Azure App Service
Arpio replicates Azure App Service resources including Web Apps, App Service Plans, App Service Environments, and App Service Certificates, enabling web application workloads to be restored in recovery environments.
Web App
Arpio replicates Azure Web Apps with their site configuration, application settings, deployed code, custom domains, and authentication settings. During backup, Arpio captures the deployed application code (wwwroot) and app settings/connection strings. At recovery time, the code is deployed to the recovered Web App and settings are restored with resource references translated to the recovery environment.
Container-based Web Apps (Docker) are also supported — container image references are translated to use the recovery container registry. Authentication settings (both V1 and V2) are replicated alongside the Web App.
Translated Attributes
The following attributes are translated during replication:
| Attribute | Translation Method |
|---|---|
| App Service Plan | Reference translated to recovery App Service Plan |
| Virtual Network Subnet | Reference translated to recovery subnet |
| Key Vault Reference Identity | Translated to recovery user-assigned identity |
| Container Image (linuxFxVersion / windowsFxVersion) | ACR image references translated to recovery registry |
| ACR User Managed Identity | Translated to recovery user-assigned identity |
| IP Security Restriction Subnets | References translated to recovery subnets |
| Hosting Environment Profile | Reference translated to recovery App Service Environment |
| SSL Certificate Resource IDs | Translated to recovery certificates |
| App Settings & Connection Strings | Resource IDs, Storage Account keys, and Key Vault URIs translated |
Automatic Dependency Selection
The following resources are automatically selected into recovery points when a Web App is selected:
- App Service Plan hosting the Web App
- Virtual network subnets (for VNet integration and IP restrictions)
- User-assigned managed identities
- App Service Environment (if applicable)
- App Service Certificates bound to the site
- Container Registries and images (for container-based apps)
- Storage Accounts and Key Vaults referenced in app settings
Private Network Access
If your Web App has public access disabled, Arpio will deploy a private delegate that is able to access the Web App via an existing private endpoint. This delegate will be used by Arpio to back up and restore code and settings for the Web App.
After recovery, code deployment to private Web Apps occurs in a separate step after Private Endpoints are established in the recovery environment.
Custom Domain Recovery
During recovery, Arpio restores custom hostname bindings. If DNS verification fails, Arpio surfaces a recovery issue titled Custom Domain Verification Required with the exact TXT record that needs to be added to your DNS (record type, host, and value). This issue is visible in the Arpio UI during the recovery operation.
App Service Plan
Arpio replicates App Service Plans with their SKU, pricing tier, and worker configurations into the recovery environment.
Translated Attributes
The following attributes are translated during replication:
| Attribute | Translation Method |
|---|---|
| Hosting Environment Profile | Reference translated to recovery App Service Environment |
Automatic Dependency Selection
The following resources are automatically selected into recovery points when an App Service Plan is selected:
- App Service Environment (if the plan is hosted in an ASE)
App Service Environment
Arpio replicates App Service Environments (ASEv3) with their networking and custom DNS configurations into the recovery environment.
Translated Attributes
The following attributes are translated during replication:
| Attribute | Translation Method |
|---|---|
| Virtual Network / Subnet | Reference translated to recovery VNet and subnet |
| Custom DNS Suffix Key Vault Certificate | Key Vault URL translated to recovery Key Vault |
| Custom DNS Suffix Managed Identity | Translated to recovery user-assigned identity |
Automatic Dependency Selection
The following resources are automatically selected into recovery points when an App Service Environment is selected:
- Virtual network subnet hosting the ASE
- User-assigned identity for custom DNS suffix (if configured)
App Service Certificate
Arpio replicates App Service Certificates that are sourced from Key Vault or are Azure-managed free certificates. Key Vault certificates are recreated in recovery by referencing the translated Key Vault and secret name. Azure-managed free certificates are reprovisioned in recovery, which requires DNS domain validation.
Certificate-to-hostname bindings are restored with SNI SSL.
Translated Attributes
The following attributes are translated during replication:
| Attribute | Translation Method |
|---|---|
| Key Vault ID | Translated to recovery Key Vault |
| Server Farm ID | Translated to recovery App Service Plan |
Limitations
- Uploaded PFX certificates cannot be recovered — Azure does not return the certificate blob or password via the API. These certificates must be manually re-uploaded after recovery.
- Azure-managed free certificates require DNS validation — recovery may require updating CNAME or A records to point to the recovered Web App before the certificate can be provisioned.
- Elastic Premium App Service Plans — worker size is dynamically assigned by Azure and may differ in recovery.
- Deployment slots are not currently supported; only the main site is replicated.