App Service: Slots, Certificates & Networking
Deployment slots let you test changes before going live. Custom domains and TLS certificates secure your app. Network settings control how it connects. Master the advanced App Service features every Azure admin needs.
Deployment slots
Deployment slots are like having a staging area next to your production line.
Instead of deploying code directly to your live website (risky!), you deploy to a “staging” slot first. Test it. If it works, you swap the staging slot with production — instant, zero-downtime switch. If something breaks, swap back in seconds.
Each slot has its own URL (e.g., myapp-staging.azurewebsites.net) and can have different configuration settings.
Slot settings
Some settings should swap with the code (same config in staging and production). Others should stay with the slot (different database connection strings per environment).
| Setting Type | Swaps with Content? | Example |
|---|---|---|
| App settings (default) | Yes | API keys, feature flags |
| App settings (marked “slot”) | No — stays with slot | Connection strings, environment-specific URLs |
| Connection strings | Configurable | Database connection per environment |
| Handler mappings | Yes | Script processor mappings |
| Custom domain bindings | No — stays with slot | Domain names stay with production |
Custom domains and TLS certificates
Mapping a custom domain:
- Create a CNAME or A record in your DNS pointing to the App Service
- Add the custom domain in App Service → Custom domains
- Azure validates ownership (via CNAME or TXT record verification)
TLS/SSL certificates:
- Free App Service Managed Certificate — auto-renewed, covers the custom domain (Basic tier or higher)
- App Service Certificate — purchased through Azure, stored in Key Vault
- Bring your own certificate — upload a PFX/PEM file
Enforce HTTPS: App Service → TLS/SSL settings → HTTPS Only = On (redirects HTTP to HTTPS)
Exam tip: Domain verification methods
The exam tests how domain ownership is verified. For a CNAME record, point your subdomain (www) to yourapp.azurewebsites.net. For a root domain (no www), create an A record pointing to the App Service IP AND a TXT record for verification. A TXT record with asuid.yourdomain.com = the App Service’s custom domain verification ID is required.
App Service backup
App Service backup creates scheduled backups of your app’s content, configuration, and connected databases.
Requirements:
- Standard tier or higher (not available on Free or Basic)
- An Azure Storage account and container to store backups
- Maximum 10 GB combined (app + database)
What’s backed up: App configuration, file content, connected databases (SQL Database, MySQL, PostgreSQL)
Backup types:
- Scheduled — automatic, on a schedule you define
- Manual — on-demand backup at any time
| Certificate Option | Cost | Best For |
|---|---|---|
| Free Managed Certificate | Free (Basic tier or higher) | Most custom domains — auto-renewed, zero maintenance |
| App Service Certificate | Paid (purchased via Azure) | When you need wildcard certs or want Azure Key Vault integration |
| Bring Your Own Certificate | Your cost (external CA) | When you have existing certs from a third-party CA |
Networking settings
| Feature | What It Does | Tier Required |
|---|---|---|
| VNet Integration | App can access resources in a VNet (databases, VMs) | Standard+ |
| Hybrid Connections | Access on-prem resources without VPN | Standard+ |
| Private Endpoints | App receives a private IP in a VNet | Standard+ |
| Access Restrictions | Allow/deny traffic by IP or VNet | All tiers |
| Service Endpoints | Restrict access to app from specific VNets | All tiers |
Real-world: Meridian Financial's App Service setup
Meridian Financial’s customer portal uses:
- Deployment slots: Staging + Production, with slot-specific database connection strings
- Custom domain: portal.meridianfinancial.com with a managed TLS certificate
- HTTPS Only: Enabled (HTTP redirects to HTTPS)
- VNet Integration: App connects to their backend SQL database via private VNet
- Private Endpoint: The app itself is only accessible via their corporate VNet
- Backup: Daily backups to a storage account, retained for 30 days
Knowledge check
Alex deploys a new version of TechCorp's web app to the staging slot. After testing, he swaps staging with production. The staging slot has a different database connection string (marked as a 'slot setting'). What happens to the connection string after the swap?
CloudFirst Labs wants their App Service to access a SQL database deployed in a private VNet. The database has no public endpoint. What App Service feature should they configure?
🎬 Video coming soon