Gap-5: App Service Operate (B+ → A) — SKU selection, custom domains, networking by paulyuk · Pull Request #1639 · microsoft/GitHub-Copilot-for-Azure

paulyuk · 2026-04-01T17:36:55Z

Closes #1613 | Parent: #1608

3 files: sku-selection.md (Free→Isolated comparison), custom-domains.md (managed TLS via Bicep), networking.md (VNet, Private Endpoints, Access Restrictions).

Starting assessment — domain experts should review.

…(Gap-5) Closes #1613 | Parent: #1608 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds App Service “Operate (A)” reference docs covering SKU selection, custom domains/managed TLS, and networking options (VNet integration, Private Endpoints, access restrictions).

Changes:

Introduces a SKU comparison/pricing guide plus IaC examples (Bicep/Terraform) for plan SKU selection.
Documents custom domain DNS setup and managed TLS workflows via CLI/Bicep/Terraform.
Adds networking guidance for VNet integration, Private Endpoints, access restrictions, and troubleshooting.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
plugin/skills/azure-prepare/references/services/app-service/sku-selection.md	New guidance to choose App Service SKUs, including feature matrix, pricing overview, and IaC examples.
plugin/skills/azure-prepare/references/services/app-service/custom-domains.md	New guide for custom domains and managed certificates using CLI/Bicep/Terraform.
plugin/skills/azure-prepare/references/services/app-service/networking.md	New networking reference covering VNet integration, Private Endpoints, access restrictions, and troubleshooting.

Copilot · 2026-04-01T17:43:43Z

plugin/skills/azure-prepare/references/services/app-service/networking.md

+  properties: {
+    serverFarmId: appServicePlan.id
+    virtualNetworkSubnetId: subnet.id
+    vnetRouteAllEnabled: true // route all outbound through VNet


vnetRouteAllEnabled is not a top-level site properties field for Microsoft.Web/sites; it belongs under siteConfig (or via a Microsoft.Web/sites/config resource). As written, this snippet will fail validation or silently not apply the setting. Move vnetRouteAllEnabled into properties.siteConfig (or add a separate config resource) while keeping virtualNetworkSubnetId on the site.

Suggested change

vnetRouteAllEnabled: true // route all outbound through VNet

siteConfig: {

vnetRouteAllEnabled: true // route all outbound through VNet

}

Copilot · 2026-04-01T17:43:43Z

plugin/skills/azure-prepare/references/services/app-service/networking.md

+resource privateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
+  name: 'privatelink.azurewebsites.net'
+  location: 'global'
+}
+
+resource dnsLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
+  parent: privateDnsZone
+  name: '${vnet.name}-link'
+  location: 'global'
+  properties: {
+    virtualNetwork: { id: vnet.id }
+    registrationEnabled: false
+  }
+}


The Private Endpoint example sets up the zone and VNet link, but it doesn’t associate the Private Endpoint to the private DNS zone (typically via a privateDnsZoneGroups child resource under the private endpoint). Without that association (or an explicit A record), name resolution for the app hostname won’t automatically work. Add the privateDnsZoneGroup step (or call out manual DNS record creation as required).

Copilot · 2026-04-01T17:43:43Z

plugin/skills/azure-prepare/references/services/app-service/networking.md

+| Private Endpoints (inbound) | ❌ | ❌ | ✅ | ✅ |
+| Access Restrictions | ✅ | ✅ | ✅ | ✅ |
+| Hybrid Connections | ❌ | 25 | 200 | 200 |
+| Service Endpoints | ❌ | ✅ | ✅ | ✅ |


The Service Endpoints row is misleading in the context of App Service, since service endpoints are a VNet/subnet feature used by downstream Azure services (Storage, SQL, etc.), not a capability you 'enable on' App Service itself. Consider removing this row, or rewording it to clarify it applies to resources the app connects to (e.g., 'Access to service-endpoint-protected resources').

Suggested change

| Service Endpoints | ❌ | ✅ | ✅ | ✅ |

| Access to service-endpoint-protected resources | ❌ | ✅ | ✅ | ✅ |

> Note: Service endpoints are configured on VNets/subnets and downstream services (e.g., Storage, SQL). App Service accesses them via VNet integration rather than enabling service endpoints directly on the app.

