Skip to content

Commit 619e088

Browse files
apwestgarthapwestgarth
authored
Initial commit of 25R1 release notes
1 parent bd03494 commit 619e088

File tree

1 file changed

+371
-0
lines changed

1 file changed

+371
-0
lines changed

‎azure-stack/operator/app-service-release-notes-2025R1.md

Lines changed: 371 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,371 @@
1+
---
2+
title: App Service on Azure Stack Hub 25R1 release notes
3+
description: Learn about what's new and updated in the App Service on Azure Stack Hub 25R1 release.
4+
author: apwestgarth
5+
ms.topic: article
6+
ms.date: 04/14/2025
7+
ms.author: anwestg
8+
ms.reviewer:
9+
---
10+
11+
# App Service on Azure Stack Hub 25R1 release notes
12+
13+
These release notes describe the improvements and fixes in Azure App Service on Azure Stack Hub 25R1 release notes and any known issues. Known issues are divided into issues directly related to the deployment, update process, and issues with the build (post-installation).
14+
15+
[!INCLUDE [Azure Stack Hub update reminder](../includes/app-service-hub-update-banner.md)]
16+
17+
## Build reference
18+
19+
The App Service on Azure Stack Hub 25R1 build number is **102.0.2.5**
20+
21+
## What's new?
22+
23+
Azure App Service on Azure Stack Hub 25 R1 brings new updates to Azure Stack Hub.
24+
25+
26+
## Prerequisites
27+
28+
See the [Before You Get Started documentation](azure-stack-app-service-before-you-get-started.md) before beginning deployment.
29+
30+
Before you begin the upgrade of Azure App Service on Azure Stack to 24R1:
31+
32+
- Ensure your Azure Stack Hub is updated to **1.2311.1.22** or later.
33+
- Ensure all roles are **Ready** in the Azure App Service Administration in the Azure Stack Hub admin portal.
34+
- Back up App Service Secrets using the App Service Administration in the Azure Stack Hub admin portal.
35+
- Back up the App Service and SQL Server master databases:
36+
- AppService_Hosting;
37+
- AppService_Metering;
38+
- Master
39+
40+
- Back up the Tenant App content file share.
41+
42+
> [!IMPORTANT]
43+
> Cloud operators are responsible for the maintenance and operation of the File Server and SQL Server. The resource provider does not manage these resources. The cloud operator is responsible for backing up the App Service databases and tenant content file share.
44+
45+
- Syndicate the Custom Script Extension version **1.9.3** from the Marketplace.
46+
47+
## Updates
48+
49+
Azure App Service on Azure Stack Update 24R1 includes the following improvements and fixes:
50+
51+
- Updates to App Service Tenant, Admin, Functions portals and Kudu tools. Consistent with the Azure Stack portal SDK version.
52+
- Updates Azure Functions runtime to **{xxxx}**.
53+
- Updates to core service to improve reliability and error messaging enabling easier diagnosis of common issues.
54+
- Updates to the following application frameworks and tools:
55+
- .NET Framework 4.8.1
56+
- ASP.NET Core
57+
- 8.0.7
58+
- 8.0.8
59+
- 6.0.29
60+
- Eclipse Temurin OpenJDK 8
61+
- 8u302
62+
- 8u312
63+
- 8u322
64+
- 8u332
65+
- 8u345
66+
- 8u362
67+
- 8u392
68+
- 8u412
69+
- 8u422
70+
- Microsoft OpenJDK 11
71+
- 11.0.12.7.1
72+
- 11.0.13.8
73+
- 11.0.14.1
74+
- 11.0.15.10
75+
- 11.0.16.1
76+
- 11.0.18.10
77+
- 11.0.21.9
78+
- 11.0.23.9
79+
- 11.0.24.8
80+
- Microsoft OpenJDK 17
81+
- 17.0.11.9
82+
- 17.0.1.12
83+
- 17.0.2.8
84+
- 17.0.3.7
85+
- 17.0.4.1
86+
- 17.0.6.1
87+
- 17.0.9.8
88+
- 17.0.12.7
89+
- Microsoft OpenJDK 21
90+
- 21.0.1.12
91+
- 21.0.3.9
92+
- 21.0.4.7
93+
- MSBuild
94+
- 15.9.21.664
95+
- 16.4.0
96+
- 16.7.0
97+
- 16.11.2
98+
- 17.11.2
99+
- MSDeploy
100+
- 3.5.120530.385
101+
- 2.5.1270717.34
102+
- NodeJS
103+
- 10.24.1
104+
- 12.22.12
105+
- 14.20.0
106+
- 16.16.0
107+
- 18.12.1
108+
- 18.19.1
109+
- 20.9.0
110+
- npm
111+
- 6.4.1
112+
- 6.13.4
113+
- 6.14.11
114+
- 6.14.12
115+
- 6.14.15
116+
- 6.14.16
117+
- 6.14.17
118+
- 7.21.1
119+
- 8.1.0
120+
- 8.19.2
121+
- 10.1.0
122+
- 10.2.4
123+
124+
- Tomcat
125+
- 8.5.20
126+
- 8.5.57
127+
- 8.5.58
128+
- 8.5.79
129+
- 8.5.82
130+
- 8.5.85
131+
- 8.5.96
132+
- 8.5.100
133+
- 9.0.0
134+
- 9.0.27
135+
- 9.0.31
136+
- 9.0.37
137+
- 9.0.63
138+
- 9.0.65
139+
- 9.0.71
140+
- 9.0.83
141+
- 9.0.91
142+
- 9.0.96
143+
- 10.0.21
144+
- 10.0.23
145+
- 10.0.27
146+
- 10.1.5
147+
- 10.1.16
148+
- 10.1.25
149+
- 10.1.31
150+
- 11.0.0
151+
- Git 2.43.0
152+
- Updated Kudu to 102.10502.001.
153+
- Continual accessibility and usability updates
154+
155+
- **Updates to underlying operating system of all roles**:
156+
- [2025-04 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KBxxxx)](https://support.microsoft.com/help/xxxx)
157+
- [2025-04 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Microsoft server operating system version 21H2 for x64 (KBxxx)](https://support.microsoft.com/help/xxxx)
158+
- Defender Definition xxxx
159+
160+
- **Cumulative Updates for Windows Server are now applied to Controller roles as part of deployment and upgrade**.
161+
162+
- Synchronization of Cipher Suites in place and preserves any modifications performed as result of customer intervention with support.
163+
164+
## Issues fixed in this release
165+
166+
- Some customers experienced database performance issues relating to locking of App Service Hosting tables, performance improvements are included this release.
167+
168+
- Ownership improvements in usage records service, to harden service when working with multiple roles and large number of workers
169+
170+
- Stuck windows updates due to continually attempting to apply Windows Server 2016 updates to Windows Server 2022 and vice versa
171+
172+
- Resolved issue whereby Windows Update KB5034439 would never complete and prevents roles moving to Ready state
173+
174+
- Installer failures resolved when customers using newer versions of the Custom Script Extension
175+
176+
- Trace messages from App Service roles were reviewed and trimmed to improve the quality of the information provided and to reduce the burden on the database
177+
178+
- Centralized SSL Certificate Support feature is installed on Front Ends as part of deployment and Tenants can bind certificates without Operator intervention
179+
180+
- Virtual Network Integration options are now disabled in portal by default.
181+
182+
- Resolved issues enabling blob storage for application logging
183+
184+
- Improved swap experience when swapping slots to prevent time-outs
185+
186+
- Change of description from Management Server to Management/Controller Roles in the choices for credential rotation to be more explicit about action being taken
187+
188+
## Pre-Update steps
189+
190+
- As of Azure App Service on Azure Stack Hub 2022 H1 Update, the letter K is now a reserved SKU Letter, if you have a custom SKU defined utilizing the letter K, contact support to assist resolving this situation before upgrading.
191+
192+
Review the [known issues for update](#known-issues-update) and take any action prescribed.
193+
194+
## Post-deployment steps
195+
196+
> [!IMPORTANT]
197+
> If you have provided the App Service resource provider with a SQL Always On Instance you MUST [add the appservice_hosting and appservice_metering databases to an availability group](/sql/database-engine/availability-groups/windows/availability-group-add-a-database) and synchronize the databases to prevent any loss of service in the event of a database failover.
198+
199+
## Known issues (update)
200+
201+
- **Application downtime should be expected during Upgrade.**
202+
203+
> [!IMPORTANT]
204+
>
205+
> Due to a change in communication format within the Web Farm, during the upgrade all roles move into repair mode until they match the same version as the controller. Due to this, we advise you to declare a maintenance window during this upgrade and prepare for application downtime during the upgrade.
206+
207+
- In situations where you converted the appservice_hosting and appservice_metering databases to contained database, upgrade might fail if logins weren't successfully migrated to contained users.
208+
209+
Customers that converted the appservice_hosting and appservice_metering databases to contained database post deployment, and didn't successfully migrate the database logins to contained users, might experience upgrade failures.
210+
211+
Customers must execute the following script against the SQL Server hosting appservice_hosting and appservice_metering before upgrading your Azure App Service on Azure Stack Hub installation to 2020 Q3. This script is non-destructive and does not cause downtime.
212+
213+
This script must be run under the following conditions:
214+
215+
- By a user that has the system administrator privilege, for example the SQL SA (System Administrator) Account;
216+
- If using SQL Always on, ensure the script is run from the SQL instance that contains all App Service logins in the form:
217+
- appservice_hosting_FileServer
218+
- appservice_hosting_HostingAdmin
219+
- appservice_hosting_LoadBalancer
220+
- appservice_hosting_Operations
221+
- appservice_hosting_Publisher
222+
- appservice_hosting_SecurePublisher
223+
- appservice_hosting_WebWorkerManager
224+
- appservice_metering_Common
225+
- appservice_metering_Operations
226+
- All WebWorker logins - which are in the form WebWorker_\<instance ip address\>
227+
228+
```sql
229+
USE appservice_hosting
230+
IF EXISTS(SELECT * FROM sys.databases WHERE Name=DB_NAME() AND containment = 1)
231+
BEGIN
232+
DECLARE @username sysname ;
233+
DECLARE user_cursor CURSOR
234+
FOR
235+
SELECT dp.name
236+
FROM sys.database_principals AS dp
237+
JOIN sys.server_principals AS sp
238+
ON dp.sid = sp.sid
239+
WHERE dp.authentication_type = 1 AND dp.name NOT IN ('dbo','sys','guest','INFORMATION_SCHEMA');
240+
OPEN user_cursor
241+
FETCH NEXT FROM user_cursor INTO @username
242+
WHILE @@FETCH_STATUS = 0
243+
BEGIN
244+
EXECUTE sp_migrate_user_to_contained
245+
@username = @username,
246+
@rename = N'copy_login_name',
247+
@disablelogin = N'do_not_disable_login';
248+
FETCH NEXT FROM user_cursor INTO @username
249+
END
250+
CLOSE user_cursor ;
251+
DEALLOCATE user_cursor ;
252+
END
253+
GO
254+
255+
USE appservice_metering
256+
IF EXISTS(SELECT * FROM sys.databases WHERE Name=DB_NAME() AND containment = 1)
257+
BEGIN
258+
DECLARE @username sysname ;
259+
DECLARE user_cursor CURSOR
260+
FOR
261+
SELECT dp.name
262+
FROM sys.database_principals AS dp
263+
JOIN sys.server_principals AS sp
264+
ON dp.sid = sp.sid
265+
WHERE dp.authentication_type = 1 AND dp.name NOT IN ('dbo','sys','guest','INFORMATION_SCHEMA');
266+
OPEN user_cursor
267+
FETCH NEXT FROM user_cursor INTO @username
268+
WHILE @@FETCH_STATUS = 0
269+
BEGIN
270+
EXECUTE sp_migrate_user_to_contained
271+
@username = @username,
272+
@rename = N'copy_login_name',
273+
@disablelogin = N'do_not_disable_login';
274+
FETCH NEXT FROM user_cursor INTO @username
275+
END
276+
CLOSE user_cursor ;
277+
DEALLOCATE user_cursor ;
278+
END
279+
GO
280+
```
281+
282+
- A new Redirect URL must be added to the identity application created in order to support Single Sign On(SSO) Scenarios (for example Kudu)
283+
284+
# [Entra ID](#tab/EntraID)
285+
286+
## Retrieve the Identity Application Client ID
287+
288+
1. In the Azure Stack admin portal, navigate to the **ControllersNSG** Network Security Group.
289+
1. By default, remote desktop access is disabled to all App Service infrastructure roles. Modify the **Inbound_Rdp_3389** rule action to **Allow** access.
290+
1. Navigate to the resource group containing the App Service Resource Provider deployment. By default, the resource group is named with the format `AppService.<region>`, and connected to **CN0-VM**.
291+
1. Launch the **Web Cloud Management Console**.
292+
1. Check the **Web Cloud Management Console -> Web Cloud** screen and verify that both **Controllers** are **Ready**.
293+
1. Select **Settings**.
294+
1. Find the **ApplicationClientId** setting. Retrieve the value.
295+
1. In the Azure Stack admin portal, navigate back to the **ControllersNSG** Network Security Group.
296+
1. Modify the **Inbound_Rdp_3389** rule to deny access.
297+
298+
## Update the Entra ID Application with new Redirect URI
299+
300+
1. Sign into the Azure portal to access the Entra ID tenant you connected your Azure Stack Hub to at deployment time.
301+
1. Using the Azure portal and navigate to **Microsoft Entra ID**.
302+
