Azure Platform In Depth

App Service     → HTTP APIs, Blazor, background workers (Always On)
Azure SQL       → relational data, EF Core, existing T-SQL skills
Key Vault       → connection strings, API keys, certs — no secrets in git
App Insights    → traces, requests, exceptions, dependency calls
Service Bus     → async messaging (see azure-dotnet-tutorial.html)
Table Storage   → high-volume entity storage, audit logs
Functions       → event-driven, timer jobs, lightweight processors
AKS             → full Kubernetes control — when PaaS isn't enough

Internet → App Service (Minimal API)
              ├─ Managed Identity → Key Vault (secrets)
              ├─ Managed Identity → Azure SQL
              ├─ telemetry → Application Insights
              └─ optional → Service Bus (async side effects)

Deploy: GitHub Actions → ACR → App Service slot → swap

// Program.cs — forward headers behind Azure load balancer
builder.Services.Configure<ForwardedHeadersOptions>(o =>
{
    o.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
});

var app = builder.Build();
app.UseForwardedHeaders();

// App Service settings (Configuration blade):
//   ASPNETCORE_ENVIRONMENT = Production
//   WEBSITE_HTTPLOGGING_RETENTION_DAYS = 7
//   Always On = true  (required for BackgroundService)

# Bind domain and managed certificate (free)
az webapp config hostname add --webapp-name myapi --resource-group rg-prod \
  --hostname api.mycompany.com

az webapp config ssl bind --certificate-thumbprint <thumb> \
  --ssl-type SNI --name myapi --resource-group rg-prod

# Enforce HTTPS only
az webapp update --name myapi --resource-group rg-prod --https-only true

builder.Services.AddDbContext<AppDbContext>((sp, options) =>
{
    var conn = builder.Configuration.GetConnectionString("Default");
    options.UseSqlServer(conn, sql =>
    {
        sql.EnableRetryOnFailure(maxRetryCount: 5);
        sql.CommandTimeout(30);
    });
});

// Connection string format (password in Key Vault):
// Server=tcp:myserver.database.windows.net,1433;
// Database=MyDb;Encrypt=True;TrustServerCertificate=False;

// App Service system-assigned Managed Identity
// SQL: CREATE USER [myapi] FROM EXTERNAL PROVIDER;
//      ALTER ROLE db_datareader ADD MEMBER [myapi];

var conn = new SqlConnection(
    "Server=tcp:myserver.database.windows.net;Database=MyDb;Encrypt=True;");
conn.AccessToken = await new DefaultAzureCredential()
    .GetTokenAsync(new TokenRequestContext(
        new[] { "https://database.windows.net/.default" }));
await conn.OpenAsync();

# Enable system-assigned identity on web app
az webapp identity assign --name myapi --resource-group rg-prod
# note principalId output

# Grant Key Vault Secrets User role
az role assignment create \
  --assignee <principalId> \
  --role "Key Vault Secrets User" \
  --scope /subscriptions/.../resourceGroups/rg-prod/providers/Microsoft.KeyVault/vaults/my-kv

// NuGet: Azure.Extensions.AspNetCore.Configuration.Secrets
builder.Configuration.AddAzureKeyVault(
    new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/"),
    new DefaultAzureCredential());

// Vault secret name: ConnectionStrings--Default
// Becomes: builder.Configuration["ConnectionStrings:Default"]

// Local dev: Azure CLI login or user secrets — same code path with DefaultAzureCredential

builder.Services.AddOpenTelemetry()
    .UseAzureMonitor(o =>
        o.ConnectionString = builder.Configuration["ApplicationInsights:ConnectionString"])
    .WithTracing(t => t
        .AddAspNetCoreInstrumentation()
        .AddHttpClientInstrumentation()
        .AddEntityFrameworkCoreInstrumentation())
    .WithMetrics(m => m
        .AddAspNetCoreInstrumentation()
        .AddRuntimeInstrumentation());

public class OrderService(ILogger<OrderService> log)
{
    public async Task CreateAsync(Order order)
    {
        using var activity = Activity.StartActivity("CreateOrder");
        activity?.SetTag("order.id", order.Id);

        log.LogInformation("Creating order {OrderId} for {CustomerId}",
            order.Id, order.CustomerId);
        // failures auto-captured as exceptions in App Insights
    }
}

// main.bicep
param location string = resourceGroup().location
param appName string
param sqlAdminLogin string
@secure()
param sqlAdminPassword string

resource plan 'Microsoft.Web/serverfarms@2023-01-01' = {
  name: '${appName}-plan'
  location: location
  sku: { name: 'P1v3', tier: 'PremiumV3' }
  properties: { reserved: true }  // Linux
}

resource web 'Microsoft.Web/sites@2023-01-01' = {
  name: appName
  location: location
  identity: { type: 'SystemAssigned' }
  properties: {
    serverFarmId: plan.id
    siteConfig: { linuxFxVersion: 'DOCKER|myregistry.azurecr.io/myapi:latest' }
  }
}

# One-time or on infra changes
az deployment group create \
  --resource-group rg-prod \
  --template-file infra/main.bicep \
  --parameters appName=myapi-prod sqlAdminLogin=sqladmin sqlAdminPassword=@secure.txt

# Store Bicep in repo; PR review for SKU changes and firewall rules

// Slot-specific (don't swap — each slot keeps its value):
//   ASPNETCORE_ENVIRONMENT might stay "Production" on both
//   KeyVaultName, ApplicationInsights:ConnectionString → sticky

// Swap with setting:
//   New API version deploys to staging
//   Staging slot setting: DeploymentSlot = staging (for logging)

az webapp deployment slot create --name myapi --resource-group rg-prod --slot staging

# Preview swap — staging gets production hostname temporarily for validation
az webapp deployment slot swap \
  --name myapi --resource-group rg-prod \
  --slot staging --action preview

# Run synthetic tests against preview URL
# Complete swap
az webapp deployment slot swap --name myapi --resource-group rg-prod --slot staging

# Bad release? Swap again — previous prod is now on staging

// Dev/test: Basic B1 App Service + serverless SQL (auto-pause)
// Prod: Premium v3 (slots, autoscale, VNet integration)
// Right-size SQL DTU/vCore — watch App Insights dependency duration
// Reserved instances after 6 months stable load

// Pair platform stack with messaging when needed:
//   App Service (sync API) + Service Bus (async) — see azure-dotnet-tutorial