Deploy ASP.NET Core to Azure App Service

1. App Service Plan = Your Azure Bill

Free F1: 60 min/day compute. Sleeps. Good for demo. Bad for users.
Basic B1: ~$13/month. Always on. No slots. No auto-scale.
Standard S1: ~$70/month. Has slots + 5 deploy slots. Minimum for prod.
Premium P1v3: ~$200/month. VNet, Private Endpoint, faster CPU.

2. Deploy in 3 Ways - Pick One

3. Deployment Slots = Zero Downtime

Problem: Deploy to prod. App restarts. Users see 502 for 30s.

Fix: 1. Deploy to staging slot. 2. Warm it up: hit myapp-staging.azurewebsites.net. 3. Click "Swap" with prod. Instant DNS switch. 0s downtime.

az webapp deployment slot swap -g rg -n myapp --slot staging --target-slot production

4. Secrets: Never in appsettings.json

Wrong: Commit "ConnectionStrings": {"Default": "Server=prod;..."} to git.
Right: Azure Portal → App Service → Configuration → Connection strings. Or Azure Key Vault.

Code: builder.Configuration.AddEnvironmentVariables() reads them. Name = ConnectionStrings__Default.

1. The Interview Theory: How Azure Runs Your App

Reality: App Service = Windows/Linux VM + IIS/Kestrel + Load Balancer. You rent a sandbox, not a server.

Startup: 1. ANCM starts dotnet MyApp.dll. 2. Kestrel listens on port from ASPNETCORE_URLS. 3. IIS/front-end routes public 80/443 to Kestrel.
Crash? Check Diagnose and solve problems → Application Logs. Or Kudu /LogFiles/eventlog.xml.

2. The #1 Interview Question: "Blue-Green Deploy in Azure?"

Your Answer: "Use Deployment Slots. Blue = prod slot. Green = staging slot. CI/CD deploys to staging. Run smoke tests on staging URL. If pass, swap slots. Swap is instant DNS change at load balancer. No app restart. If bug, swap back in 10s. For DB changes, use feature flags or backward-compatible migrations. Never run destructive migration before swap."

3. GitHub Actions CI/CD - Prod Ready

Azure Portal → Deployment Center → GitHub → Authorize. It generates this YAML:

name: Deploy to Azure
on: push: branches: [ main ]
jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Setup.NET
      uses: actions/setup-dotnet@v3
      with: dotnet-version: '8.0.x'
    - run: dotnet publish -c Release -o./publish
    - name: Deploy to Staging
      uses: azure/webapps-deploy@v2
      with:
        app-name: 'myapp'
        slot-name: 'staging'
        package:./publish
    - name: Swap to Prod
      run: az webapp deployment slot swap -g rg -n myapp --slot staging

4. Key Vault - Stop Hardcoding Secrets

Problem: Connection string in App Settings is visible to anyone with Azure read access.

Fix: 1. Create Key Vault. 2. Add secret DbConnection. 3. App Service → Identity → System Assigned → On. 4. Key Vault → Access Policies → Add App Service. 5. App Settings → Add ConnectionStrings__Default = @Microsoft.KeyVault(SecretUri=...).
Code: builder.Configuration.AddAzureKeyVault() with Managed Identity. Zero secrets in code.

5. Scale Rules - Don't Go Broke