You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/deploy-configure-credentials.md
+20-18Lines changed: 20 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,9 @@ ms.date: 06/30/2025
11
11
12
12
# Manage deployment credentials for Azure App Service
13
13
14
-
You can deploy local apps to [Azure App Service](overview.md) by using [local Git deployment](deploy-local-git.md) or [FTP/S deployment](deploy-ftp.md). App Service supports two types of credentials for secure local app deployment: *user-scope* and *app-scope* credentials. These deployment credentials are different from your Azure subscription credentials. This article explains how to create and manage deployment credentials for local Git or FTP/S deployment.
14
+
You can deploy local apps to [Azure App Service](overview.md) by using [local Git deployment](deploy-local-git.md) or [FTP/S deployment](deploy-ftp.md). This article explains how to create and manage deployment credentials for local Git or FTP/S deployment.
15
+
16
+
App Service supports two types of credentials for secure local app deployment: *user-scope* and *app-scope* credentials. These deployment credentials are different from your Azure subscription credentials.
@@ -24,24 +26,26 @@ To access, set, or reset deployment user credentials, you must have **Contributo
24
26
25
27
To publish App Service apps via local Git or FTP/S, you must enable basic authentication. **SCM Basic Auth Publishing Credentials** and **FTP Basic Auth Publishing Credentials** must both be set to **On** on the app's **Configuration** page in the Azure portal.
26
28
27
-
Basic authentication is less secure than other authentication methods and is disabled by default for new apps. When basic authentication is disabled, you can't view or set deployment credentials in the app's **Deployment Center** or use these credentials for publishing. For more information, see [Disable basic authentication in Azure App Service deployments](configure-basic-auth-disable.md).
29
+
Basic authentication is less secure than other authentication methods and is disabled by default for new apps. If basic authentication is disabled, you can't view or set deployment credentials in the app's **Deployment Center** or use these credentials for publishing. For more information, see [Disable basic authentication in Azure App Service deployments](configure-basic-auth-disable.md).
28
30
29
31
<aname="userscope"></a>
30
32
## Set user-scope credentials
31
33
32
-
Both local Git and FTP/S deployment require a user name. The user name must be unique within Azure.
34
+
For FTP/S deployment, you need both a user name and a password. Local Git deployment requires a user name but not a password.
35
+
36
+
The user name must be unique within Azure. For local Git deployment, the user name can't contain the `@` character.
33
37
34
-
-For local Git, the user name can't contain the `@` character.
38
+
For FTP/S:
35
39
36
-
-To authenticate to an FTP/S endpoint, the user name must follow the format `<app-name>\<user-name>`. Since user-scope credentials are linked to the user and not to the app, the username must be in this format to direct the sign-in action to the correct FTP/S endpoint for the app.
40
+
-The user name must follow the format `<app-name>\<user-name>`. Since user-scope credentials are linked to the user and not to the app, the username must be in this format to direct the sign-in action to the correct FTP/S endpoint for the app.
37
41
38
-
For FTP/S deployment, you also need a password. The password must be at least eight characters and contain capital letters, lowercase letters, numbers, and symbols. The JSON output shows the password as `null`. Local Git deployment doesn't require a password.
42
+
-The password must be at least eight characters and contain capital letters, lowercase letters, numbers, and symbols. The JSON output from credential creation shows the password as `null`.
39
43
40
44
You can configure user-scope credentials by using Azure CLI or the Azure portal.
41
45
42
46
# [Azure CLI](#tab/cli)
43
47
44
-
To create user-scope credentials, run the [`az webapp deployment user set`](/cli/azure/webapp/deployment/user#az-webapp-deployment-user-set) command, replacing `<username>` and `<password>` with values you select.
48
+
To create user-scope credentials using Azure CLI, run the [`az webapp deployment user set`](/cli/azure/webapp/deployment/user#az-webapp-deployment-user-set) command, replacing `<username>` and `<password>` with values you select.
45
49
46
50
```azurecli-interactive
47
51
az webapp deployment user set --user-name <username> --password <password>
@@ -53,19 +57,17 @@ You can't create user-scope credentials by using Azure PowerShell. Use Azure CLI
53
57
54
58
# [Azure portal](#tab/portal)
55
59
56
-
You must have at least one app to set user-scope deployment credentials in the [Azure portal](https://portal.azure.com). You can use any app that has **SCM Basic Auth** and **FTP Basic Auth** enabled. The credentials then apply to all apps for all subscriptions in your Azure account that have **SCM Basic Auth** and **FTP Basic Auth** enabled.
