Playbooks
Symptom-oriented troubleshooting guides for Azure App Service, with platform applicability stated in each playbook.
Each playbook follows a hypothesis-driven structure: start from the symptom, list competing hypotheses, collect evidence, validate or disprove, and identify the root cause.
The detector categories map closely to the playbooks below: Availability and Performance to the startup and performance playbooks, Networking to the outbound playbooks, and Configuration and Management plus Deployment to deployment failures. Open the detector hub first so Azure can surface the most likely detectors, then pick the matching playbook here for hypothesis-driven validation.
Choose a Hosting Mode
Windows Playbooks and Evidence
The dedicated Windows set covers the symptoms above. Cross-platform deployment investigation also includes Deployment Failures, Missing wwwroot Files and 404, the Missing wwwroot Content Lab, and the ZIP Deploy File Lock Lab. Other playbooks commonly use Linux examples; reuse their diagnostic method only after translating evidence through the correct hosting-mode guide.
graph TD
A[Reported symptom] --> B{Primary symptom area}
B --> C[Performance]
B --> D[Outbound or Network]
B --> E[Startup or Availability]
C --> F[Slow response low CPU]
C --> G[Memory pressure]
C --> H[Intermittent 5xx]
C --> I[No space left on device]
C --> J[Slow start / cold start]
D --> K[SNAT vs app issue]
D --> L[DNS resolution VNet]
D --> M[Private endpoint and DNS routing]
E --> N[Container HTTP pings]
E --> O[Warm-up vs health check]
E --> P[Slot swap warm-up failure]
E --> Q[Deployment ok but startup fails]
E --> R[Failed to forward request]
E --> S[Slot swap config drift]
| Playbook | Symptom |
| Deployment Failures | Failed deployments, slot issues, or swap failures |
| SCM Client DNS and HTTP Failures | Kudu fails to open from one or several clients; distinguish name resolution, transport, HTTP rules and authentication |
| Private Endpoint and Access Restriction Decisions | PE approval without connectivity, unexpected allowlist exclusions, or safe private-only cutover |
| Production ARM Configuration HTTP 400 | Production configuration update returns ARM HTTP 400 while a comparable staging-slot request succeeds |
| Missing wwwroot Files and 404 | Expected static file absent from served content, later 404, actor and loss time unknown |
| App Startup Failures | Application or container never becomes ready |
| mTLS Failures | Missing client certificate headers, failed validation, or outbound certificate loading issues |
| SSL Certificate Issues | Custom domain TLS binding, renewal, or hostname mismatch problems |
| Authentication Failures | Easy Auth, Entra ID, or identity-related sign-in failures |
| CD RBAC Role Assignment Conflict | RoleAssignmentExists on Deployment Center reconnect with managed-identity ACR pulls |
Process lifecycle and missing work
If work appears missing near a maintenance event, crash, configured restart, scale event, or deployment, use Process Lifecycle and In-Flight Work. It provides the shared symptom-first timeline and evidence method for these competing causes. A separate playbook would duplicate that method before the initiating lifecycle path is known.
Outbound / Network
Startup / Availability
See Also
Sources