{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "slug": "dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription", "url": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/" }, "title": "Use a hostname when an App Service backend is in another subscription", "summary": "Application Gateway's App Services dropdown has a narrower scope than backend configuration.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:04+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Use this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend's identity and intended public or private access path with its owner before entering an address.", "dse_recommendation": "DSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app.", "primary_source": { "name": "Manage traffic to App Service - Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Application Gateway’s App Services target dropdown lists only apps in the gateway’s subscription. Microsoft directs administrators targeting an app in another subscription to choose IP address or hostname and enter the App Service hostname. For an App Service using private endpoints, the guide directs them to use the private endpoint’s FQDN or IP address. Microsoft Learn.

\n

Applicability

\n

Use this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend’s identity and intended public or private access path with its owner before entering an address.

\n

DSE recommendation

\n

DSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app. Obtain the exact hostname or private-endpoint address from the backend owner. Review name resolution, access restrictions, HTTP settings and the health probe together before saving the configuration.

\n

Verification

\n

Inspect the saved backend address and test resolution from the intended gateway network. Check backend health, then exercise the application through the approved listener. Retain the subscription and resource identities with the observed result. A correctly entered hostname is one configuration checkpoint; acceptance also requires the intended application path to work.

\n

Official references

\n

Microsoft Learn: Manage traffic to App Service.

", "content_text": "Source facts\nApplication Gateway’s App Services target dropdown lists only apps in the gateway’s subscription. Microsoft directs administrators targeting an app in another subscription to choose IP address or hostname and enter the App Service hostname. For an App Service using private endpoints, the guide directs them to use the private endpoint’s FQDN or IP address. Microsoft Learn.\nApplicability\nUse this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend’s identity and intended public or private access path with its owner before entering an address.\nDSE recommendation\nDSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app. Obtain the exact hostname or private-endpoint address from the backend owner. Review name resolution, access restrictions, HTTP settings and the health probe together before saving the configuration.\nVerification\nInspect the saved backend address and test resolution from the intended gateway network. Check backend health, then exercise the application through the approved listener. Retain the subscription and resource identities with the observed result. A correctly entered hostname is one configuration checkpoint; acceptance also requires the intended application path to work.\nOfficial references\nMicrosoft Learn: Manage traffic to App Service.", "content_markdown": "## Source facts\n\nApplication Gateway’s App Services target dropdown lists only apps in the gateway’s subscription. Microsoft directs administrators targeting an app in another subscription to choose IP address or hostname and enter the App Service hostname. For an App Service using private endpoints, the guide directs them to use the private endpoint’s FQDN or IP address. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app).\n\n## Applicability\n\nUse this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend’s identity and intended public or private access path with its owner before entering an address.\n\n## DSE recommendation\n\nDSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app. Obtain the exact hostname or private-endpoint address from the backend owner. Review name resolution, access restrictions, HTTP settings and the health probe together before saving the configuration.\n\n## Verification\n\nInspect the saved backend address and test resolution from the intended gateway network. Check backend health, then exercise the application through the approved listener. Retain the subscription and resource identities with the observed result. A correctly entered hostname is one configuration checkpoint; acceptance also requires the intended application path to work.\n\n## Official references\n\n[Microsoft Learn: Manage traffic to App Service](https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "url": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use a hostname when an App Service backend is in another subscription", "item": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "url": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/", "headline": "Use a hostname when an App Service backend is in another subscription", "description": "Application Gateway's App Services dropdown has a narrower scope than backend configuration.", "abstract": "Application Gateway's App Services dropdown has a narrower scope than backend configuration.", "articleBody": "Source facts\nApplication Gateway’s App Services target dropdown lists only apps in the gateway’s subscription. Microsoft directs administrators targeting an app in another subscription to choose IP address or hostname and enter the App Service hostname. For an App Service using private endpoints, the guide directs them to use the private endpoint’s FQDN or IP address. Microsoft Learn.\nApplicability\nUse this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend’s identity and intended public or private access path with its owner before entering an address.\nDSE recommendation\nDSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app. Obtain the exact hostname or private-endpoint address from the backend owner. Review name resolution, access restrictions, HTTP settings and the health probe together before saving the configuration.\nVerification\nInspect the saved backend address and test resolution from the intended gateway network. Check backend health, then exercise the application through the approved listener. Retain the subscription and resource identities with the observed result. A correctly entered hostname is one configuration checkpoint; acceptance also requires the intended application path to work.\nOfficial references\nMicrosoft Learn: Manage traffic to App Service.", "datePublished": "2026-09-17T16:33:04+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use a hostname when an App Service backend is in another subscription" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage traffic to App Service - Azure Application Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app" } } ] } }