Microsoft Entra authentication for Kudu VFS GET when SCM Basic Auth is disabled

Question

Microsoft Entra authentication for Kudu VFS GET when SCM Basic Auth is disabled

admin email 0

For Azure App Service on Linux with SCM Basic Auth Publishing Credentials disabled, does the Kudu VFS REST endpoint GET /api/vfs/site/wwwroot/<filename> support direct Microsoft Entra bearer-token authentication? If supported, what token audience/resource, RBAC action, and documented client authentication flow are required? Does the endpoint return file bytes directly or use authentication redirects? Please identify the current Microsoft documentation. We do not want to enable Basic Authentication or use SSH.

0 comments

2 answers

Your answer

Answer 1

Welcome to Microsoft Q&A

Hello @admin email

Based on the current Microsoft documentation, Kudu does support Microsoft Entra authentication for accessing the SCM/Kudu site, provided the caller has a role that includes the Microsoft.Web/sites/publish/Action permission. Microsoft documents browser access to Kudu using Entra authentication and lists the required RBAC permission.

A few points relevant to your scenario:

Disabling SCM Basic Auth Publishing Credentials disables the use of publishing credentials for SCM/Kudu access, but App Service supports Entra-based authentication workflows as an alternative.
For Kudu/SCM endpoint access, recent Microsoft guidance indicates that callers should obtain a token for the App Service audience, rather than using an Azure Resource Manager token. Specifically, direct Kudu/SCM calls should use the App Service audience, while ARM tokens remain for ARM management operations.
The Kudu documentation confirms that the VFS API endpoint:
```
  GET /api/vfs/site/wwwroot/<filename>
```
returns the file content for the specified path.

What I could not find in current Microsoft Learn documentation is a page that explicitly documents:

Entra bearer-token authentication for the VFS API specifically,
The exact OAuth flow for GET /api/vfs/...,
The expected behavior regarding redirects versus direct file-byte responses.

The official Kudu REST API documentation is still largely written around basic-auth examples and predates the newer Entra-auth support model.

Given that your requirement is SCM Basic Auth disabled and no SSH, the supported direction appears to be:

Acquire an Entra access token for the App Service audience.
Ensure the caller has an RBAC role containing Microsoft.Web/sites/publish/Action.
Call the SCM/Kudu endpoint directly using the bearer token.

If you're looking for a definitive statement on Entra support for Kudu VFS GET specifically, I'd recommend a Microsoft moderator or product team confirmation, as the current documentation describes Entra authentication for Kudu generally but does not explicitly call out the VFS endpoint authentication flow.

References

1. https://learn.microsoft.com/azure/virtual-desktop/customize-rdp-properties
2. https://learn.microsoft.com/microsoftteams/avd/teams-for-avd

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find similar solutions.

Answer 2

Microsoft does not currently document direct Microsoft Entra bearer-token authentication as a supported contract for GET /api/vfs/site/wwwroot/<filename>; the documented token flow applies to deployment-oriented SCM/Kudu APIs such as /api/publish, so it cannot be safely extended to VFS file downloads.

What is documented

The App Service authentication matrix lists SCM/Kudu/OneDeploy REST endpoint as supporting Basic authentication and Microsoft Entra authentication. Its linked procedure, however, documents the Kudu publish API, not /api/vfs GET operations.^1^
For /api/publish, Microsoft shows obtaining a token with the default Azure CLI command and sending it in the Authorization header:^2^

TOKEN=$(az account get-access-token \
  --query accessToken \
  --output tsv)

curl -X POST \
  -H "Authorization: Bearer $TOKEN" \
  -T @"<zip-package-path>" \
  "https://<app-name>.scm.azurewebsites.net/api/publish?type=zip"

Because no --resource is specified, this example obtains the Azure Resource Manager token used by the signed-in Azure CLI context. The documentation does not separately declare that audience as the supported audience for /api/vfs.

RBAC requirement

For Microsoft Entra access to Kudu in a browser, the assigned Azure role must contain:

Microsoft.Web/sites/publish/Action

Examples include Website Contributor, Contributor, and Owner, although a least-privilege role is preferred.^3^

That page does not state that Microsoft.Web/sites/publish/Action is the formally documented authorization requirement for a direct bearer-authenticated VFS GET. Therefore, it should not be treated as a VFS-specific RBAC guarantee.

File bytes versus redirects

The current Microsoft Learn pages cited above do not specify, for an Entra-authenticated call to:

GET https://<app-name>.scm.azurewebsites.net/api/vfs/site/wwwroot/<filename>

whether Kudu will:

accept the Bearer [Token] and return the raw file bytes,
return an authentication challenge,
or redirect the client through an interactive Kudu sign-in flow.

Kudu’s REST API is linked from the service overview, but the current App Service documentation does not provide a VFS-specific Entra example or define its bearer-token response behavior.^3^

Practical conclusion

There is no current Microsoft documentation that supplies all three items required to build a supported, noninteractive VFS download client:

A VFS-specific token audience or scope.
A VFS-specific RBAC authorization requirement.
A guarantee that an authenticated GET returns file bytes without browser redirects.

Keep SCM Basic Auth disabled; Microsoft explicitly supports disabling it and recommends token-based deployment methods where documented.^4^ If programmatic file download through VFS is a hard requirement, request confirmation from Azure App Service support for that exact endpoint before depending on it. Otherwise, expose the required artifact through an application-controlled authenticated endpoint or move it to a storage service with a documented data-plane download API.

References