Skip to content

Commit 8227741

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #18248 from apwestgarth/2025R1
2025 r1 Release Updates
2 parents 34e8108 + 8a54046 commit 8227741

File tree

5 files changed

+341
-960
lines changed

5 files changed

+341
-960
lines changed

‎azure-stack/includes/app-service-hub-update-banner.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ author: apwestgarth
33
ms.author: anwestg
44
ms.service: azure-stack
55
ms.topic: include
6-
ms.date: 01/31/2025
6+
ms.date: 06/25/2025
77
ms.reviewer: sethm
88
ms.lastreviewed: 10/28/2020
99
---
@@ -13,4 +13,4 @@ ms.lastreviewed: 10/28/2020
1313
>
1414
> | Supported minimum Azure Stack Hub version | App Service RP version |
1515
> |-----|---|
16-
> | 2311 and later | 24R1 [Installer](https://aka.ms/appsvcupdate24R1installer) ([release notes](../operator/app-service-release-notes-2024R1.md)) |
16+
> | 2311 and later | 25R1 [Installer](https://aka.ms/appsvcupdate25R1installer) 25R1 [Offline Package](https://aka.ms/appsvcupdate25R1offline) ([release notes](../operator/app-service-release-notes-2025R1.md)) |

‎azure-stack/operator/TOC.yml

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -386,16 +386,10 @@
386386
href: app-service-migrate-sql-server.md
387387
- name: Release notes
388388
items:
389+
- name: 25R1 release notes [June 2025]
390+
href: app-service-release-notes-2025R1.md
389391
- name: 24R1 release notes [December 2024]
390392
href: app-service-release-notes-2024R1.md
391-
- name: 2302 release notes [February 2023]
392-
href: app-service-release-notes-2302.md
393-
- name: 2022 H1 release notes [October 2022]
394-
href: app-service-release-notes-2022-h1.md
395-
- name: 2021 Q3 release notes [December 2021]
396-
href: app-service-release-notes-2021-Q3.md
397-
- name: 2021 Q1 release notes [June 2021]
398-
href: app-service-release-notes-2021-Q1.md
399393
- name: Azure Container Registry
400394
items:
401395
- name: Overview

‎azure-stack/operator/app-service-release-notes-2025r1.md

Lines changed: 299 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,299 @@
1+
---
2+
title: App Service on Azure Stack Hub 25R1 release notes
3+
description: Learn about what's new and updated in the App Service on Azure Stack Hub 25R1 release.
4+
author: apwestgarth
5+
ms.topic: article
6+
ms.date: 06/27/2025
7+
ms.author: anwestg
8+
ms.reviewer:
9+
---
10+
11+
# App Service on Azure Stack Hub 25R1 release notes
12+
13+
These release notes describe the improvements and fixes in Azure App Service on Azure Stack Hub 25R1 release notes and any known issues. Known issues are divided into issues directly related to the deployment, update process, and issues with the build (post-installation).
14+
15+
[!INCLUDE [Azure Stack Hub update reminder](../includes/app-service-hub-update-banner.md)]
16+
17+
## Build reference
18+
19+
The App Service on Azure Stack Hub 25R1 build number is **102.10.2.11**
20+
21+
## What's new?
22+
23+
Azure App Service on Azure Stack Hub 25 R1 brings new updates to Azure Stack Hub and builds on the previously released 24R1 ([24R1 Release Notes](app-service-release-notes-2024r1.md)). Customers can install 25R1 directly without deploying 24R1 first.
24+
25+
- Updates to .NET 8 and 9.
26+
- Updates to App Service on Azure Stack Hub Resource Provider.
27+
- Resolution to [issues customers encountered with 24R1](## Issues fixed in this release).
28+
29+
> [!IMPORTANT]
30+
> With Azure App Service on Azure Stack Hub 25R1 operators must deploy or update via the **Complete offline installation or upgrade** pathway. Download links are provided in the [deploy](azure-stack-app-service-deploy.md) or [update](azure-stack-app-service-update.md) documentation to the installer, helper scripts, and the offline package zip file.
31+
32+
## Prerequisites
33+
34+
See the [Before You Get Started documentation](azure-stack-app-service-before-you-get-started.md) before beginning deployment.
35+
36+
Before you begin the upgrade of Azure App Service on Azure Stack to 25R1:
37+
38+
- Ensure your Azure Stack Hub is updated to **1.2311.1.22** or later.
39+
- Ensure all roles are **Ready** in the Azure App Service Administration in the Azure Stack Hub admin portal.
40+
- Back up App Service Secrets using the App Service Administration in the Azure Stack Hub admin portal.
41+
- Back up the App Service and SQL Server master databases:
42+
- AppService_Hosting;
43+
- AppService_Metering;
44+
- Master
45+
46+
- Back up the Tenant App content file share.
47+
48+
> [!IMPORTANT]
49+
> Cloud operators are responsible for the maintenance and operation of the File Server and SQL Server. The resource provider doesn't manage these resources. The cloud operator is responsible for backing up the App Service databases and tenant content file share.
50+
51+
- Syndicate the Custom Script Extension version **1.9.3** from the Marketplace.
52+
53+
## Updates
54+
55+
Azure App Service on Azure Stack Update 25R1 includes the following improvements and fixes:
56+
57+
- Updates to App Service Tenant, Admin, Functions portals and Kudu tools. Consistent with the Azure Stack portal SDK version.
58+
- Updates Azure Functions runtime to **1.0.23001**.
59+
- Updates to core service to improve reliability and error messaging enabling easier diagnosis of common issues.
60+
- Updates to the following application frameworks and tools:
61+
- .NET Framework 3.5 and 4.8.1
62+
- ASP.NET Core
63+
- 9.0.3
64+
- 9.0.201
65+
- 8.0.407
66+
- 8.0.14
67+
- MSBuild
68+
- 17.12.0
69+
- MSDeploy
70+
- 3.5.140404
71+
- 3.5.140521
72+
- NodeJS
73+
- 10.15.2
74+
- 14.20.0
75+
- 16.16.0
76+
- 18.20.4
77+
- 18.20.7
78+
- 20.9.0
79+
- 20.18.3
80+
- 22.5.1
81+
- 22.14.0
82+
- npm
83+
- 6.4.1
84+
- 10.7.0
85+
- 10.8.2
86+
- 10.9.2
87+
- Git 2.46.0
88+
- VC14 Redistributable 14.40.33810
89+
- SQL Native Client 11.0.2100.60
90+
- Updated Kudu to 103.0.1.100
91+
- Continual accessibility and usability updates
92+
93+
- **Updates to underlying operating system of all roles**:
94+
- [2025-06 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5060526)](https://support.microsoft.com/help/5060526)
95+
- [2025-04 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Microsoft server operating system version 21H2 for x64 (KB5054693)](https://support.microsoft.com/help/5054693)
96+
- Definition updates for Windows Defender Antivirus and other Microsoft anti-malware 1.429.494.0
97+
98+
- **Cumulative Updates for Windows Server are now applied to Controller roles as part of deployment and upgrade**.
99+
100+
- Synchronization of Cipher Suites in place and preserves any modifications performed as result of customer intervention with support.
101+
102+
## Issues fixed in this release
103+
104+
Newly fixed issues in this release:
105+
106+
- Application downtime should no longer be expected during Upgrade. In 24R1, an issue caused significant downtime due to a change in communication format within the Web Farm during upgrade. The handling of the communication change was modified in this update, and doesn't cause downtime in 25R1.
107+
108+
- Resolution to issues faced with Role Based Access Control and Single Sign on to Kudu and SCM sites
109+
110+
- Further process improvements in usage records service, to more effectively handle failures and outages during usage record commits
111+
112+
- Resolved issues in Kudu where new runs of Web Jobs can't be started due to stalled jobs running
113+
114+
- Resolved issue when worker limits weren't checked when scaling out an App Service Plan using a deployment template
115+
116+
- Resolved issue where an invalid Data Service endpoint is set in configuration when all names in management server certificate are of wildcard format
117+
118+
- Enforced tcp prefix on all connection strings for the Resource Provider data plane and ensured all roles receive updated connection string during rotation
119+
120+
- Enabled Health Check Feature in Tenant Portal
121+
122+
## Pre-Update steps
123+
124+
- As of Azure App Service on Azure Stack Hub 2022 H1 Update, the letter K is now a reserved SKU Letter, if you have a custom SKU defined utilizing the letter K, contact support to assist resolving this situation before upgrading.
125+
126+
Review the [known issues for update](#known-issues-update) and take any action prescribed.
127+
128+
## Post-deployment steps
129+
130+
> [!IMPORTANT]
131+
> If App Service resource provider is configured with a SQL Always On Instance, you MUST [add the appservice_hosting and appservice_metering databases to an availability group](/sql/database-engine/availability-groups/windows/availability-group-add-a-database). Once added, you MUST synchronize the databases, to prevent any loss of service in the event of a database failover.
132+
133+
## Known issues (update)
134+
135+
- In situations where you converted the appservice_hosting and appservice_metering databases to contained database, upgrade might fail if logins weren't successfully migrated to contained users.
136+
137+
Customers that converted the appservice_hosting and appservice_metering databases to contained database post deployment, and didn't successfully migrate the database logins to contained users, might experience upgrade failures.
138+
139+
Customers must execute the following script against the SQL Server hosting appservice_hosting and appservice_metering before upgrading your Azure App Service on Azure Stack Hub installation to 2020 Q3. This script is nondestructive and doesn't cause downtime.
140+
141+
This script must be run under the following conditions:
142+
143+
- By a user that has the system administrator privilege, for example the SQL SA (System Administrator) Account;
144+
- If using SQL Always on, ensure the script is run from the SQL instance that contains all App Service logins in the form:
145+
- appservice_hosting_FileServer
146+
- appservice_hosting_HostingAdmin
147+
- appservice_hosting_LoadBalancer
148+
- appservice_hosting_Operations
149+
- appservice_hosting_Publisher
150+
- appservice_hosting_SecurePublisher
151+
- appservice_hosting_WebWorkerManager
152+
- appservice_metering_Common
153+
- appservice_metering_Operations
154+
- All WebWorker logins - which are in the form WebWorker_\<instance ip address\>
155+
156+
```sql
157+
USE appservice_hosting
158+
IF EXISTS(SELECT * FROM sys.databases WHERE Name=DB_NAME() AND containment = 1)
159+
BEGIN
160+
DECLARE @username sysname ;
161+
DECLARE user_cursor CURSOR
162+
FOR
163+
SELECT dp.name
164+
FROM sys.database_principals AS dp
165+
JOIN sys.server_principals AS sp
166+
ON dp.sid = sp.sid
167+
WHERE dp.authentication_type = 1 AND dp.name NOT IN ('dbo','sys','guest','INFORMATION_SCHEMA');
168+
OPEN user_cursor
169+
FETCH NEXT FROM user_cursor INTO @username
170+
WHILE @@FETCH_STATUS = 0
171+
BEGIN
172+
EXECUTE sp_migrate_user_to_contained
173+
@username = @username,
174+
@rename = N'copy_login_name',
175+
@disablelogin = N'do_not_disable_login';
176+
FETCH NEXT FROM user_cursor INTO @username
177+
END
178+
CLOSE user_cursor ;
179+
DEALLOCATE user_cursor ;
180+
END
181+
GO
182+
183+
USE appservice_metering
184+
IF EXISTS(SELECT * FROM sys.databases WHERE Name=DB_NAME() AND containment = 1)
185+
BEGIN
186+
DECLARE @username sysname ;
187+
DECLARE user_cursor CURSOR
188+
FOR
189+
SELECT dp.name
190+
FROM sys.database_principals AS dp
191+
JOIN sys.server_principals AS sp
192+
ON dp.sid = sp.sid
193+
WHERE dp.authentication_type = 1 AND dp.name NOT IN ('dbo','sys','guest','INFORMATION_SCHEMA');
194+
OPEN user_cursor
195+
FETCH NEXT FROM user_cursor INTO @username
196+
WHILE @@FETCH_STATUS = 0
197+
BEGIN
198+
EXECUTE sp_migrate_user_to_contained
199+
@username = @username,
200+
@rename = N'copy_login_name',
201+
@disablelogin = N'do_not_disable_login';
202+
FETCH NEXT FROM user_cursor INTO @username
203+
END
204+
CLOSE user_cursor ;
205+
DEALLOCATE user_cursor ;
206+
END
207+
GO
208+
```
209+
210+
- A new Redirect URL must be added to the identity application created in order to support Single Sign On(SSO) Scenarios (for example Kudu)
211+
212+
# [Entra ID](#tab/EntraID)
213+
214+
## Retrieve the Identity Application Client ID
215+
216+
1. In the Azure Stack admin portal, navigate to the **ControllersNSG** Network Security Group.
217+
1. By default, remote desktop access is disabled to all App Service infrastructure roles. Modify the **Inbound_Rdp_3389** rule action to **Allow** access.
218+
1. Navigate to the resource group containing the App Service Resource Provider deployment. By default, the resource group is named with the format `AppService.<region>`, and connected to **CN0-VM**.
219+
1. Launch the **Web Cloud Management Console**.
220+
1. Check the **Web Cloud Management Console -> Web Cloud** screen and verify that both **Controllers** are **Ready**.
221+
1. Select **Settings**.
222+
1. Find the **ApplicationClientId** setting. Retrieve the value.
223+
1. In the Azure Stack admin portal, navigate back to the **ControllersNSG** Network Security Group.
224+
1. Modify the **Inbound_Rdp_3389** rule to deny access.
225+
226+
## Update the Entra ID Application with new Redirect URI
227+
228+
1. Sign into the Azure portal to access the Entra ID tenant you connected your Azure Stack Hub to at deployment time.
229+
1. Use the Azure portal, and navigate to **Microsoft Entra ID**.
230+
1. Search your tenant for the `ApplicationClientId` you retrieved earlier.
231+
1. Select the application.
232+
1. Select **Authentication**.
233+
1. Add another **Redirect URI** to the existing list: `https://azsstamp.sso.appservice.<region>.<DomainName>.<extension>`.
234+
235+
# [ADFS](#tab/ADFS)
236+
237+
## Retrieve the identity application
238+
239+
1. Open a [session to the Privileged Endpoint](azure-stack-privileged-endpoint.md).
240+
1. Run the following command to retrieve the AD FS Graph applications:
241+
242+
``` PowerShell
243+
Get-GraphApplication
244+
```
245+
246+
1. Find the identifier for the **AzureStack-AppService** application.
247+
1. Update the `RedirectURIs` for the application:
248+
249+
``` PowerShell
250+
$RedirectURIs = "@("https://appservice.sso.appservice.<region>.<DomainName>.<extension>", "https://azsstamp.sso.appservice.<region>.<DomainName>.<extension>", "https://api.appservice.<region>.<DomainName>.<extension>:44300/manage")
251+
Set-GraphApplication -ApplicationIdentifier <insert Identifier value> -ClientRedirectUris $RedirectURIs
252+
```
253+
254+
1. Close the Privileged Endpoint session.
255+
256+
---
257+
258+
## Known issues (post-installation)
259+
260+
- Worker instances are unable to reach file server when App Service is deployed in an existing virtual network. The file server is only available on the private network, as called out in the Azure App Service on Azure Stack deployment documentation.
261+
262+
During initial deployment, if you chose to deploy into an existing virtual network and use an internal IP address to connect to your file server. You must add an outbound security rule, enabling SMB (Server Message Block) traffic between the worker subnet, and the file server. Go to the WorkersNsg in the Admin Portal and add an outbound security rule with the following properties:
263+
- Source: Any
264+
- Source port range: *
265+
- Destination: IP Addresses
266+
- Destination IP address range: Range of IPs for your file server
267+
- Destination port range: 445
268+
- Protocol: TCP
269+
- Action: Allow
270+
- Priority: 700
271+
- Name: Outbound_Allow_SMB445
272+
273+
- To remove latency when worker instances are communicating with the file server, we also advise adding the following rule to the Worker NSG (Network Security Group). This rule allows outbound LDAP (Lightweight Directory Access Protocol) and Kerberos traffic to your Active Directory Controllers when securing the file server using Active Directory. For example, if you used the Quickstart template to deploy a HA File Server and SQL Server.
274+
275+
Go to the WorkersNsg in the Admin Portal and add an outbound security rule with the following properties:
276+
- Source: Any
277+
- Source port range: *
278+
- Destination: IP Addresses
279+
- Destination IP address range: Range of IPs for your AD Servers, for example with the Quickstart template 10.0.0.100, 10.0.0.101
280+
- Destination port range: 389,88
281+
- Protocol: Any
282+
- Action: Allow
283+
- Priority: 710
284+
- Name: Outbound_Allow_LDAP_and_Kerberos_to_Domain_Controllers
285+
286+
### Known issues for Cloud Admins operating Azure App Service on Azure Stack
287+
288+
- Custom domains aren't supported in disconnected environments.
289+
290+
App Service performs domain ownership verification against public DNS (Domain Name System) endpoints. As a result, custom domains aren't supported in disconnected scenarios.
291+
292+
- Virtual Network integration for Web and Function Apps isn't supported.
293+
294+
The ability to add virtual network integration to Web and Function apps shows in the Azure Stack Hub portal and if a tenant attempts to configure, they receive an internal server error. This feature isn't supported in Azure App Service on Azure Stack Hub.
295+
296+
## Next steps
297+
298+
- For an overview of Azure App Service, see [Azure App Service on Azure Stack overview](azure-stack-app-service-overview.md).
299+
- For more information about how to prepare to deploy App Service on Azure Stack, see [Before you get started with App Service on Azure Stack](azure-stack-app-service-before-you-get-started.md).

0 commit comments

Comments
 (0)