Outbound VNet integration and inbound private exposure are separate features. In this case, a web app has VNet integration but still has public inbound traffic. “A private endpoint or appropriate inbound access control” would not satisfy that requirement; the supported action is “VNet integration primarily concerns outbound traffic, not private ingress”. Private ingress requires separate networking and access configuration.

Regional VNet integration enables outbound connectivity into supported virtual networks. In this case, a web app has VNet integration but still has public inbound traffic. “App Service regional virtual network integration” would not satisfy that requirement; the supported action is “VNet integration primarily concerns outbound traffic, not private ingress”. Private ingress requires separate networking and access configuration.

Outbound routes do not themselves define inbound client admission. In this case, a web app has VNet integration but still has public inbound traffic. “Inbound access restriction rule configuration and priority” would not satisfy that requirement; the supported action is “VNet integration primarily concerns outbound traffic, not private ingress”. Private ingress requires separate networking and access configuration.

Private endpoints enable private ingress connectivity to eligible web apps. In this case, an App Service app must restrict incoming requests to a corporate subnet. “Use an App Service private endpoint with appropriate DNS and access controls” would not satisfy that requirement; the supported action is “App Service access restrictions with the correct allowed network rules”. Access restrictions control allowed inbound traffic sources.

Health checks monitor app response and help exclude unhealthy instances. In this case, an App Service app must restrict incoming requests to a corporate subnet. “Configure health check to probe an application endpoint” would not satisfy that requirement; the supported action is “App Service access restrictions with the correct allowed network rules”. Access restrictions control allowed inbound traffic sources.

Instance health assessment depends on an endpoint that reflects application readiness. In this case, an App Service app must restrict incoming requests to a corporate subnet. “App Service health check path and response behavior” would not satisfy that requirement; the supported action is “App Service access restrictions with the correct allowed network rules”. Access restrictions control allowed inbound traffic sources.

Private endpoints enable private ingress connectivity to eligible web apps. In this case, an app is reachable from an unapproved public IP despite a restrictive VNet route. “Use an App Service private endpoint with appropriate DNS and access controls” would not satisfy that requirement; the supported action is “Inbound access restriction rule configuration and priority”. Outbound routes do not themselves define inbound client admission.

Private ingress requires separate networking and access configuration. In this case, an app is reachable from an unapproved public IP despite a restrictive VNet route. “VNet integration primarily concerns outbound traffic, not private ingress” would not satisfy that requirement; the supported action is “Inbound access restriction rule configuration and priority”. Outbound routes do not themselves define inbound client admission.

Health checks monitor app response and help exclude unhealthy instances. In this case, an app is reachable from an unapproved public IP despite a restrictive VNet route. “Configure health check to probe an application endpoint” would not satisfy that requirement; the supported action is “Inbound access restriction rule configuration and priority”. Outbound routes do not themselves define inbound client admission.

Access restrictions control allowed inbound traffic sources. In this case, a developer needs a deterministic startup check for a web app instance. “App Service access restrictions with the correct allowed network rules” would not satisfy that requirement; the supported action is “Configure health check to probe an application endpoint”. Health checks monitor app response and help exclude unhealthy instances.

A reference string is not a substitute for Key Vault authorization. In this case, a developer needs a deterministic startup check for a web app instance. “Grant the web app's managed identity the required secret read permissions” would not satisfy that requirement; the supported action is “Configure health check to probe an application endpoint”. Health checks monitor app response and help exclude unhealthy instances.

Key Vault references and managed identities reduce direct secret storage in code. In this case, a developer needs a deterministic startup check for a web app instance. “Use managed identity with supported Key Vault references in app settings” would not satisfy that requirement; the supported action is “Configure health check to probe an application endpoint”. Health checks monitor app response and help exclude unhealthy instances.

A reference string is not a substitute for Key Vault authorization. In this case, a web app scales out but load balancer continues sending traffic to a broken process. “Grant the web app's managed identity the required secret read permissions” would not satisfy that requirement; the supported action is “App Service health check path and response behavior”. Instance health assessment depends on an endpoint that reflects application readiness.

Access restrictions control allowed inbound traffic sources. In this case, a web app scales out but load balancer continues sending traffic to a broken process. “App Service access restrictions with the correct allowed network rules” would not satisfy that requirement; the supported action is “App Service health check path and response behavior”. Instance health assessment depends on an endpoint that reflects application readiness.

Key Vault references and managed identities reduce direct secret storage in code. In this case, a web app scales out but load balancer continues sending traffic to a broken process. “Use managed identity with supported Key Vault references in app settings” would not satisfy that requirement; the supported action is “App Service health check path and response behavior”. Instance health assessment depends on an endpoint that reflects application readiness.

Health checks monitor app response and help exclude unhealthy instances. In this case, a web application needs secrets without storing cleartext connection strings in app code. “Configure health check to probe an application endpoint” would not satisfy that requirement; the supported action is “Use managed identity with supported Key Vault references in app settings”. Key Vault references and managed identities reduce direct secret storage in code.

App Service backups depend on supported plan capabilities and storage destination. In this case, a web application needs secrets without storing cleartext connection strings in app code. “App Service backup configuration on an eligible plan with proper storage access” would not satisfy that requirement; the supported action is “Use managed identity with supported Key Vault references in app settings”. Key Vault references and managed identities reduce direct secret storage in code.

Instance health assessment depends on an endpoint that reflects application readiness. In this case, a web application needs secrets without storing cleartext connection strings in app code. “App Service health check path and response behavior” would not satisfy that requirement; the supported action is “Use managed identity with supported Key Vault references in app settings”. Key Vault references and managed identities reduce direct secret storage in code.

App Service backups depend on supported plan capabilities and storage destination. In this case, a Key Vault reference fails because the web app lacks access. “App Service backup configuration on an eligible plan with proper storage access” would not satisfy that requirement; the supported action is “Grant the web app's managed identity the required secret read permissions”. A reference string is not a substitute for Key Vault authorization.

Health checks monitor app response and help exclude unhealthy instances. In this case, a Key Vault reference fails because the web app lacks access. “Configure health check to probe an application endpoint” would not satisfy that requirement; the supported action is “Grant the web app's managed identity the required secret read permissions”. A reference string is not a substitute for Key Vault authorization.

Instance health assessment depends on an endpoint that reflects application readiness. In this case, a Key Vault reference fails because the web app lacks access. “App Service health check path and response behavior” would not satisfy that requirement; the supported action is “Grant the web app's managed identity the required secret read permissions”. A reference string is not a substitute for Key Vault authorization.

A reference string is not a substitute for Key Vault authorization. In this case, a web app needs built-in backup to a selected storage account. “Grant the web app's managed identity the required secret read permissions” would not satisfy that requirement; the supported action is “App Service backup configuration on an eligible plan with proper storage access”. App Service backups depend on supported plan capabilities and storage destination.

Key Vault references and managed identities reduce direct secret storage in code. In this case, a web app needs built-in backup to a selected storage account. “Use managed identity with supported Key Vault references in app settings” would not satisfy that requirement; the supported action is “App Service backup configuration on an eligible plan with proper storage access”. App Service backups depend on supported plan capabilities and storage destination.

Slot traffic percentage routing supports controlled gradual exposure. In this case, a web app needs built-in backup to a selected storage account. “Use deployment-slot traffic routing for a supported phased release” would not satisfy that requirement; the supported action is “App Service backup configuration on an eligible plan with proper storage access”. App Service backups depend on supported plan capabilities and storage destination.

Key Vault references and managed identities reduce direct secret storage in code. In this case, a team assumes source control alone preserves runtime app configuration for recovery. “Use managed identity with supported Key Vault references in app settings” would not satisfy that requirement; the supported action is “Plan application backup or redeployment of configuration and dependent data”. Source code versioning may not retain runtime settings and application data.

A reference string is not a substitute for Key Vault authorization. In this case, a team assumes source control alone preserves runtime app configuration for recovery. “Grant the web app's managed identity the required secret read permissions” would not satisfy that requirement; the supported action is “Plan application backup or redeployment of configuration and dependent data”. Source code versioning may not retain runtime settings and application data.

Slot traffic percentage routing supports controlled gradual exposure. In this case, a team assumes source control alone preserves runtime app configuration for recovery. “Use deployment-slot traffic routing for a supported phased release” would not satisfy that requirement; the supported action is “Plan application backup or redeployment of configuration and dependent data”. Source code versioning may not retain runtime settings and application data.

App Service backups depend on supported plan capabilities and storage destination. In this case, a business wants to serve a new app version to 10% of users initially. “App Service backup configuration on an eligible plan with proper storage access” would not satisfy that requirement; the supported action is “Use deployment-slot traffic routing for a supported phased release”. Slot traffic percentage routing supports controlled gradual exposure.

Expired or unbound certificates cause browser trust errors on custom domains. In this case, a business wants to serve a new app version to 10% of users initially. “TLS certificate validity and current hostname binding” would not satisfy that requirement; the supported action is “Use deployment-slot traffic routing for a supported phased release”. Slot traffic percentage routing supports controlled gradual exposure.

Source code versioning may not retain runtime settings and application data. In this case, a business wants to serve a new app version to 10% of users initially. “Plan application backup or redeployment of configuration and dependent data” would not satisfy that requirement; the supported action is “Use deployment-slot traffic routing for a supported phased release”. Slot traffic percentage routing supports controlled gradual exposure.

Certificate upload and active binding are distinct management steps. In this case, a staging slot exists but it receives no user testing traffic. “The expected hostname binding may still refer to the previous certificate” would not satisfy that requirement; the supported action is “Route an appropriate percentage of traffic to the test slot where supported”. A slot's existence alone does not create a canary audience.

Expired or unbound certificates cause browser trust errors on custom domains. In this case, a staging slot exists but it receives no user testing traffic. “TLS certificate validity and current hostname binding” would not satisfy that requirement; the supported action is “Route an appropriate percentage of traffic to the test slot where supported”. A slot's existence alone does not create a canary audience.

Source code versioning may not retain runtime settings and application data. In this case, a staging slot exists but it receives no user testing traffic. “Plan application backup or redeployment of configuration and dependent data” would not satisfy that requirement; the supported action is “Route an appropriate percentage of traffic to the test slot where supported”. A slot's existence alone does not create a canary audience.