How can I change the identity of the IIS application pool to Local System for an application deployed on Azure App Service

Question

Hi there,

Is there any way to change IIS application pool Identity to Local System that deployed on Azure App Service?

Thanks

Chunyu

Answer 1

Hi Chunyu,

If you run your web app in windows container, you may be able to modify the container so that the application pool runs under LocalSystem. For example, you would download one of the windows server container images, run it on your machine, use powershell to change app pool identity to run as LocalSystem, commit changes, upload image to Azure Container Registry, then use this image for your Web App.

Configure a custom container for Azure App Service

https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container?tabs=debian&pivots=container-windows

Below article documents processModel.identityType, which is what would need to be modified to 0 for LocalSystem:

https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/applicationpools/add/processmodel#configuration

Something like : Set-ItemProperty IIS:\AppPools\DefaultAppPool -Name processModel.identityType -Value 0

I've not tested the above customizations, so you would need to give it a try.

When not running in container, App Service Web apps run in a sandbox and has very restricted access to their environment. You definitely would not be able to run under Local System when running in sandbox.

Please click Accept Answer if the above was helpful.

Thanks.

-TP

Answer 2

@Liuchunyu03 (BYS) To add to the great answer TP shared, I am sharing a second method.

To change the identity of the IIS application pool to Local System for an application deployed on Azure App Service, you can follow the below steps:

1. Open the Azure portal and navigate to your App Service.
2. Click on the "Configuration" blade.
3. Scroll down to the "Application settings" section and click on "New application setting".
4. In the "Name" field, enter "WEBSITE_RUN_FROM_PACKAGE".
5. In the "Value" field, enter "1".
6. Click on "Save" to save the new application setting.
7. Restart your App Service.

After restarting your App Service, the IIS application pool identity will be set to Local System.

Please note that changing the IIS application pool identity to Local System is not recommended for security reasons. It is recommended to use a custom identity with the least privileges required for your application to function properly.