You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/configure-authentication-customize-sign-in-out.md
+32-25Lines changed: 32 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,10 +2,11 @@
2
2
title: Customize Sign-ins and Sign-outs
3
3
description: Use the built-in authentication and authorization in Azure App Service and at the same time customize the sign-in and sign-out behavior.
4
4
ms.topic: how-to
5
-
ms.date: 07/08/2024
5
+
ms.date: 04/03/2025
6
6
ms.custom: AppServiceIdentity
7
7
author: cephalin
8
8
ms.author: cephalin
9
+
#customer intent: As an app developer, I want to customize my sign-in and sign-out options to provide links to different providers and to enhance the user experience in Azure App Service.
9
10
---
10
11
11
12
# Customize sign-ins and sign-outs in Azure App Service authentication
@@ -14,13 +15,15 @@ This article shows you how to customize user sign-ins and sign-outs while using
14
15
15
16
## Use multiple sign-in providers
16
17
17
-
The Azure portal configuration doesn't offer a turnkey way to present multiple sign-in providers to your users (such as both Facebook and X). To add the functionality of using multiple sign-in providers to your app:
18
+
The Azure portal configuration doesn't offer a turnkey way to present multiple sign-in providers to your users. For instance, you might want to offer both Facebook and X as options. To add multiple sign-in providers to your app:
18
19
19
-
1. In the Azure portal, on the **Authentication / Authorization** page, configure each identity provider that you want to enable.
20
+
1. In the Azure portal, in your web app, select **Settings** > **Authentication**.
20
21
21
-
1.In**Action to take when request is not authenticated**, select **Allow Anonymous requests (no action)**.
1. On the sign-in page, or the navigation bar, or any other location of your app, add a sign-in link to each of the providers that you enabled (`/.auth/login/<provider>`). For example:
24
+
1. For **Restrict access**, select **Allow unauthenticated access**.
25
+
26
+
1. On the sign-in page, the navigation bar, or any other location in your app, add a sign-in link to each of the providers that you enabled (`/.auth/login/<provider>`). For example:
24
27
25
28
```html
26
29
<ahref="/.auth/login/aad">Log in with Microsoft Entra</a>
@@ -32,19 +35,22 @@ The Azure portal configuration doesn't offer a turnkey way to present multiple s
32
35
33
36
When the user selects one of the links, the respective page opens for sign-in.
34
37
35
-
To redirect the user to a custom URL after sign-in, use the `post_login_redirect_uri` query string parameter. (Don't confuse this parameter with the redirect URI in your identity provider configuration.) For example, to move the user to `/Home/Index` after sign-in, use the following HTML code:
38
+
To redirect the user to a custom URL after sign-in, use the `post_login_redirect_uri` query string parameter. For example, to move the user to `/Home/Index` after sign-in, use the following HTML code:
> Don't confuse this value with the redirect URI in your identity provider configuration.
46
+
41
47
## <aname = "client-directed-sign-in"></a> Use client-directed sign-in
42
48
43
-
In a client-directed sign-in, the application signs in the user to the identity provider by using a provider-specific SDK. The application code then submits the resulting authentication token to App Service for validation (see [Authentication flow](overview-authentication-authorization.md#authentication-flow)) by using an HTTP `POST` request. This validation itself doesn't grant users access to the desired app resources, but a successful validation gives users a session token that they can use to access app resources.
49
+
In a client-directed sign-in, the application signs in the user to the identity provider by using a provider-specific SDK. The application code then submits the resulting authentication token to App Service for validation by using an HTTP `POST` request. This validation itself doesn't grant users access to the desired app resources. A successful validation gives users a session token that they can use to access app resources. For more information, see [Authentication flow](overview-authentication-authorization.md#authentication-flow).
44
50
45
51
To validate the provider token, the App Service app must first be configured with the desired provider. At runtime, after you retrieve the authentication token from your provider, post the token to `/.auth/login/<provider>` for validation. For example:
46
52
47
-
```
53
+
```https
48
54
POST https://<appname>.azurewebsites.net/.auth/login/aad HTTP/1.1
The token format varies slightly according to the provider:
55
61
56
62
| Provider value | Required in request body | Comments |
57
-
|-|-|-|
63
+
|:-|:-|:-|
58
64
|`aad`|`{"access_token":"<access_token>"}`| The `id_token`, `refresh_token`, and `expires_in` properties are optional. |
59
65
|`google`|`{"id_token":"<id_token>"}`| The `authorization_code` property is optional. Providing an `authorization_code` value adds an access token and a refresh token to the token store. When you specify `authorization_code`, you can optionally accompany it with a `redirect_uri` property. |
60
66
|`facebook`|`{"access_token":"<user_access_token>"}`| Use a valid [user access token](https://developers.facebook.com/docs/facebook-login/access-tokens) from Facebook. |
> The GitHub provider for App Service authentication does not support customized sign-in and sign-out.
70
+
> The GitHub provider for App Service authentication doesn't support customized sign-in and sign-out.
66
71
67
-
If the provider token is validated successfully, the API returns with an `authenticationToken` value in the response body. This value is your session token. To get more information on the user claims, see [Work with user identities in Azure App Service authentication](configure-authentication-user-identities.md).
72
+
If the provider token is validated successfully, the API returns with an `authenticationToken` value in the response body. This value is your session token. For more information on user claims, see [Work with user identities in Azure App Service authentication](configure-authentication-user-identities.md).
68
73
69
74
```json
70
75
{
@@ -77,7 +82,7 @@ If the provider token is validated successfully, the API returns with an `authen
77
82
78
83
After you have this session token, you can access protected app resources by adding the `X-ZUMO-AUTH` header to your HTTP requests. For example:
79
84
80
-
```
85
+
```https
81
86
GET https://<appname>.azurewebsites.net/api/products/1
82
87
X-ZUMO-AUTH: <authenticationToken_value>
83
88
```
@@ -88,7 +93,7 @@ Users can initiate a sign-out by sending a `GET` request to the app's `/.auth/lo
88
93
89
94
- Clears authentication cookies from the current session.
90
95
- Deletes the current user's tokens from the token store.
91
-
-For Microsoft Entra and Google, performs a server-side sign-out on the identity provider.
96
+
-Performs a server-side sign-out on the identity provider for Microsoft Entra and Google.
92
97
93
98
Here's a simple sign-out link on a webpage:
94
99
@@ -98,15 +103,15 @@ Here's a simple sign-out link on a webpage:
98
103
99
104
By default, a successful sign-out redirects the client to the URL `/.auth/logout/complete`. You can change the post-sign-out redirect page by adding the `post_logout_redirect_uri` query parameter. For example:
100
105
101
-
```
106
+
```https
102
107
GET /.auth/logout?post_logout_redirect_uri=/index.html
103
108
```
104
109
105
110
We recommend that you [encode](https://wikipedia.org/wiki/Percent-encoding) the value of `post_logout_redirect_uri`.
106
111
107
-
When you're using fully qualified URLs, the URL must be either hosted in the same domain or configured as an allowed external redirect URL for your app. The following example redirects to an `https://myexternalurl.com` URL that's not hosted in the same domain:
112
+
When you use fully qualified URLs, the URL must be hosted in the same domain or configured as an allowed external redirect URL for your app. The following example redirects to an `https://myexternalurl.com` URL that's not hosted in the same domain:
108
113
109
-
```
114
+
```https
110
115
GET /.auth/logout?post_logout_redirect_uri=https%3A%2F%2Fmyexternalurl.com
111
116
```
112
117
@@ -156,19 +161,21 @@ This setting appends the `domain_hint` query string parameter to the sign-in red
156
161
157
162
## Authorize or deny users
158
163
159
-
App Service takes care of the simplest authorization case (for example, reject unauthenticated requests). But your app might require more fine-grained authorization behavior, such as limiting access to only a specific group of users.
164
+
App Service takes care of the simplest authorization case, for example, reject unauthenticated requests. Your app might require more fine-grained authorization behavior, such as limiting access to only a specific group of users.
160
165
161
-
In certain cases, you need to write custom application code to allow or deny access to the signed-in user. In other cases, App Service or your identity provider might be able to help without requiring code changes.
166
+
You might need to write custom application code to allow or deny access to the signed-in user. In some cases, App Service or your identity provider might be able to help without requiring code changes.
162
167
163
168
### Server level (Windows apps only)
164
169
165
-
For any Windows app, you can define authorization behavior of the IIS web server by editing the `Web.config` file. Linux apps don't use IIS and can't be configured through `Web.config`.
170
+
For any Windows app, you can define authorization behavior of the IIS web server by editing the `web.config` file. Linux apps don't use IIS and can't be configured through `web.config`.
171
+
172
+
1. To go to the Kudu debug console for your app, select **Development Tools** > **Advanced Tools** and select **Go**. Then select **Debug console**.
166
173
167
-
1. Go to `https://<app-name>.scm.azurewebsites.net/DebugConsole`.
174
+
You can also open this page with this URL: `https://<app-name>-<random-hash>.scm.<region>.azurewebsites.net/DebugConsole`. To get the random hash and region values, in your app **Overview**, copy **Default domain**.
168
175
169
-
1. In the browser explorer of your App Service files, go to `site/wwwroot`. If `Web.config` doesn't exist, create it by selecting **+** > **New File**.
176
+
1. In the browser explorer of your App Service files, go to `site/wwwroot`. If `web.config` doesn't exist, create it by selecting **+** > **New File**.
170
177
171
-
1. Select the pencil for `Web.config` to edit the file. Add the following configuration code, and then select **Save**. If `Web.config` already exists, just add the `<authorization>` element with everything in it. In the `<allow>` element, add the accounts that you want to allow.
178
+
1. Select the pencil for `web.config` to edit the file. Add the following configuration code, and then select **Save**. If `web.config` already exists, just add the `<authorization>` element with everything in it. In the `<allow>` element, add the accounts that you want to allow.
172
179
173
180
```xml
174
181
<?xml version="1.0" encoding="utf-8"?>
@@ -186,8 +193,8 @@ For any Windows app, you can define authorization behavior of the IIS web server
186
193
187
194
The identity provider might provide certain turnkey authorization. For example:
188
195
189
-
- You can [manage enterprise-level access](../active-directory/manage-apps/what-is-access-management.md) directly in Microsoft Entra. For instructions, see [Remove user access to applications](../active-directory/manage-apps/methods-for-removing-user-access.md).
190
-
- For [Google](configure-authentication-provider-google.md), Google API projects that belong to an [organization](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy#organizations) can be configured to allow access only to users in your organization. See the [Manage OAuth Clients](https://support.google.com/cloud/answer/6158849?hl=en) Google support page.
196
+
- For Microsoft Entra, you can [manage enterprise-level access](../active-directory/manage-apps/what-is-access-management.md) directly. For more information, see [Remove user access to applications](../active-directory/manage-apps/methods-for-removing-user-access.md).
197
+
- For [Google](configure-authentication-provider-google.md), Google API projects that belong to an [organization](https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy#organizations) can be configured to allow access only to users in your organization. For more information, see [Manage OAuth Clients](https://support.google.com/cloud/answer/6158849?hl=en).
Copy file name to clipboardExpand all lines: articles/azure-functions/migration/discover-lambda-workloads.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: "Stage 1: Discover Workloads to Migrate from AWS Lambda to Azure Functions"
2
+
title: Discover AWS Lambda Workloads to Migrate to Azure Functions
3
3
description: Learn how to conduct a detailed discovery process to inventory current AWS Lambda workloads, including their configuration, dependencies, and usage patterns.
4
4
author: MadhuraBharadwaj-MSFT
5
5
ms.author: mabhar
@@ -11,7 +11,7 @@ ms.date: 03/18/2025
11
11
12
12
# Stage 1: Discover workloads to migrate from AWS Lambda to Azure Functions
13
13
14
-
In this stage, you conduct a detailed discovery process to evaluate existing AWS Lambda workloads, including their configuration, dependencies, and usage patterns.
14
+
In this stage, you conduct a detailed discovery process to evaluate existing AWS Lambda workloads, including their configuration, dependencies, and usage patterns. The goal is to understand which AWS features and services your workload relies on.
15
15
16
16
## Evaluate your current workload
17
17
@@ -36,6 +36,7 @@ Compile a comprehensive inventory of your AWS Lambda functions by using familiar
36
36
- Identify virtual private cloud configurations, including subnets, security groups, and NAT gateway dependencies, if applicable.
37
37
38
38
### Tooling
39
+
39
40
- List the continuous integration and continuous delivery tools and deployment frameworks that each function uses, such as AWS SAM, Serverless Framework, or custom pipelines.
40
41
41
42
- Document build and packaging tools, including testing frameworks and staging workflows.
@@ -73,4 +74,4 @@ This detailed inventory is the foundation for the next stage, where you assess t
Copy file name to clipboardExpand all lines: articles/azure-functions/migration/migrate-lambda-workloads-overview.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,9 +11,9 @@ ms.date: 03/18/2025
11
11
12
12
# Migrate AWS Lambda to Azure Functions
13
13
14
-
This article provides an overview of how to migrate serverless applications from AWS Lambda to Azure Functions.
14
+
This article provides an overview of how to migrate serverless applications from AWS Lambda to Azure Functions. Learn about Functions features, and understand the stages of migration so that you can migrate your workload efficiently.
15
15
16
-
## Introduction to Azure Functions
16
+
## Introduction to Azure Functions
17
17
18
18
Azure Functions provides serverless compute resources in Azure by enabling you to run event-driven code without provisioning or managing infrastructure. The Flex Consumption hosting plan for Functions is equivalent to Lambda's consumption-based model. It provides network integration to meet enterprise governance needs alongside serverless implementation. AWS Lambda and Azure Functions share similar features like automatic resource provisioning, scaling, and pay-per-use pricing models. Functions also supports dedicated hosting modes, taking advantage of its highly portable runtime to run in various environments. Functions provides unique benefits, such as a versatile programming model that has rich triggers and bindings, scaling models, concurrency control, and runtime support.
19
19
@@ -46,4 +46,4 @@ During this stage, you perform these steps to adapt function code, deploy and te
46
46
Let's get started migrating your AWS Lambda code to Azure Functions:
Copy file name to clipboardExpand all lines: articles/azure-functions/migration/migrate-lambda-workloads.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: "Stage 3: Migrate Workloads from AWS Lambda to Azure Functions"
2
+
title: Migrate Workloads from AWS Lambda to Azure Functions
3
3
description: Learn about the steps to complete your AWS Lambda to Azure Functions migration, test performance, optimize operations, and implement monitoring.
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments