Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Kudu is the engine behind some features in Azure App Service that are related to source-control-based deployment and other deployment methods, like Dropbox and OneDrive sync.
Access Kudu for your app
Anytime you create an app, App Service creates a companion app for it that's secured by HTTPS. This Kudu app is accessible at these URLs:
- App not in the Isolated tier:
https://<app-name>.scm.azurewebsites.net - Internet-facing app in the Isolated tier (App Service Environment):
https://<app-name>.scm.<ase-name>.p.azurewebsites.net - Internal app in the Isolated tier (App Service Environment for internal load balancing):
https://<app-name>.scm.<ase-name>.appserviceenvironment.net
For more information, see Accessing the Kudu service.
Kudu features
Kudu gives you helpful information about your App Service app, such as:
- App settings
- Connection strings
- Environment variables
- Server variables
- HTTP headers
It also provides features like these:
- Run commands in the Kudu console.
- Download IIS diagnostic dumps or Docker logs.
- Manage IIS processes and site extensions.
- Add deployment webhooks for Windows apps.
- Allow ZIP deployment UI with
/ZipDeploy. - Generate custom deployment scripts.
- Allow access with a REST API.
For Linux apps, Kudu also provides an authenticated proxy for container access without requiring an SSH server or an embedded SSH password in a custom image. The preview az webapp exec command opens a shell in the main app container, or in the Kudu container with --target kudu. These are separate environments. Detached execution targets only the main app container. For examples and limitations, see Open a container shell (SSH) and run commands.
RBAC permissions required to access Kudu
To access Kudu in the browser by using Microsoft Entra authentication, you need to be assigned an appropriate built-in or custom role over the scope of the application. The assigned role must include permission for the Microsoft.Web/sites/publish/Action resource provider operation. The following table shows example built-in roles that include this permission.
| Role type | Example built-in roles |
|---|---|
| Job function roles | Website Contributor Logic Apps Standard Developer |
| Privileged administrator roles1 | Owner Contributor |
1 Privileged administrator roles grant much more permission than is needed to access Kudu. If need to create a new role assignment, consider if a job function role with less access can be used instead.
See the role-based access control overview to learn more about creating role assignments.
More resources
Kudu is an open-source project. It has documentation on the Kudu wiki.