- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
- Security
Secure an Azure Delivery Workflow with Gates, Secrets, and Policy
In this Azure lab, you build and operate a secure delivery workflow that deploys a web app to Azure App Service via GitHub Actions, hardened with the controls that a real delivery engineer relies on. You store a preconfigured deployment credential as a secret, configure a review gate that holds the deployment until you approve it, and run a pre-deploy configuration check that blocks a non-compliant deployment and then passes once you correct it. The workflow deploys using an App Service publish profile, so there is no service principal or Entra ID configuration required. You then verify the secured result in the Azure portal: the deployed app and its HTTPS-only configuration, how a Key Vault secret is referenced without being exposed, the Azure Policy compliance state you assign, and the preserved release evidence. By the end, you can build and operate this secured workflow in your own Azure delivery environment.
Lab Info
Table of Contents
-
Challenge
Configure a gate that blocks or allows deployment based on review
- Create a protected production environment in the workflow repository and add yourself as a required reviewer.
- Run the workflow and observe the deploy job hold in a pending review state because of the gate.
- Approve the deployment and confirm the job is released to run, and that the approval is recorded in the run history.
-
Challenge
Use preconfigured Azure authentication to deploy without Entra work
- Download the App Service publish profile from the portal and store it as a repository secret.
- Run the workflow and observe the deploy step authenticate to Azure with that secret rather than a service principal.
- In the portal, verify the App Service deployment center shows the GitHub Actions source and a successful deployment from the workflow.
-
Challenge
Retrieve a deployment secret using a supportable Key Vault pattern
- In the portal, inspect the App Service environment variables and confirm the deployment secret setting is a Key Vault reference with a resolved status, not a literal value.
- Confirm in Key Vault that the secret exists and that the App Service identity is granted read access through an access policy scoped to that identity.
-
Challenge
Run a policy or configuration check before deployment proceeds
- Run the workflow and observe the pre-deploy configuration check fail on a non-compliant declared configuration, which blocks the deployment.
- Correct the declared configuration to meet the HTTPS-only baseline, run the workflow again, and observe the check pass and the deployment proceed.
- In the portal, assign the built-in Azure Policy that audits the HTTPS-only baseline on the resource group, then view the App Service compliance state.
-
Challenge
Verify the workflow preserves security and release evidence
- Confirm the running application reflects the deployed version and serves over HTTPS.
- In the portal, confirm the App Service deployment center and activity log show the deployment and its source.
- Identify the evidence preserved across both surfaces: the approval and run record in GitHub, and the deployment and configuration record in Azure.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.