Deployment credentials

In the Ultra Transcenders books

AZ-104

Each book explains Deployment credentials in context, with comparison tables and the common traps.

Terms in this definition

• USERNAME

  Desktop shows DOMAIN\user; once published to Power BI's service, a UPN comes back instead. Either way, it identifies whoever is currently viewing.

• LSDOU

  The sequence in which Group Policy is processed: the local policy first, followed by site, domain and organisational unit policies. The nearest, last-processed setting takes effect unless Enforced or Block Inheritance alters that.

• Git

  A distributed version control system. Anything kept in Git, prompts included, gains a history of authors, timestamps, diffs and tags, and changes can be reverted.

• App Service

  Managed PaaS hosting for web apps and Web App for Containers, run in a sandbox without OS access. Deployment slots and autoscale start at the Standard tier.

Related terms

• FTP

  Plain file transfer with no encryption. Unless its FTP state is switched to Disabled or to FTPS only, App Service will still take deployments over it; ZIP deployment is the better choice, with FTPS second.

• IIS

  Internet Information Services, Microsoft's web server, where a Microsoft CA's CertSrv enrolment pages live. VCF cannot get certificates from that CA until Basic Authentication is switched on there.

• Legacy authentication

  Older protocols, such as Exchange ActiveSync and legacy mail apps (the Other clients category), that sign in with basic authentication. MFA isn't possible with them, so Conditional Access policies use the client apps condition to block them.

• Microsoft CA

  Certificate authority built on Microsoft AD Certificate Services. Once a suitable template exists and IIS has Basic Authentication on for CertSrv, VCF can have it sign and automatically renew certificates for its parts.

• Publish profile

  Per-app credentials for App Service, usable by GitHub Actions and other deployment tools. Basic authentication has to stay enabled for it to work, which is why OpenID Connect is the better option.

• Secure Webhook

  Calls an endpoint secured with Microsoft Entra ID from an Azure Monitor action group; basic authentication can't be used. It supersedes the IT Service Management Connector for BMC Helix and ServiceNow.

• Trigger syncing

  Letting the Functions platform know what triggers an app contains. After deploying from an external package URL, through local Git or over FTPS, this has to be done manually with a restart or a syncfunctiontriggers call.

• Website Contributor

  Manages web apps but not the plans behind them, allowing Entra identities to publish with no need for deployment credentials.