Edit

Share via

Kudu service overview

  • Article

Kudu is the engine behind some features in Azure App Service that are related to source-control-based deployment and other deployment methods, like Dropbox and OneDrive sync.

Access Kudu for your app

Anytime you create an app, App Service creates a companion app for it that's secured by HTTPS. This Kudu app is accessible at these URLs:

  • App not in the Isolated tier: https://<app-name>.scm.azurewebsites.net
  • Internet-facing app in the Isolated tier (App Service Environment): https://<app-name>.scm.<ase-name>.p.azurewebsites.net
  • Internal app in the Isolated tier (App Service Environment for internal load balancing): https://<app-name>.scm.<ase-name>.appserviceenvironment.net

For more information, see Accessing the Kudu service.

Kudu features

Kudu gives you helpful information about your App Service app, such as:

  • App settings
  • Connection strings
  • Environment variables
  • Server variables
  • HTTP headers

It also provides features like these:

  • Run commands in the Kudu console.
  • Download IIS diagnostic dumps or Docker logs.
  • Manage IIS processes and site extensions.
  • Add deployment webhooks for Windows apps.
  • Allow ZIP deployment UI with /ZipDeploy.
  • Generate custom deployment scripts.
  • Allow access with a REST API.

RBAC permissions required to access Kudu

To access Kudu in the browser by using Microsoft Entra authentication, you need to be assigned an appropriate built-in or custom role over the scope of the application. The assigned role must include permission for the Microsoft.Web/sites/publish/Action resource provider operation. The following table shows example built-in roles that include this permission.

Role type Example built-in roles
Job function roles Website Contributor
Logic Apps Standard Developer (Preview)
Privileged administrator roles1 Owner
Contributor

1 Privileged administrator roles grant much more permission than is needed to access Kudu. If need to create a new role assignment, consider if a job function role with less access can be used instead.

See the role-based access control overview to learn more about creating role assignments.

More resources

Kudu is an open-source project. It has documentation on the Kudu wiki.