cad-deploy-app-service

Run az webapp up from the folder containing your .csproj after creating an App Service plan and Web App with the Azure CLI. The command zips the project, builds it server-side with dotnet publish, and restarts the app on its azurewebsites.net URL.

Store the secret with az keyvault secret set, then reference it in App Settings using the syntax @Microsoft.KeyVault(VaultName=...;SecretName=...). App Service fetches the value at runtime through the app's managed identity, so the secret never appears in code or config files.

The App Service plan is the underlying VM defining CPU, RAM, region, and pricing tier, while the App Service (Web App) is the application running on that plan. One plan can host multiple apps, and pricing is attached to the plan.

The managed identity likely lacks the correct RBAC role, or the role assignment has not propagated yet. Grant Key Vault Secrets User or Storage Blob Data Contributor on the resource scope, then wait one to two minutes and retry.

No, deployment slots require at least the B1 tier. Upgrade the plan with az appservice plan update --sku B1 before creating a staging slot, noting that B1 costs roughly thirteen dollars per month.

Blob clients authenticated with DefaultAzureCredential cannot generate SAS tokens the simple way; CanGenerateSasUri returns false. The production options are using a user delegation key or streaming the file through the API with File(stream, contentType), which this project adopts.