1. Search your tenant for the `ApplicationClientId` you retrieved earlier.
303+
1. Select the application.
304+
1. Select **Authentication**.
305+
1. Add another **Redirect URI** to the existing list: `https://azsstamp.sso.appservice.<region>.<DomainName>.<extension>`.
306+
307+
# [ADFS](#tab/ADFS)
308+
309+
## Retrieve the identity application
310+
311+
1. Open a [session to the Privileged Endpoint](azure-stack-privileged-endpoint.md).
312+
1. Run the following command to retrieve the AD FS Graph applications:
313+
314+
``` PowerShell
315+
Get-GraphApplication
316+
```
317+
318+
1. Find the identifier for the **AzureStack-AppService** application.
319+
1. Update the `RedirectURIs` for the application:
320+
321+
``` PowerShell
322+
$RedirectURIs = "@("https://appservice.sso.appservice.<region>.<DomainName>.<extension>", "https://azsstamp.sso.appservice.<region>.<DomainName>.<extension>", "https://api.appservice.<region>.<DomainName>.<extension>:44300/manage")
323+
Set-GraphApplication -ApplicationIdentifier <insert Identifier value> -ClientRedirectUris $RedirectURIs
324+
```
325+
326+
1. Close the Privileged Endpoint session.
327+
328+
---
329+
330+
## Known issues (post-installation)
331+
332+
- Workers are unable to reach file server when App Service is deployed in an existing virtual network, and the file server is only available on the private network, as called out in the Azure App Service on Azure Stack deployment documentation.
333+
334+
If you chose to deploy into an existing virtual network and an internal IP address to connect to your file server, you must add an outbound security rule, enabling SMB (Server Message Block) traffic between the worker subnet and the file server. Go to the WorkersNsg in the Admin Portal and add an outbound security rule with the following properties:
335+
- Source: Any
336+
- Source port range: *
337+
- Destination: IP Addresses
338+
- Destination IP address range: Range of IPs for your file server
339+
- Destination port range: 445
340+
- Protocol: TCP
341+
- Action: Allow
342+
- Priority: 700
343+
- Name: Outbound_Allow_SMB445
344+
345+
- To remove latency when workers are communicating with the file server, we also advise adding the following rule to the Worker NSG (Network Security Group) to allow outbound LDAP (Lightweight Directory Access Protocol) and Kerberos traffic to your Active Directory Controllers when securing the file server using Active Directory. For example, if you have used the Quickstart template to deploy a HA File Server and SQL Server.
346+
347+
Go to the WorkersNsg in the Admin Portal and add an outbound security rule with the following properties:
348+
- Source: Any
349+
- Source port range: *
350+
- Destination: IP Addresses
351+
- Destination IP address range: Range of IPs for your AD Servers, for example with the Quickstart template 10.0.0.100, 10.0.0.101
352+
- Destination port range: 389,88
353+
- Protocol: Any
354+
- Action: Allow
355+
- Priority: 710
356+
- Name: Outbound_Allow_LDAP_and_Kerberos_to_Domain_Controllers
357+
358+
### Known issues for Cloud Admins operating Azure App Service on Azure Stack
359+
360+
- Custom domains aren't supported in disconnected environments.
361+
362+
App Service performs domain ownership verification against public DNS (Domain Name System) endpoints. As a result, custom domains aren't supported in disconnected scenarios.
363+
364+
- Virtual Network integration for Web and Function Apps isn't supported.
365+
366+
The ability to add virtual network integration to Web and Function apps shows in the Azure Stack Hub portal and if a tenant attempts to configure, they receive an internal server error. This feature isn't supported in Azure App Service on Azure Stack Hub.
367+
368+
## Next steps
369+
370+
- For an overview of Azure App Service, see [Azure App Service on Azure Stack overview](azure-stack-app-service-overview.md).
371+
- For more information about how to prepare to deploy App Service on Azure Stack, see [Before you get started with App Service on Azure Stack](azure-stack-app-service-before-you-get-started.md).

0 commit comments

Comments
 (0)