Copilot · 2026-04-01T17:43:44Z

plugin/skills/azure-prepare/references/services/app-service/custom-domains.md

+resource customDomain 'Microsoft.Web/sites/hostNameBindings@2022-09-01' = {
+  parent: webApp
+  name: 'www.contoso.com'
+  properties: {
+    siteName: webApp.name
+    hostNameType: 'Verified'
+    sslState: 'Disabled' // enable after cert is created
+  }
+}
+
+resource managedCert 'Microsoft.Web/certificates@2022-09-01' = {
+  name: 'www.contoso.com'
+  location: location
+  properties: {
+    serverFarmId: appServicePlan.id
+    canonicalName: 'www.contoso.com'
+  }
+  dependsOn: [customDomain]


This section is titled 'Custom Domain with Managed Certificate', but the Bicep example only creates the hostname binding and requests a certificate; it never binds the certificate to the hostname (i.e., enabling SNI by setting sslState and the certificate thumbprint on the hostNameBinding / or via the appropriate binding mechanism). As-is, HTTPS via the managed cert won’t be enabled. Add the missing binding step after the cert resource is created.

Suggested change

resource customDomain 'Microsoft.Web/sites/hostNameBindings@2022-09-01' = {

parent: webApp

name: 'www.contoso.com'

properties: {

siteName: webApp.name

hostNameType: 'Verified'

sslState: 'Disabled' // enable after cert is created

}

}

resource managedCert 'Microsoft.Web/certificates@2022-09-01' = {

name: 'www.contoso.com'

location: location

properties: {

serverFarmId: appServicePlan.id

canonicalName: 'www.contoso.com'

}

dependsOn: [customDomain]

resource managedCert 'Microsoft.Web/certificates@2022-09-01' = {

name: 'www.contoso.com'

location: location

properties: {

serverFarmId: appServicePlan.id

canonicalName: 'www.contoso.com'

}

}

resource customDomain 'Microsoft.Web/sites/hostNameBindings@2022-09-01' = {

parent: webApp

name: 'www.contoso.com'

properties: {

siteName: webApp.name

hostNameType: 'Verified'

sslState: 'SniEnabled'

thumbprint: managedCert.properties.thumbprint

}

dependsOn: [

managedCert

]

Copilot · 2026-04-01T17:43:44Z

plugin/skills/azure-prepare/references/services/app-service/custom-domains.md

+# Create managed certificate (free)
+az webapp config ssl create -n $APP -g $RG --hostname www.contoso.com
+
+# Bind the certificate
+az webapp config ssl bind -n $APP -g $RG \
+  --certificate-thumbprint $THUMBPRINT --ssl-type SNI


The CLI flow references $THUMBPRINT but doesn’t show how it’s obtained from the ssl create step. Add a command to capture the thumbprint from the create output (or query the certificate after creation) so the sequence is runnable end-to-end.

Copilot · 2026-04-01T17:43:44Z

plugin/skills/azure-prepare/references/services/app-service/sku-selection.md

+| SKU | vCPU | RAM | Storage | Approx. Monthly Cost |
+|-----|------|-----|---------|---------------------|
+| F1 | Shared | 1 GB | 1 GB | Free |
+| B1 | 1 | 1.75 GB | 10 GB | ~$55 |
+| B2 | 2 | 3.5 GB | 10 GB | ~$110 |
+| S1 | 1 | 1.75 GB | 50 GB | ~$73 |
+| S2 | 2 | 3.5 GB | 50 GB | ~$146 |
+| P1v3 | 2 | 8 GB | 250 GB | ~$138 |
+| P2v3 | 4 | 16 GB | 250 GB | ~$276 |
+| P3v3 | 8 | 32 GB | 250 GB | ~$552 |
+| I1v2 | 2 | 8 GB | 1 TB | ~$460 |


The pricing table is presented with specific monthly figures, but App Service pricing varies materially by OS (Windows vs Linux), region, commitment/offers, and sometimes plan options. The note on line 33 helps, but adding an 'as-of' date and the assumed region/OS (or explicitly labeling these numbers as a single example scenario) would prevent readers from treating them as generally applicable.

github-actions · 2026-04-01T17:56:47Z

Details

# 🔍 Token Analysis Report

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts compare --base origin/main --head HEAD --markdown

fatal: path 'plugin/skills/azure-prepare/references/services/app-service/custom-domains.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/app-service/networking.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/app-service/sku-selection.md' exists on disk, but not in 'origin/main'

