Step-by-Step Guide to Setting Up DevOps Approvals for Production Slots

To set up DevOps approvals for production slots, you must control who can move code to your live app. A production slot is your live app. A staging slot lets you test changes first. DevOps approvals add a checkpoint before changes reach users. This makes deployments safer and more reliable.

Many teams have problems like managing environment settings, setting up approval steps, and controlling who has access. Risk-based approval automation can make wait times 78% shorter for low-risk changes. Manual approvals can slow down deployments and cause more problems.

You can use deployment slots to test updates and run smoke tests. You can swap to production with no downtime. This helps lower mistakes and lets you roll back fast if something goes wrong.

Key Takeaways

• Deployment slots let you test updates before using them on your real app. This helps lower downtime and mistakes.

• Add manual approval steps in your pipeline. This lets you pick who can put changes into production. It makes things safer.

• Keep your production safe with strong access rules. Use role-based permissions and multi-factor authentication.

• First, deploy to a staging slot. Run tests there. Only move to production after getting approvals. This keeps things stable.

• Watch approvals and deployment history. This helps you know who did what. You can fix problems fast if something goes wrong.

Prerequisites

Tools and Accounts

You need some things before you begin. Azure DevOps Pipelines help you make a release pipeline. This pipeline has a production stage. The Azure portal lets you manage App Service deployment slots. To set up approvals, add yourself or others as approvers. This stops automatic deployments from going to production without a check.

Here is what you need:

• Azure DevOps account that can reach your project.

• Azure App Service with at least two slots: production and staging.

• Permission to make and change pipelines in Azure DevOps.

• Access to the Azure portal to manage slots.

• Approvers who have Azure DevOps accounts and approval rights.

• The Project Build Service account with Read access to Azure Boards queries. This helps with approval gates.

Set the deployment task to use the production slot. You do this by not checking the slot option or by picking the production slot in your pipeline.

Permissions

You need the right permissions to set up and handle approvals. Azure DevOps uses roles to decide who can do what. These roles are Creator, Reader, User, and Administrator. Only Administrators or people with similar rights can fully control approval checks.

To give roles, go to the environment’s security settings. Add users or groups and give them the right role. You must be in an administrator group to manage project security. For release pipeline security, you need 'Administer release permissions'.

Identify Production Slot

You must know how to find the production slot in App Service. The production slot is the main slot. It gets all live traffic. Its URL does not end with a slot name. For example, the production slot might use

https://yourapp.azurewebsites.net

. Other slots, like staging, add the slot name to the end of the URL.

You can also look at HTTP headers. The production slot uses the routing cookie x-ms-routing-name=self. This helps you make sure you are working with the right slot before you make changes.

Pipeline Setup

Create Pipeline

First, you need to make a new pipeline in Azure DevOps. Pipelines help you build and deploy your app without doing it by hand. Here is how you set up your pipeline for Azure App Service slots:

1. Go to Azure DevOps and open your project.

2. Click on Pipelines and then pick New Pipeline.

3. Choose where your code is stored, like GitHub or Azure Repos.

4. Pick a starter template or use YAML to write your pipeline steps.

5. Add steps to build your app and package the files.

6. Set up deployment slots by adding settings for your staging slot. You can use Azure PowerShell scripts if you need to make or change slots.

Tip: Make your pipeline with clear steps like Build, Test, Deploy, and Validate. This helps you find problems faster and keeps things neat.

Connect to Slot

You need to connect your pipeline safely to the right App Service slot. Follow these tips to keep your deployment safe:

• Use service endpoints or private endpoints to limit who can publish to your App Service slot.

• Put build agents inside a Virtual Network (VNet) with service endpoints for safe publishing.

• Keep secrets like connection strings in Azure Key Vault. Use them in your pipeline so you do not show private info.

• Give role-based access control (RBAC) at the App Service level. Only give the permissions needed, like Contributor or custom roles.

• Make sure everyone who uses the pipeline has multi-factor authentication (MFA).

These steps help you decide who can deploy and keep your app safe.

Define Stages

Stages split your pipeline into smaller parts. Each stage does an important job in your deployment. For example, you can have stages for Build, Test, Deploy to Staging, Validate, and Swap to Production.

• Add manual approval checks at the start or end of important stages, like before swapping to production.

• Use rules to decide when each stage should run. For example, only swap if the validation stage works.

• Put deployment jobs inside stages to do things like slot swaps.

When you set up clear stages and approvals, your deployments are safer and easier to handle.

Configure DevOps Approvals

Protect Production Environment

You need to keep your production slot safe. This helps your app stay stable. In Azure DevOps, you can mark the production slot as protected. This stops people from sending code straight to production. It lets you control what goes live.

Here are some good ways to protect your production environment:

1. First, deploy your app to a staging slot. Only swap to production after you test it.

2. Do not let anyone deploy straight to production. This keeps your live app safe from mistakes.

3. Use special rules in your deployment templates. Only let production deployments happen if you set a special flag.

4. Set the app setting WEBSITE_ADD_SITENAME_BINDINGS_IN_APPHOST_CONFIG=1 on all slots. This stops restarts after swaps.

5. Automate your builds and deployments. Always send updates to non-production slots first. Then swap to production.

6. Run health checks before you swap. Only swap if your app is healthy.

Tip: Always use strong access control. Only give users the permissions they need. Use Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA). This keeps your environment safe. Check who has access often. Remove users who do not need it anymore.

You should keep secrets in Azure Key Vault. This keeps passwords and keys safe. Scan your code for secrets before you deploy. These steps help stop leaks and keep your app secure.

