Deploy and manage Azure compute resources
App Service Connectivity, TLS, Deployment, and Recovery
CoreConfigure domains, TLS, network access, backup, and deployment slots for safe application operations.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Reliable App Service operations require administrators to separate name ownership, encrypted binding, inbound and outbound networking, release switching, and point-in-time recovery.
Must Know
- Map a custom hostname by proving domain ownership and creating the required DNS record; bind a valid certificate separately to serve HTTPS.
- A private endpoint provides private inbound access to the app, while VNet integration gives the app outbound access into a virtual network.
- Deployment slots are live app instances used to validate and swap releases; slot-specific settings remain with their designated slot.
- App Service backup creates recoverable copies of supported app content and configuration on a schedule; it is not a release-routing feature.
- Feature availability and constraints depend on the App Service plan tier and the app’s platform configuration.
Compare and Distinguish
- Custom DNS vs TLS certificate: route and verify a hostname vs prove server identity and encrypt HTTPS for that hostname.
- Private endpoint vs VNet integration: private inbound path to the app vs outbound app access to VNet resources.
- Deployment slot vs backup: warm release environment with traffic swap vs retained recovery point for restoration.
- App Service vs VM or container runtime: managed application operations vs guest OS control or container-specific orchestration.
Scenario examples
- Scenario: A custom hostname resolves to the app but browsers report a certificate mismatch. Think: Add or renew a certificate that covers the hostname and configure the TLS binding.
- Scenario: The app must call a private database in a VNet. Think: Configure outbound VNet integration rather than an inbound private endpoint alone.
- Scenario: A release needs warm-up and immediate rollback of traffic. Think: Deploy to a slot, validate it, and swap; keep backup for a separate recovery requirement.
Exam traps
- A DNS record does not provide a TLS certificate, and a certificate does not create DNS routing.
- VNet integration does not make inbound client access private.
- Swapping a slot is not a historical data or content restore.
Key takeaways
- Treat DNS, TLS, inbound networking, outbound networking, release slots, and backups as separate controls.
- Use a slot for safe promotion and a backup for point-in-time recovery.
How it works
- DNS directs a hostname to App Service, the platform selects the hostname binding, and TLS uses the associated certificate.
- A slot swap exchanges applicable app configuration and routing between source and target after optional warm-up.
Objects and administrative surfaces
- DNS zone and App Service app — domain ownership record, custom hostname, certificate, TLS binding, and HTTPS settings.
- App and VNet — access restrictions, private endpoint and private DNS for inbound traffic, VNet integration subnet for outbound traffic.
- App and slot — deployments, slot settings, traffic swap, backup configuration, and restore targets.
When to use it
- Use private endpoints for private inbound app access and VNet integration for private outbound dependencies.
- Use slots for release testing and backups when an app needs recoverable historical state.
Security and governance implications
- Automate certificate renewal where supported, require modern TLS, and protect private DNS and subnet changes.
- Keep secrets slot-specific when environments need different credentials and protect backup destinations.
How to reason about this
- For a custom-domain failure, trace public or private DNS, ownership verification, hostname binding, certificate validity and coverage, then TLS binding.
- For connectivity failure, identify direction, resolve the destination, inspect the applicable endpoint or integration subnet, routes, NSGs, and target firewall.
More detail
- Configure ownership records, custom domains, certificates, TLS bindings, access paths, backups, and deployment slots at app scope.
- Understand which settings swap between slots and which are deliberately marked as slot-specific.
Ready for the quiz?
- What two independent configurations are needed for a custom HTTPS hostname?
- Which networking feature handles outbound calls from an app into a VNet?
- When does a deployment slot solve a problem that backup does not?
Related objectives
- D3.4.S4 — Configure certificates and Transport Layer Security (TLS) for an App Service
- D3.4.S5 — Map an existing custom DNS name to an App Service
- D3.4.S6 — Configure backup for an App Service
- D3.4.S7 — Configure networking settings for an App Service
- D3.4.S8 — Configure deployment slots for an App Service