Mapping a Custom Domain
High-level process:
- In Azure Portal → App Service → Custom domains → Add custom domain
- Enter your domain name (e.g., www.contoso.com)
- Azure tells you which DNS records to create
- Create those records in your DNS provider
- Azure verifies the records and maps the domain
- Add an SSL certificate for the domain
Minimum Tier for Custom Domains Custom domain mapping requires Basic tier or above. Free and Shared tiers do NOT support custom domains (Free has no domain support at all; Shared supports it with limitations).
CNAME vs A Record
| CNAME Record | A Record | |
|---|---|---|
| Maps | Hostname → another hostname | Hostname → IP address |
| Usage | www.contoso.com → myapp.azurewebsites.net | @ (root domain) → App Service IP |
| Zone apex? | ❌ Not allowed at zone apex (contoso.com) | ✅ Required for zone apex |
| IP changes? | Follows automatically | Must update if IP changes |
| Recommended for | www subdomain and all subdomains | Root domain only |
Avoid A Records When Possible App Service IP addresses can change (e.g., when scaling or migrating). CNAME records automatically follow the hostname — A records need manual updating. Use CNAME for www and subdomains. Only use A records when you must point the root domain (and keep the IP backed up).
Domain Verification
To prove you own the domain, Azure requires you to create a TXT verification record in addition to the CNAME/A record:
- Record type: TXT
- Name:
asuid.www(for www.contoso.com) - Value: App Service's unique Domain Verification ID (shown in the portal)
Free App Service Managed Certificates
App Service provides free SSL certificates for custom domains — provisioned and renewed automatically by Microsoft. No cost, no manual renewal.
Getting a Free Certificate
- App Service → TLS/SSL settings → Private Key Certificates → Create App Service Managed Certificate
- Select the custom domain
- Certificate is provisioned automatically (takes a few minutes)
- Bind the certificate to the domain
Managed Certificate Limitations
- Only for custom subdomains (www.contoso.com) — NOT root domains (contoso.com)
- Cannot be exported
- Not available on Free or Shared tiers
- Does not support wildcard certificates (*.contoso.com)
Root Domain + Managed Cert Workaround Managed certs don't work for root domains. Options: (1) Use Azure Front Door or CDN in front — these support root domain HTTPS. (2) Buy a certificate from a CA. (3) Use App Service Domain (Azure-managed domain) which includes a wildcard cert.
Bring Your Own Certificate
Upload your own SSL certificate (PFX format) when you need:
- Wildcard certificate (*.contoso.com) for all subdomains
- Root domain certificate
- Extended Validation (EV) certificate
- Certificate from a specific CA for compliance
Azure CLIUpload and bind a custom certificate
# Upload PFX certificate
az webapp config ssl upload \
--certificate-file mycert.pfx \
--certificate-password "CertPassword123!" \
--name mywebapp-2026 \
--resource-group myRG
# Bind to custom domain
az webapp config ssl bind \
--certificate-thumbprint \
--ssl-type SNI \
--name mywebapp-2026 \
--resource-group myRG SNI SSL vs IP-Based SSL
| SNI SSL | IP-Based SSL | |
|---|---|---|
| How | Uses TLS Server Name Indication — no dedicated IP | Assigns a dedicated inbound IP |
| Cost | Included in plan cost | Additional charge per binding |
| Multiple certs | ✅ Multiple certificates on same IP | One certificate per IP |
| Recommended? | ✅ Yes — for almost all use cases | Only if you need a dedicated IP |
Enforcing HTTPS
Enable "HTTPS Only" to redirect all HTTP traffic to HTTPS automatically. This should always be enabled for production apps.
Azure CLIEnforce HTTPS
# Force HTTPS redirect
az webapp update \
--name mywebapp-2026 \
--resource-group myRG \
--https-only trueMinimum TLS Version
Configure the minimum TLS version to reject older, less secure connections. TLS 1.2 is the recommended minimum — TLS 1.0 and 1.1 are deprecated.
Azure CLISet minimum TLS version to 1.2
# Set minimum TLS to 1.2
az webapp config set \
--name mywebapp-2026 \
--resource-group myRG \
--min-tls-version 1.2AZ-104 Exam Tip Know that Free managed certificates don't work for root domains or wildcards. Know that CNAME cannot be used at the zone apex. Know that SNI SSL is recommended over IP-based SSL. Know that HTTPS Only redirects HTTP to HTTPS. Know minimum TLS 1.2 is best practice.