azure-deployment-operations

Azure Deployment Operations

Battle-tested patterns for deploying and operating Azure services in production.

Scope: Inheritable skill. Covers SWA, Container Apps, App Service, security posture, rate limiting, production checklists, and multi-subscription management.

Azure Static Web Apps (SWA)

Deployment Method

Prefer GitHub Actions over SWA CLI. SWA CLI v2.0.8 silently fails deploys (reports success, uploads nothing). Use Azure/static-web-apps-deploy@v1:

- uses: Azure/static-web-apps-deploy@v1
  with:
    azure_static_web_apps_api_token: ${{ secrets.SWA_DEPLOY_TOKEN }}
    repo_token: ${{ secrets.GITHUB_TOKEN }}
    action: upload
    app_location: dist          # adjust to your output folder
    skip_app_build: true        # if pre-built
    skip_api_build: true        # if using linked backend

Critical: If the SWA has a linked backend (Azure Functions via az staticwebapp backends link), do NOT include api_location — it creates embedded functions that override the linked backend.

Get the deploy token: az staticwebapp secrets list --name <name> --query "properties.apiKey" -o tsv

Environment Deployment

SWA defaults to preview environments. Always specify production explicitly in any CLI fallback:

swa deploy --env production

Custom Domain Registration

Custom domains require a two-step process:

Step	Action	Validates
1. CNAME record	Point domain to SWA default hostname	DNS ownership
2. Hostname registration	az staticwebapp hostname set	Azure binding

Common error: Adding CNAME but forgetting hostname registration. Both steps are required.

SWA Configuration

{
  "navigationFallback": {
    "rewrite": "/index.html",
    "exclude": ["/api/*", "/assets/*"]
  },
  "routes": [
    { "route": "/api/*", "allowedRoles": ["authenticated"] }
  ],
  "globalHeaders": {
    "X-Content-Type-Options": "nosniff",
    "X-Frame-Options": "DENY"
  }
}