📊 Token Change Report

Comparing origin/main → HEAD

Summary

Metric	Value
📈 Total Change	+3,088 tokens (0%)
Before	0 tokens
After	3,088 tokens
Files Changed	3

Changed Files

File	Before	After	Change
`plugin/skills/azure-prepare/references/services/app-service/networking.md`	-	1,067	+1067
`plugin/skills/azure-prepare/references/services/app-service/custom-domains.md`	-	1,056	+1056
`plugin/skills/azure-prepare/references/services/app-service/sku-selection.md`	-	965	+965

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts check --markdown

📊 Token Limit Check Report

Checked: 527 files
Exceeded: 69 files

⚠️ Files Exceeding Token Limits

File	Tokens	Limit	Over By
`.github/skills/analyze-test-run/SKILL.md`	2471	500	+1971
`.github/skills/file-test-bug/SKILL.md`	628	500	+128
`.github/skills/sensei/README.md`	3531	2000	+1531
`.github/skills/sensei/SKILL.md`	2382	500	+1882
`.github/skills/sensei/references/EXAMPLES.md`	3707	2000	+1707
`.github/skills/sensei/references/LOOP.md`	4181	2000	+2181
`.github/skills/sensei/references/SCORING.md`	3927	2000	+1927
`.github/skills/skill-authoring/SKILL.md`	817	500	+317
`plugin/skills/appinsights-instrumentation/SKILL.md`	908	500	+408
`plugin/skills/azure-ai/SKILL.md`	817	500	+317
`plugin/skills/azure-aigateway/SKILL.md`	1258	500	+758
`plugin/skills/azure-aigateway/references/policies.md`	2342	2000	+342
`plugin/skills/azure-cloud-migrate/references/services/functions/lambda-to-functions.md`	2600	2000	+600
`plugin/skills/azure-cloud-migrate/references/services/functions/runtimes/javascript.md`	2181	2000	+181
`plugin/skills/azure-compliance/SKILL.md`	1185	500	+685
`plugin/skills/azure-compute/SKILL.md`	755	500	+255
`plugin/skills/azure-compute/workflows/vm-recommender/vm-recommender.md`	2393	2000	+393
`plugin/skills/azure-compute/workflows/vm-troubleshooter/references/cannot-connect-to-vm.md`	7308	2000	+5308
`plugin/skills/azure-cost-optimization/SKILL.md`	3900	500	+3400
`plugin/skills/azure-deploy/SKILL.md`	1562	500	+1062
`plugin/skills/azure-diagnostics/SKILL.md`	1132	500	+632
`plugin/skills/azure-diagnostics/aks-troubleshooting/networking.md`	2147	2000	+147
`plugin/skills/azure-diagnostics/aks-troubleshooting/node-issues.md`	2003	2000	+3
`plugin/skills/azure-enterprise-infra-planner/SKILL.md`	991	500	+491
`plugin/skills/azure-enterprise-infra-planner/references/constraints/compute-apps.md`	2022	2000	+22
`plugin/skills/azure-hosted-copilot-sdk/SKILL.md`	608	500	+108
`plugin/skills/azure-kubernetes/SKILL.md`	2266	500	+1766
`plugin/skills/azure-kusto/SKILL.md`	2149	500	+1649
`plugin/skills/azure-messaging/SKILL.md`	967	500	+467
`plugin/skills/azure-prepare/SKILL.md`	2607	500	+2107
`plugin/skills/azure-prepare/references/aspire.md`	2991	2000	+991
`plugin/skills/azure-prepare/references/plan-template.md`	2559	2000	+559
`plugin/skills/azure-prepare/references/recipes/azd/terraform.md`	3012	2000	+1012
`plugin/skills/azure-prepare/references/resources-limits-quotas.md`	3322	2000	+1322
`plugin/skills/azure-prepare/references/security.md`	2092	2000	+92
`plugin/skills/azure-prepare/references/services/functions/bicep.md`	3065	2000	+1065
`plugin/skills/azure-prepare/references/services/functions/templates/SPEC-composable-templates.md`	6187	2000	+4187
`plugin/skills/azure-prepare/references/services/functions/templates/recipes/composition.md`	4649	2000	+2649
`plugin/skills/azure-prepare/references/services/functions/terraform.md`	3358	2000	+1358
`plugin/skills/azure-quotas/SKILL.md`	3445	500	+2945
`plugin/skills/azure-quotas/references/commands.md`	2644	2000	+644
`plugin/skills/azure-resource-lookup/SKILL.md`	1279	500	+779
`plugin/skills/azure-resource-visualizer/SKILL.md`	2054	500	+1554
`plugin/skills/azure-storage/SKILL.md`	1180	500	+680
`plugin/skills/azure-upgrade/SKILL.md`	1001	500	+501
`plugin/skills/azure-upgrade/references/services/functions/automation.md`	3463	2000	+1463
`plugin/skills/azure-upgrade/references/services/functions/consumption-to-flex.md`	2773	2000	+773
`plugin/skills/azure-validate/SKILL.md`	906	500	+406
`plugin/skills/entra-app-registration/SKILL.md`	2068	500	+1568
`plugin/skills/entra-app-registration/references/api-permissions.md`	2545	2000	+545
`plugin/skills/entra-app-registration/references/cli-commands.md`	2211	2000	+211
`plugin/skills/entra-app-registration/references/console-app-example.md`	2752	2000	+752
`plugin/skills/entra-app-registration/references/oauth-flows.md`	2375	2000	+375
`plugin/skills/microsoft-foundry/SKILL.md`	2870	500	+2370
`plugin/skills/microsoft-foundry/foundry-agent/create/create.md`	3016	2000	+1016
`plugin/skills/microsoft-foundry/foundry-agent/deploy/deploy.md`	5511	2000	+3511
`plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/eval-datasets.md`	2342	2000	+342
`plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/references/trace-to-dataset.md`	4268	2000	+2268
`plugin/skills/microsoft-foundry/foundry-agent/observe/observe.md`	2547	2000	+547
`plugin/skills/microsoft-foundry/foundry-agent/trace/references/kql-templates.md`	2701	2000	+701
`plugin/skills/microsoft-foundry/models/deploy-model/SKILL.md`	1640	500	+1140
`plugin/skills/microsoft-foundry/models/deploy-model/capacity/SKILL.md`	1739	500	+1239
`plugin/skills/microsoft-foundry/models/deploy-model/customize/SKILL.md`	2235	500	+1735
`plugin/skills/microsoft-foundry/models/deploy-model/customize/references/customize-workflow.md`	3335	2000	+1335
`plugin/skills/microsoft-foundry/models/deploy-model/preset/SKILL.md`	1226	500	+726
`plugin/skills/microsoft-foundry/models/deploy-model/preset/references/preset-workflow.md`	5534	2000	+3534
`plugin/skills/microsoft-foundry/quota/quota.md`	2129	2000	+129
`plugin/skills/microsoft-foundry/quota/references/capacity-planning.md`	2029	2000	+29
`plugin/skills/microsoft-foundry/references/sdk/foundry-sdk-py.md`	2162	2000	+162

Consider moving content to references/ subdirectories.

Automated token analysis. See skill authoring guidelines for best practices.

feat(operate): App Service SKU selection, custom domains, networking …

95bb7f9

…(Gap-5) Closes #1613 | Parent: #1608 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 1, 2026 17:36

paulyuk requested review from kvenkatrajan, tmeschter and wbreza as code owners April 1, 2026 17:36

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Copilot started reviewing on behalf of paulyuk April 1, 2026 17:53 View session

github-actions bot mentioned this pull request Apr 3, 2026

[repo-status] Weekly Repo Status — Mar 27 – Apr 3, 2026 #1703

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gap-5: App Service Operate (B+ → A) — SKU selection, custom domains, networking#1639

Gap-5: App Service Operate (B+ → A) — SKU selection, custom domains, networking#1639
paulyuk wants to merge 1 commit intomainfrom
pass-equity-gap-5

paulyuk commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

github-actions bot commented Apr 1, 2026

📊 Token Change Report

Summary

Changed Files

📊 Token Limit Check Report

⚠️ Files Exceeding Token Limits

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	\| Service Endpoints \| ❌ \| ✅ \| ✅ \| ✅ \|
	\| Access to service-endpoint-protected resources \| ❌ \| ✅ \| ✅ \| ✅ \|
	> Note: Service endpoints are configured on VNets/subnets and downstream services (e.g., Storage, SQL). App Service accesses them via VNet integration rather than enabling service endpoints directly on the app.

Conversation

paulyuk commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 1, 2026

📊 Token Change Report

Summary

Changed Files

📊 Token Limit Check Report

⚠️ Files Exceeding Token Limits

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants