Search code examples
c#azure-web-app-service.net-7.0azure-sdk-.netazure-webapps

Programmatically change System Assigned ID for an App in an Azure App Service

We are in the midst of a Azure tenant/subscription migration. During this migration we are going to lose all of our current system assigned IDs. This means that we will need to manually update each place.

EX: We have app configs pointed at a Key Vault Secret. The KV allows the app access to the secret based on it's system assigned ID. After migration this is all broken and will need rebuilt so access can be restored to the app.

With how many instances we have, this could be a very very long process.

Has anyone come across this issue before? Is this even doable?

I am trying to do this in a .Net7 console app but cannot seem to find out how to access the Webapp's ID settings. I have scoured the SDK documentation and ran in circles with the LLMs to no avail.

I have this accessing the appServicePlan but I do not see a way to go even deeper to get to the app that is in the plan. On top of that I am not even sure if once I do get there I will be able to change the system assigned ID setting.

        // Sign into Azure
        ArmClient armClient = new ArmClient(credential, subscriptionId);

        // Verify a successful login by retrieving the subscription
        var loginSuccess = await armClient.GetDefaultSubscription().GetAsync();

        SubscriptionResource subscription = await armClient.GetDefaultSubscriptionAsync();
        ResourceGroupCollection resourceGroups = subscription.GetResourceGroups();
        ResourceGroupResource resourceGroup = await resourceGroups.GetAsync(resourceGroupName);
        
        await foreach(AppServicePlanResource appServicePlan in resourceGroup.GetAppServicePlans()) 
        {
            foreach() // I want to get into the app here but I can't seem to find it. 
        }
Solution

  • Use managed identities to access App Configuration. Azure App Configuration and its .NET Core, .NET Framework, and grant a managed identity access to App Configuration and configure your app to use a managed identity when you connect to App Configuration.

    Programmatically changing the system assigned ID for an App in an Azure App Service, you can use the Azure CLI to assign a system-assigned identity to an App Service. And use the Azure CLI to assign a user-assigned identity to an App Service.

    Approach-1 To assign a system-assigned identity to an App Service using the Azure CLI

    az webapp identity assign --name <app-name> --resource-group <resource-group-name>

    To assign a user-assigned identity to an App Service using the Azure CLI

    az webapp identity assign --name <app-name> --resource-group <resource-group-name> --identities <user-assigned-identity-resource-id>

    And can use the az webapp identity remove command to remove the identity from the App Service.

    Approach -2 Using the Get API

    https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}?api-version=2022-03-01

    Using the Update API

    https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{name}?api-version=2022-03-01

    enter image description here

    enter image description here

    For more information refer to the MS Docs - Web apps Get and Web Apps-Update.