57
-
58
-
To configure deployment credentials:
60
+
In the [Azure portal](https://portal.azure.com), you must have at least one app to use for setting user-scope credentials. The credentials then apply to all apps for all subscriptions in your Azure account that have **SCM Basic Auth** and **FTP Basic Auth** enabled.
59
61
60
62
1. Select **Deployment Center** under **Deployment** in the left navigation menu of an app.
61
63
1. Select the **FTPS credentials** tab, or if **Local Git** is configured as the build source, the **Local Git/FTPS credentials** tab.
62
64
1. In the **User-scope** section, add a **Username**.
63
-
1.For FTP/S deployments, add and confirm a **Password**.
65
+
1.Add and confirm a **Password**.
64
66
1. Select **Save**.
65
67
66
68
-----
67
69
68
-
After you set the credentials, you can see your deployment user name on your app's **Overview** page in the Azure portal. If local Git deployment is configured, the label is **Git/deployment username**. Otherwise, the label is **FTP/deployment username**.
70
+
After you set user-scope credentials, you can see your deployment user name on your app's **Overview** page in the Azure portal. If local Git deployment is configured, the label is **Git/Deployment username**. Otherwise, the label is **FTP/Deployment username**.
69
71
70
72
The portal doesn't show the password. If you forget your password, you can [reset your credentials](#reset-credentials) to get a new one.
71
73
@@ -74,7 +76,7 @@ The portal doesn't show the password. If you forget your password, you can [rese
74
76
<aname="appscope"></a>
75
77
## Get application-scope credentials
76
78
77
-
The application-scope credentials are automatically created with the app. The FTP/S app-scope user name always follows the format `app-name\$app-name`. The local Git user name uses the format `$app-name`.
79
+
The application-scope credentials are automatically created at app creation. The FTP/S app-scope user name always follows the format `app-name\$app-name`. The local Git user name uses the format `$app-name`.
78
80
79
81
>[!NOTE]
80
82
>When you use `git remote add` in shells that use the dollar sign for variable interpolation, such as Bash, you must use `\$` to escape any dollar signs in the username or password to avoid authentication errors.
@@ -83,7 +85,7 @@ You can get your app-scope credentials by using Azure CLI, Azure PowerShell, or
83
85
84
86
# [Azure CLI](#tab/cli)
85
87
86
-
Get the application-scope credentials by using the [`az webapp deployment list-publishing-profiles`](/cli/azure/webapp/deployment#az-webapp-deployment-list-publishing-profiles) command. For example:
88
+
In Azure CLI, get the application-scope credentials by using the [`az webapp deployment list-publishing-profiles`](/cli/azure/webapp/deployment#az-webapp-deployment-list-publishing-profiles) command. For example:
87
89
88
90
```azurecli-interactive
89
91
az webapp deployment list-publishing-profiles --resource-group myResourceGroup --name myApp
@@ -99,17 +101,17 @@ The returned Git remote URI doesn't have `/<app-name>.git` at the end. If you us
99
101
100
102
# [Azure PowerShell](#tab/powershell)
101
103
102
-
Get the application-scope credentials by using the [`Get-AzWebAppPublishingProfile`](/powershell/module/az.websites/get-azwebapppublishingprofile) command. For example:
104
+
In Azure PowerShell, get the application-scope credentials by using the [`Get-AzWebAppPublishingProfile`](/powershell/module/az.websites/get-azwebapppublishingprofile) command. For example:
To get the application-scope credentials in the Azure portal:
111
113
112
-
1.In the Azure portal, select**Deployment Center** under **Deployment** in the left navigation menu of your app.
114
+
1.Select**Deployment Center** under **Deployment** in the left navigation menu of your app.
113
115
1. On the **Deployment Center** page, select the **FTPS credentials** or **Local Git/FTPS credentials** tab.
114
116
1. In the **Application-scope** section, view the **FTPS username**, **Local Git username**, and **Password**. Select the copy icons to copy the values.
From the left navigation menu of your app in the Azure portal, select **Deployment Center**> **FTPS credentials** or **Local Git/FTPS credentials**.
152
+
In the Azure portal, select **Deployment Center**from your app's left navigation menu, and then select the **FTPS credentials** or **Local Git/FTPS credentials** tab.
151
153
152
154
- To reset your app-scope credentials and get a new password, select **Reset** at the bottom of the **Application-scope** section.
0 commit comments