Common Anti-Patterns¶

This document catalogs high-impact App Service anti-patterns that frequently cause outages, security incidents, cost spikes, and difficult troubleshooting cycles. Use it as a review checklist during design, architecture review, and release readiness gates.

How to Use This Guide¶

Apply this guide in three moments:

1. During architecture and platform design reviews
2. Before production go-live
3. During post-incident corrective action planning

Anti-Pattern Detection Flow¶

flowchart TD
    A[Design or operational change proposed] --> B{Touches production workload?}
    B -- No --> C[Apply standard quality checks]
    B -- Yes --> D[Run anti-pattern review checklist]
    D --> E{Any anti-pattern found?}
    E -- No --> F[Proceed with controlled rollout]
    E -- Yes --> G[Map risk severity and blast radius]
    G --> H[Apply recommended alternative pattern]
    H --> I[Retest and validate]
    I --> J{Residual risk acceptable?}
    J -- Yes --> F
    J -- No --> K[Escalate architecture review]

Anti-Pattern Catalog¶

Use the following table as a policy baseline.

High-Risk Anti-Patterns to Eliminate First¶

If you cannot fix everything immediately, prioritize these first:

1. Single instance in production
2. No health check configuration
3. Secrets outside Key Vault references
4. Direct-to-production deployments without slot validation
5. Connection-per-request outbound calls causing SNAT pressure

Portal view: Diagnose and solve problems¶

The Diagnose and solve problems blade is the App Service equivalent of an anti-pattern detection gate after the fact — it surfaces the symptoms left behind by the patterns this guide eliminates upfront. The visible Risk alerts: Availability — 2 Critical panel is the platform's own confirmation that this particular app is hitting at least two anti-patterns from the catalog above; clicking through shows which ones (most commonly single-instance HA, missing health check, or SNAT/timeout patterns flagged by the platform). The seven Troubleshooting categories map cleanly onto the anti-pattern table sections — Availability and Performance reveals single-instance and missing-health-check anti-patterns, Configuration and Management surfaces slot-setting and EasyAuth misconfigurations, Networking exposes SNAT and outbound dependency anti-patterns, and Risk Assessments is the closest platform equivalent to a pre-go-live anti-pattern review. Treat any non-zero Risk alerts count as a release blocker, not as ambient noise.

Category Deep Dive¶

Configuration Anti-Patterns¶

Common symptoms:

• Unexpected behavior after slot swap
• Environment mismatch between staging and production
• Leaked credentials in logs or scripts

Remediation baseline:

• Configuration inventory with ownership
• Slot setting review in each release checklist
• Secret source policy (Key Vault by default)

Deployment Anti-Patterns¶

Common symptoms:

• Deployments succeed but app fails after startup
• Rollback takes too long due to missing artifact provenance
• Frequent hotfixes with unclear change history

Remediation baseline:

• Immutable artifact promotion model
• Slot-based validation and controlled swap
• Rollback rehearsal before high-risk changes

Networking Anti-Patterns¶

Common symptoms:

• Intermittent 5xx under moderate load
• Dependency connection timeouts at scale
• Inconsistent behavior across instances

Remediation baseline:

• Reuse outbound connections
• Add explicit timeout and retry budgets
• Validate network design with load tests

Security Anti-Patterns¶

Common symptoms:

• Secrets copied into multiple systems
• Over-permissioned identities
• Drift between intended and actual TLS/security config

Remediation baseline:

• Managed identity everywhere possible
• Key Vault reference policy
• Security baseline validation in CI/CD

Performance Anti-Patterns¶

Common symptoms:

• Tail latency spikes during routine operations
• Scale-out fails to improve user experience
• High variability between instances

Remediation baseline:

• Minimum two instances in production
• Autoscale tied to meaningful metrics
• Session/state design aligned to horizontal scaling

Monitoring Anti-Patterns¶

Common symptoms:

• Incidents discovered by users first
• Unclear root cause due to missing telemetry
• Slow post-incident analysis

Remediation baseline:

• Health, error, and latency dashboards
• Actionable alert thresholds with ownership
• Deployment and incident timeline correlation

Governance Pattern¶

Use an anti-pattern review gate in architecture and change workflows:

• Design review checklist must include this document
• Production change approval requires anti-pattern attestation
• Exceptions require documented risk acceptance and expiry date

Operational Review Checklist¶

Before production release, validate:

• No critical anti-pattern remains unresolved
• All high-risk exceptions have mitigation owners
• Deployment, monitoring, and rollback controls are tested
• Runbooks match current architecture

# Example: verify key settings surface for review
az webapp config appsettings list \
    --resource-group $RG \
    --name $APP_NAME

See Also¶

• Platform - How App Service Works
• Platform - Networking
• Operations - Security
• Operations - Deployment Slots
• Best Practices - Deployment
• Best Practices - Scaling
• Best Practices - Reliability

Sources¶

• Best practices for Azure App Service (Microsoft Learn)
• Secure Azure App Service apps (Microsoft Learn)
• Troubleshoot outbound connection failures in Azure App Service (Microsoft Learn)
• Monitor instances in Azure App Service with Health check (Microsoft Learn)