Continuous deployment to Azure App Service

See Local Git deployment to Azure App Service.

The GitHub Actions build provider is available only for GitHub deployment. When configured from the app's Deployment Center, it completes these actions to set up CI/CD:

• Deposits a GitHub Actions workflow file into your GitHub repository to handle build and deploy tasks to App Service.
• For basic authentication, adds the publish profile for your app as a GitHub secret. The workflow file uses this secret to authenticate with App Service.
• For user-assigned identity, see What does the user-assigned identity option do for GitHub Actions?
• Captures information from the workflow run logs and displays it on the Logs tab in the Deployment Center.

You can customize the GitHub Actions build provider in these ways:

• Customize the workflow file after it's generated in your GitHub repository. For more information, see Workflow syntax for GitHub Actions. Just make sure that the workflow deploys to App Service with the azure/webapps-deploy action.
• If the selected branch is protected, you can still preview the workflow file without saving the configuration and then manually add it into your repository. This method doesn't give you log integration with the Azure portal.
• Instead of using basic authentication or a user-assigned identity, you can also deploy by using a service principal in Microsoft Entra ID. This can't be configured in the portal.

App Service Build Service is the deployment and build engine native to App Service, otherwise known as Kudu. When this option is selected, App Service adds a webhook into the repository you authorized. Any code push to the repository triggers the webhook, and App Service pulls the changes into its repository and performs any deployment tasks. For more information, see Deploying from GitHub (Kudu).

Resources:

• Investigate common problems with continuous deployment
• Project Kudu

What happens to my app during deployment?

All the officially supported deployment methods make changes to the files in the /home/site/wwwroot folder of your app. These files are used to run your app. So the deployment can fail because of locked files. The app might also behave unpredictably during deployment because the files aren't all updated at the same time. This behavior is undesirable for a customer-facing app. There are a few ways to avoid these issues:

• Run your app directly from the ZIP package, without unpacking it.
• Stop your app or enable offline mode for it during deployment. For more information, see Deal with locked files during deployment.
• Deploy to a staging slot with auto swap turned on.

Frequently asked questions

• Does the GitHub Actions build provider work with basic authentication if basic authentication is disabled?
• What does the user-assigned identity option do for GitHub Actions?
• Why do I see the error, "This identity does not have write permissions on this app. Please select a different identity, or work with your admin to grant the Website Contributor role to your identity on this app"?
• Why do I see the error, "This identity does not have write permissions on this app. Please select a different identity, or work with your admin to grant the Website Contributor role to your identity on this app"?

Does the GitHub Actions build provider work with basic authentication if basic authentication is disabled?

No. Try using GitHub Actions with the user-assigned identity option.

For more information, see Deployment without basic authentication.

What does the user-assigned identity option do for GitHub Actions?

When you select user-assigned identity under the GitHub Actions source, App Service configures all the necessary resources in Azure and in GitHub to enable the recommended OpenID Connect authentication with GitHub Actions.

Specifically, App Service does the following operations:

• Creates a federated credential between a user-assigned managed identity in Azure and your selected repository and branch in GitHub.
• Creates the secrets AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID from the federated credential in your selected GitHub repository.
• Assigns the identity to your app.

In a GitHub Actions workflow in your GitHub repository, you can then use the Azure/login action to authenticate with your app by using OpenID Connect. For examples, see Add the workflow file to your GitHub repository.

If your Azure account has the required permissions, App Service creates a user-assigned managed identity and configures it for you. This identity isn't shown in the Identities page of your app. If your Azure account doesn't have the required permissions, you must select an existing identity with the required role.

Why do I see the error, "You do not have sufficient permissions on this app to assign role-based access to a managed identity and configure federated credentials"?

The message indicates that your Azure account doesn't have the required permissions to create a user-assigned managed identity for the GitHub Actions. The required permissions (scoped to your app) are:

• Microsoft.Authorization/roleAssignments/write
• Microsoft.ManagedIdentity/userAssignedIdentities/write

By default, the User Access Administrator role and Owner role have these permissions already, but the Contributor role doesn't. If you don't have the required permissions, work with your Azure administrator to create a user-assigned managed identity with the Website Contributor role. In the Deployment Center, you can then select the identity in the GitHub > Identity dropdown.

For more information on the alternative steps, see Deploy to App Service using GitHub Actions.

Why do I see the error, "This identity does not have write permissions on this app. Please select a different identity, or work with your admin to grant the Website Contributor role to your identity on this app"?

The message indicates that the selected user-assigned managed identity doesn't have the required role to enable OpenID Connect between the GitHub repository and the App Service app. The identity must have one of the following roles on the app: Owner, Contributor, Websites Contributor. The least privileged role that the identity needs is Websites Contributor.

More resources

• Use Azure PowerShell