• Liveness: /health/live
• Readiness: /health/ready

Liveness should stay independent from external dependencies. Readiness includes database connectivity.

Check:

• Authentication:Authority
• Authentication:Audience
• Entra app registration exposed API/audience
• Token issuer and audience claims

Check:

• App Service managed identity has a contained database user.
• Key Vault reference for ConnectionStrings--Default resolves.
• VNet integration is enabled.
• SQL private endpoint DNS resolves from the app.

Check:

• Staging slot configuration.
• Key Vault access for the slot managed identity.
• App Service runtime stack.
• Application Insights logs.

After infrastructure deployment, create a contained database user for the App Service managed identity from a network-authorized SQL session:

CREATE USER [<web-app-name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<web-app-name>];
ALTER ROLE db_datawriter ADD MEMBER [<web-app-name>];
ALTER ROLE db_ddladmin ADD MEMBER [<web-app-name>];

For least privilege, replace broad roles with migration-time and runtime-specific permissions once real features exist.