# Use a hostname when an App Service backend is in another subscription

> Application Gateway's App Services dropdown has a narrower scope than backend configuration.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:04+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Application Gateway's App Services dropdown has a narrower scope than backend configuration.

## Potentially affected

Use this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend's identity and intended public or private access path with its owner before entering an address.

## DSE recommendation

DSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app.

## Article

## Source facts

Application Gateway’s App Services target dropdown lists only apps in the gateway’s subscription. Microsoft directs administrators targeting an app in another subscription to choose IP address or hostname and enter the App Service hostname. For an App Service using private endpoints, the guide directs them to use the private endpoint’s FQDN or IP address. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app).

## Applicability

Use this configuration check when the intended App Service belongs to a different subscription from Application Gateway. Confirm the backend’s identity and intended public or private access path with its owner before entering an address.

## DSE recommendation

DSE recommends treating an absent dropdown entry as a scope clue, then using the documented target type for the intended app. Obtain the exact hostname or private-endpoint address from the backend owner. Review name resolution, access restrictions, HTTP settings and the health probe together before saving the configuration.

## Verification

Inspect the saved backend address and test resolution from the intended gateway network. Check backend health, then exercise the application through the approved listener. Retain the subscription and resource identities with the observed result. A correctly entered hostname is one configuration checkpoint; acceptance also requires the intended application path to work.

## Official references

[Microsoft Learn: Manage traffic to App Service](https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app).

## Primary reference

- Name: Manage traffic to App Service - Azure Application Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use a hostname when an App Service backend is in another subscription,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-116-use-a-hostname-when-an-app-service-backend-is-in-another-subscription/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.