Share Azure diagnostics and enable App Service end-to-end TLS

[David Pine (IEvangelist)]

Summary

Configure the public AppHost to publish Front Door and Azure Managed Redis diagnostics into one shared Azure Log Analytics workspace.

• Disable the hosted Aspire dashboard with WithDashboard(false) and enable website end-to-end TLS through PublishAsAzureAppServiceWebsite.
• Create workspace-logs only in publish mode, with SDK-generated physical naming and no retention override.
• Add typed WithDiagnostics helpers using Azure.Provisioning.Monitor 1.0.0-beta.2, with no other package upgrades. Front Door's security-logs setting enables FrontDoorAccessLog and FrontDoorWebApplicationFirewallLog on the existing CDN profile. Redis's redis-connection-logs setting enables only ConnectionEvents on the existing databases/default resource.
• Preserve public App Service defaults, Redis authentication/networking and website references, live-status configuration, frontend development setup, and the existing Front Door run-mode resource and origin/cache behavior.

This is one new commit directly on freshly fetched public main (d0da0bb0d75219668ef0685d0e451bc394eccc0d). Only the three existing AppHost source/project files change. No Ev2/private packages or artifacts, deployment-pipeline changes, additional Application Insights resources, metrics, DCRs, dedicated-table settings, or hardcoded resource IDs are included.

The public Aspire 13.6 App Service defaults produce a P0V3 Premium plan. This was verified against the package's public source and generated Bicep; Microsoft Learn's App Service TLS documentation confirms Premium plans support end-to-end TLS. No hosting SKU/scaling customization is needed.

Third-party links and affiliations

None.

Validation

All generated files and the comparison script were kept in a session-artifacts directory outside the repository. In the exact commands below, $artifacts was set to that directory.

AppHost-only build: passed, 0 warnings and 0 errors. Both frontend build/install scripts were disabled.

dotnet build .\src\apphost\Aspire.Dev.AppHost\Aspire.Dev.AppHost.csproj -p:ShouldRunBuildScript=false -p:ShouldRunNpmInstall=false --verbosity quiet

Manifest export: passed, 7/7 pipeline steps. No infrastructure was deployed.

aspire do publish-manifest --apphost .\src\apphost\Aspire.Dev.AppHost\Aspire.Dev.AppHost.csproj --no-build --non-interactive --output-path "$artifacts\shared-diagnostics-manifest"

Generated Bicep compilation: passed, all 10 modules, using Bicep CLI 0.41.2.

$files = @(Get-ChildItem -LiteralPath "$artifacts\shared-diagnostics-manifest" -Filter '*.bicep')
foreach ($file in $files) {
    az bicep build --file $file.FullName --outfile ([System.IO.Path]::ChangeExtension($file.FullName, '.json')) --only-show-errors
    if ($LASTEXITCODE -ne 0) { throw "Bicep compilation failed: $($file.Name)" }
}

Generated-output inspection and baseline comparison: passed. A session-local assertion script, not a repository test or PR file, checked the compiled templates against an export of unchanged public main:

python "$artifacts\verify_shared_diagnostics.py"

Confirmed exactly one SDK-named workspace; no hosted dashboard; endToEndEncryptionEnabled: true on the website; Front Door scope: frontdoor_afd; Redis scope: cache_default; exactly the requested enabled log categories; and both manifest parameters referencing {workspace-logs.outputs.logAnalyticsWorkspaceId} through workspace_logs_outputs_loganalyticsworkspaceid. Retention, diagnostic metrics and destination-type overrides are omitted. Existing Redis resources/outputs, authentication and networking, Front Door resources/outputs, App Service plan, website identities, Redis/live-status settings, and unrelated modules are unchanged, except for the expected removal of dashboard-specific telemetry settings/resources.

Diff/history checks: passed.

git --no-pager diff --check
git rev-list --count upstream/main..HEAD
git rev-parse HEAD^ upstream/main

The branch contains one new public-only commit; its parent exactly equals freshly fetched public main. No internal commits were cherry-picked or merged.

Not performed: frontend production build, unit/E2E suites, Azure deployment or what-if, deployed destination/permissions checks, deployed retention verification, and live log delivery tests. Before deployment, confirm the intended environment/destination and retention policy; after deployment, verify Front Door access/WAF and Redis connection events reach the shared workspace. Enabling the WAF log category does not add or configure a WAF policy.

[Eric Erhardt (eerhardt)]

Just one suggestion

[Copilot]

🔵 Needs a closer look

Production TLS behavior and diagnostic delivery still require deployment-level human verification.

0 open findings

What changed in this PR

Updates the public AppHost to share Azure diagnostics and enable App Service end-to-end TLS.

Changes:

• Adds a publish-only Log Analytics workspace for Front Door and Redis logs.
• Enables website end-to-end TLS and disables the hosted Aspire dashboard.
• Adds Azure.Provisioning.Monitor version 1.0.0-beta.2.

File	Description
src/​apphost/​Aspire.Dev.AppHost/​Extensions/​DeploymentExtensions.cs	Adds typed Front Door and Redis diagnostic helpers.
src/​apphost/​Aspire.Dev.AppHost/​Aspire.Dev.AppHost.csproj	Adds the Monitor provisioning dependency.
src/​apphost/​Aspire.Dev.AppHost/​AppHost.cs	Configures shared diagnostics, TLS, and dashboard removal.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.