Azure Deployment Guide

End-to-end steps for deploying SonWinCommonAPI to Azure: Entra ID app registrations, App Service setup, networking, and a Postman verify.

Prerequisites

• SQL Server running on an Azure VM
• The VM is connected to a Virtual Network (VNet)

1. Register SonWinCommonAPI in Entra ID

1. Entra ID → App registrations → New registration

   • Name: SonWinCommonAPI
   • Supported account types: Single tenant
   • No redirect URI needed

2. Note the Application (client) ID and Directory (tenant) ID — they go into the App Service env vars (§4).

3. Expose an API:

   • Set the Application ID URI (accept default: api://<client-id>)

4. App roles → Create app role:

   • Display name: Access
   • Allowed member types: Applications
   • Value: Access
   • Description: Allows the application to access SonWinCommonAPI
   • Enable the role

2. Register the calling app in Entra ID

For each app that needs to call SonWinCommonAPI (e.g. egu-common-api):

1. Entra ID → App registrations → New registration

   • Name: egu-common-api
   • Single tenant, no redirect URI

2. Certificates & secrets → New client secret — copy the value immediately

3. API permissions → Add a permission → APIs my organization uses → SonWinCommonAPI

   • Choose Application permissions
   • Select the Access app role
   • Click Add permissions

4. Click Grant admin consent for <tenant>

3. Create the Web App

In the Azure Portal, create a new Web App:

• Publish: Code
• Runtime: .NET 10
• Region: Same as the VM
• Connect to the VNet in the creation wizard if prompted

4. Configure environment variables

In App Service → Settings → Environment variables:

Connection strings tab:

Use the VM's private IP, not the public IP.

Application settings tab:

These tell the API which tenant issued tokens must come from and which audience (aud claim) to accept. The calling app keeps its own config (client ID, secret, target scope api://<SonWinCommonAPI-client-id>/.default, tenant ID) on its side.

5. VNet integration

In App Service → Settings → Networking → VNet Integration:

1. Select the same VNet as the VM
2. The default subnet cannot be shared — create a new subnet in the VNet first:
   • Go to Virtual Network → Subnets → + Subnet
   • Name: appservice-subnet (or similar)
   • Accept default address range
3. Select the new subnet in VNet Integration

6. NSG rule for SQL Server

On the VM's Network Security Group, find the existing inbound rule for port 1433 and update the Source to include the IP range of appservice-subnet:

• Port: 1433
• Source: IP address range of appservice-subnet (found in Virtual Network → Subnets → appservice-subnet)
• Action: Allow

7. Deploy from Visual Studio

1. Right-click the project → Publish, or use Build → Publish
2. Select Azure App Service
3. Options:
   • Deploy as ZipPackage: Yes
   • Basic Authentication: No
   • API Management: Skip
4. Click Publish

8. Verify with Postman

In Postman, under Authorization → OAuth 2.0 → Get New Access Token:

• Grant Type: Client Credentials
• Access Token URL: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
• Client ID: egu-common-api's client ID
• Client Secret: egu-common-api's secret
• Scope: api://<SonWinCommonAPI-client-id>/.default

Click Get New Access Token, then call an endpoint with it:

GET https://<app-service-url>/bright/accounts
Authorization: Bearer <token>

To test connectivity from the App Service to SQL Server, use the console (App Service → Development Tools → Console):

tcpping <private-ip>:1433