoft.com/v1.0",
    "Scopes": "Files.Read.All"
  }
}

// In controller / service — GraphServiceClient is injected via DI
public class GraphFilesController(GraphServiceClient graphClient) : ControllerBase
{
    [HttpGet("drives")]
    public async Task<IActionResult> GetDrives([FromQuery] string siteId, CancellationToken ct)
    {
        var drives = await graphClient.Sites[siteId].Drives
            .GetAsync(config =>
                config.QueryParameters.Select = ["id", "name", "driveType"],
                cancellationToken: ct);
        return Ok(drives?.Value);
    }
}

5. EF Core with DefaultAzureCredential

See deep-dive: references/efcore-azure-sql.md

// No password — use Managed Identity / DefaultAzureCredential
// Connection string in appsettings.json:
// "Server=tcp:<server>.database.windows.net;Database=<db>;Authentication=Active Directory Default"

public class AppDbContext(DbContextOptions<AppDbContext> options) : DbContext(options)
{
    public DbSet<FileInventoryItem> FileInventory => Set<FileInventoryItem>();

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        modelBuilder.Entity<FileInventoryItem>(entity =>
        {
            entity.HasKey(e => e.Id);
            entity.Property(e => e.Name).HasMaxLength(255).IsRequired();
            entity.HasIndex(e => e.DriveId);
        });
    }
}

6. Blazor Architecture

See deep-dive: references/blazor-patterns.md

Render mode selection

// Program.cs — .NET 8 Blazor Web App (supports all render modes)
builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents()
    .AddInteractiveWebAssemblyComponents();

app.MapRazorComponents<App>()
    .AddInteractiveServerRenderMode()
    .AddInteractiveWebAssemblyRenderMode()
    .AddAdditionalAssemblies(typeof(Client._Imports).Assembly);

Component with auth guard

@page "/files"
@attribute [Authorize]
@rendermode InteractiveServer
@inject IFileInventoryService FileService

<PageTitle>File Inventory</PageTitle>

<AuthorizeView>
    <Authorized>
        @if (files is null)
        {
            <p>Loading...</p>
        }
        else
        {
            <QuickGrid Items="@files.AsQueryable()">
                <PropertyColumn Property="@(f => f.Name)" Sortable="true" />
                <PropertyColumn Property="@(f => f.SizeMb)" Title="Size (MB)" />
            </QuickGrid>
        }
    </Authorized>
    <NotAuthorized>
        <p>Please sign in to view files.</p>
    </NotAuthorized>
</AuthorizeView>

@code {
    private List<FileInventoryDto>? files;

    protected override async Task OnInitializedAsync()
    {
        files = await FileService.GetAllAsync();
    }
}

7. Progressive Disclosure — Reference Files