Tutorial: Connect a web app to Azure App Configuration with Service Connector
Learn how to connect an ASP.NET Core app running on Azure App Service, to Azure App Configuration, using one of the following methods:
- System-assigned managed identity (SMI)
- User-assigned managed identity (UMI)
- Service principal
- Connection string
In this tutorial, use the Azure CLI to complete the following tasks:
- Set up Azure resources
- Create a connection between a web app and App Configuration
- Build and deploy your app to Azure App Service
- An Azure account with an active subscription. Your access role within the subscription must be "Contributor" or "Owner". Create an account for free.
- The Azure CLI. You can use it in Azure Cloud Shell or install it locally.
Sign in to Azure
Sign in to the Azure portal at https://portal.azure.com/ with your Azure account.
Set up Azure resources
Start by creating your Azure resources.
Clone the following sample repo:
git clone https://github.com/Azure-Samples/serviceconnector-webapp-appconfig-dotnet.git
Deploy the web app to Azure
az loginto sign in to and follow these steps to create an App Service and deploy the sample app. Make sure you have the Subscription Contributor role.
Create an app service and deploy the sample app that uses system-assigned managed identity to interact with App Config.
# Change directory to the SMI sample cd serviceconnector-webapp-appconfig-dotnet\system-managed-identity # Create a web app LOCATION='eastus' RESOURCE_GROUP_NAME='service-connector-tutorial-rg' APP_SERVICE_NAME='webapp-appconfig-smi' az webapp up --location $LOCATION --resource-group $RESOURCE_GROUP_NAME --name $APP_SERVICE_NAME
Parameter Description Example Location Choose a location near you. Use
az account list-locations --output tableto list locations.
eastus Resource group name You'll use this resource group to organize all the Azure resources needed to complete this tutorial. service-connector-tutorial-rg App service name The app service name is used as the name of the resource in Azure and to form the fully qualified domain name for your app, in the form of the server endpoint
https://<app-service-name>.azurewebsites.com. This name must be unique across all Azure and the only allowed characters are
Create an Azure App Configuration store
APP_CONFIG_NAME='my-app-config' az appconfig create -g $RESOURCE_GROUP_NAME -n $APP_CONFIG_NAME --sku Free -l eastus
Import the test configuration file to Azure App Configuration.
Import the test configuration file to Azure App Configuration using a system-assigned managed identity.
Cd into the folder
az appconfig kv import -n $APP_CONFIG_NAME --source file --format json --path ./sampleconfigs.json --separator : --yes
Connect the web app to App Configuration
Create a connection between your web application and your App Configuration store.
Create a connection between your web application and your App Configuration store, using a system-assigned managed identity authentication. This connection is done through Service Connector.
az webapp connection create appconfig -g $RESOURCE_GROUP_NAME -n $APP_SERVICE_NAME --app-config $APP_CONFIG_NAME --tg $RESOURCE_GROUP_NAME --connection "app_config_smi" --system-identity
system-identity refers to the system-assigned managed identity (SMI) authentication type. Service Connector also supports the following authentications: user-assigned managed identity (UMI), connection string (secret) and service principal.
Validate the connection
- To check if the connection is working, navigate to your web app at
https://<myWebAppName>.azurewebsites.net/from your browser. Once the website is up, you'll see it displaying "Hello. Your Azure WebApp is connected to App Configuration by ServiceConnector now".
How it works
Find below what Service Connector manages behind the scenes for each authentication type.
Service Connector manages the connection configuration for you:
- Set up the web app's
AZURE_APPCONFIGURATION_ENDPOINTto let the application access it and get the App Configuration endpoint. Access sample code.
- Activate the web app's system-assigned managed authentication and grant App Configuration a Data Reader role to let the application authenticate to the App Configuration using DefaultAzureCredential from Azure.Identity. Access sample code.
For more information, go to Service Connector internals.
Optionally, do the following tests:
Update the value of the key
SampleApplication:Settings:Messagesin the App Configuration Store.
az appconfig kv set -n <myAppConfigStoreName> --key SampleApplication:Settings:Messages --value hello --yes
Navigate to your Azure web app by going to
https://<myWebAppName>.azurewebsites.net/and refresh the page. You'll see that the message is updated to "hello".
Once you're done, delete the Azure resources you created.
az group delete -n <myResourceGroupName> --yes
Follow the tutorials listed below to learn more about Service Connector.