# Deploy Python Apps to Azure App Service

Deploying Python applications to Azure App Service requires coordinated resource, runtime, packaging, and startup settings. This skill guides Azure CLI or azd deployment for Linux web apps.

## Install

```bash
npx skillstore add microsoft/python-appservice-deploy
```

## Metadata

- Status: approved
- Slug: microsoft-python-appservice-deploy
- Version: 1.0.1
- Author version: 1.0.1
- Skillstore revision: r2
- Version status: valid
- Tree hash: 9f5ba3173880504ff0b50fcda1c5e0107253aa43c8608eb4b74246f54efafdaf
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/python-appservice-deploy/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, network
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/microsoft-python-appservice-deploy
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-python-appservice-deploy/manifest

## Capabilities

- Detects Flask, Django, FastAPI, generic WSGI, and generic ASGI projects from common dependency and entry-point files.
- Selects Azure Developer CLI when an App Service azure.yaml configuration exists, otherwise using Azure CLI.
- Creates a missing resource group, Linux App Service plan, and Python web app with documented defaults.
- Enables server-side dependency installation through App Service deployment settings.
- Configures an explicit uvicorn startup command for detected FastAPI applications.
- Packages project files, deploys the archive, and reports the Azure App Service endpoint.

## Use Cases

- Deploy a first Flask service: Create the required Azure resources, package a Flask project, deploy it, and receive its App Service endpoint.
- Standardize FastAPI startup: Deploy FastAPI with an explicit uvicorn entry point and consistent Linux App Service startup behavior.
- Reuse an existing azd environment: Detect an App Service azure.yaml configuration and perform a subsequent code deployment through Azure Developer CLI.

## Prompt Templates

### Deploy a Flask project

```
Deploy the Flask project in this workspace to Azure App Service Linux. Show the selected subscription, region, resource group, and app name.
```

### Deploy FastAPI with a custom entry point

```
Deploy this FastAPI project to Azure App Service. Detect the entry point, confirm it with me, and configure the required uvicorn startup command.
```

### Deploy through an existing azd setup

```
Inspect azure.yaml and deploy through azd when its service host is App Service. Reuse the existing environment and report the endpoint.
```

### Control production deployment settings

```
Deploy this Django project using my specified subscription, resource group, region, plan, and app name. Review archive contents and planned resource changes first.
```

## Limitations

- Supports Python applications on Linux Azure App Service only.
- Does not provision databases, private networking, Key Vault, containers, Functions, or infrastructure-as-code environments.
- Uses documented Python, region, and pricing-tier defaults unless the user supplies alternatives.
- Does not verify application health after deployment, so asynchronous build or startup failures may remain undiscovered.

## Best Practices

- Confirm the Azure subscription, resource group, region, and pricing tier before provisioning resources.
- Inspect the deployment archive and remove secrets, local credentials, virtual environments, caches, and unrelated artifacts.
- Treat upload acceptance separately from build and health status, then review deployment logs after the warm-up period.

## Anti Patterns

- Do not use this skill for Windows plans, containers, Functions, databases, private networking, or full infrastructure design.
- Do not keep secrets or local credential files inside the deployment workspace or generated archive.
- Do not treat successful archive upload as proof that the application built, started, or passed a health check.

## Security Audit

- Audited at: 2026-07-23T20:10:04.357\+00:00
- Summary: Most static alerts are false positives caused by Markdown backticks, PowerShell fences, bind addresses, HTTPS endpoint templates, and benign device redirection. The retry wrappers execute caller-supplied command strings through eval or nested PowerShell, creating command-injection risk, and the PowerShell archive path can include environment secrets. No prompt injection or malicious exfiltration intent was found.

## Stats

- Views: 0
- Downloads: 5
- Favorites: 0
- Popularity score: 0