Quickstart: Create a service connection in App Service with the Azure CLI

This quickstart describes the steps for creating a service connection in Azure App Service with the Azure CLI.

If you don't have an Azure subscription, create an Azure free account before you begin.

Prerequisites

• Use the Bash environment in Azure Cloud Shell. For more information, see Quickstart for Bash in Azure Cloud Shell.

  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Sign in with the Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

• This quickstart requires version 2.30.0 or higher of the Azure CLI. If using Azure Cloud Shell, the latest version is already installed.
• This quickstart assumes that you already have at least an App Service running on Azure. If you don't have an App Service, create one.

Initial set-up

1. If you're using Service Connector for the first time, start by running the command az provider register to register the Service Connector resource provider.

   az provider register -n Microsoft.ServiceLinker
   

   Tip

   You can check if the resource provider has already been registered by running the command az provider show -n "Microsoft.ServiceLinker" --query registrationState. If the output is Registered, then Service Connector has already been registered.

2. Optionally, use the Azure CLI az webapp connection list-support-types command to get a list of supported target services for App Service.

   az webapp connection list-support-types --output table
   

Create a service connection

Using a managed identity

Important

Using Managed Identity requires you have the permission to Microsoft Entra role assignment. Without this permission, creating a connection will fail. You can ask your subscription owner to grant you this permission or use an access key to create the connection.

Use the Azure CLI az webapp connection command to create a service connection to a Blob Storage with a system-assigned Managed Identity, providing the following information:

• The name of the resource group that contains the App Service
• The name of the App Service
• The name of the resource group that contains the storage account
• The name of the storage account

az webapp connection create storage-blob

Note

If you don't have a Blob Storage, you can run az webapp connection create storage-blob --new --system-identity to provision a new Blob Storage resource and directly connected it to your App Service instance.

Using an access key

Warning

Microsoft recommends that you use the most secure authentication flow available. The authentication flow described in this procedure requires a very high degree of trust in the application, and carries risks that are not present in other flows. You should only use this flow when other more secure flows, such as managed identities, aren't viable.

Use the Azure CLI az webapp connection create command to create a service connection to an Azure Blob Storage with an access key, providing the following information:

• Source compute service resource group name: the resource group name of the App Service.
• App Service name: the name of your App Service that connects to the target service.
• Target service resource group name: the resource group name of the Blob Storage.
• Storage account name: the account name of your Blob Storage.

az webapp connection create storage-blob --secret

Tip

If you don't have a Blob Storage, run az webapp connection create storage-blob --new --secret to provision a new one and directly get connected to your App Service resource.

View connections

Run the Azure CLI az webapp connection command to list connections to your App Service, providing the following information:

• The name of the resource group that contains the App Service
• The name of the App Service

az webapp connection list -g "<your-app-service-resource-group>" -n "<your-app-service-name>" --output table

Next steps

Follow the tutorials below to start building your own application with Service Connector.

Tutorial: WebApp + Storage with Azure CLI

Tutorial: WebApp + PostgreSQL with Azure CLI