Add Approval Step

You can add a manual approval step before you deploy. This step makes sure someone checks the deployment first. You can do this in both classic and YAML pipelines.

Classic Pipeline:

1. Open your release pipeline and go to the production stage.

2. Add an agentless job at the start of the deployment.

3. Add a Manual Intervention task to this job.

4. Give it a display name and write clear instructions for the approver.

5. Pick who gets notified and set what happens if no one answers in time.

6. Save your pipeline.

YAML Pipeline Example:

jobs:
- job: waitForValidation
  displayName: Wait for external validation
  pool: server
  steps:
  - task: ManualValidation@0
    inputs:
      notifyUsers: |
        your-approver@example.com
      instructions: 'Please review and approve this deployment to production.'
      onTimeout: 'reject'

This step stops the pipeline. The deployment will not go on until someone approves it. You can set a timeout so the pipeline does not wait forever.

Note: You can also set up approvals and checks on the environment. Go to your environment and pick "Approvals and checks." Add the users or groups who can approve deployments.

Assign Approvers

Picking the right approvers is important for safe deployments. You can add users or groups as approvers. If you use a group, only one person needs to approve.

Here are some tips for picking approvers and setting rules:

1. Add users or groups who know the app and understand the risks.

2. Decide if approvers can approve their own deployments. For more control, do not let people approve their own work.

3. Set a timeout for approvals. If no one approves in time, the deployment will skip or fail.

4. Remember, the list of approvers is set when the approval check starts. Changes after that do not count for the current run.

You should also set clear rules for compliance and accountability:

• Make sure everyone knows the rules and where to find them.

• Teach new team members how to handle approvals.

• Review and update your rules often.

• Use audit trails to track who approved each deployment.

• Assign a compliance officer or team to watch the process.

• Use dashboards to watch compliance in real time.

Tip: Use controls like approval workflows and audit logs. These help you track every deployment and hold people responsible.

By following these steps, you make DevOps approvals a strong part of your process. You protect your production slot, add checks before going live, and make sure only the right people can approve changes.

Deploy and Swap

Deploy to Staging

You start by deploying your new code to the staging slot. This slot acts like a copy of your production environment. It lets you test updates without affecting your live app.

1. Set up your CI/CD pipeline to deploy every new build to the staging slot.

2. Use the staging slot to check if your app works as expected.

3. Make sure the staging slot matches your production settings. This helps you catch problems early.

Staging slots help you find bugs before users see them. You can also prewarm the app in staging. This means your app is ready to go live with no delay.

Many teams use more than one slot for testing, QA, or canary releases. This gives you more control and lets you move builds closer to production step by step.

Test Changes

After you deploy to staging, you need to test your changes. Use the staging slot’s URL to open the app and check its features.

• Run manual or smoke tests to make sure everything works.

• Prewarm the app in staging to avoid slow starts when you swap.

• Use the staging slot to test new versions and roll back if you find issues.

• Try routing a small part of your real traffic to the staging slot. This helps you see how the app works under real conditions.

Tip: Use the "Swap with Preview" feature to pause before the swap. This lets you review settings and make sure the app is ready.

Testing in staging keeps your production slot safe. You can fix problems before they reach your users.

Swap with Approval

When your tests pass, you can swap the staging slot with production. DevOps approvals play a key role here. They make sure only trusted people can move changes live.

1. Your pipeline pauses after staging deployment. It waits for a DevOps approval before swapping.

2. An approver checks the staging slot and confirms the app is ready.

3. After approval, the pipeline swaps the staging slot with production. The swap is fast and does not cause downtime.

4. If you find problems after the swap, you can swap back to restore the old version.

# Example: Swap with approval in YAML pipeline
- job: SwapSlots
  dependsOn: DeployToStaging
  pool: server
  steps:
    - task: ManualValidation@0
      inputs:
        notifyUsers: 'approver@example.com'
        instructions: 'Approve to swap staging with production.'
        onTimeout: 'reject'
    - task: AzureAppServiceManage@0
      inputs:
        action: 'Swap Slots'
        sourceSlot: 'staging'
        resourceGroupName: 'your-resource-group'
        webAppName: 'your-app-name'

Approvals add a checkpoint. You control when and how updates go live. This reduces risk and keeps your app stable.

Swapping slots with DevOps approvals gives you zero-downtime deployments. You do not need to stop your app or restart services. The swap is quick, and users do not notice any change. If something goes wrong, you can roll back by swapping again.

Using deployment slots with approvals is safer than traditional methods. Old ways often mean stopping the app and risking downtime. With slots and approvals, you test first, approve, and swap with confidence.

Monitor and Rollback

Track Approvals

You need to know who approves each deployment. Azure DevOps gives you different ways to check this.

• Go to your Azure DevOps project and click Pipelines.

• Choose your pipeline and press Edit.

• Click the History tab to see who made changes and when.

• Use Compare Difference to find out what changed.

• Use Revert Pipeline if you want to undo a change.

Azure DevOps Environments show details for approvals and checks. You can see who approved what and when. You can also look at deployment history and change permissions. For updates right away, add the Azure Pipelines app in Microsoft Teams. This app sends messages about pipeline status and approvals.

Tip: Use monitoring tools like Datadog to watch deployments and approvals. Datadog dashboards show live status and can stop deployments if health checks fail.

Rollback Deployments

Sometimes, you need to undo a deployment. Azure App Service makes this simple with deployment slots.

1. Swap the staging slot with production to go back to the last good version.

2. Use Azure DevOps pipelines with tags and retention rules. This lets you deploy an older stable build.

3. Use feature flags to turn off new features without rolling everything back.

4. Always know your "last known good" state. This helps you know what to go back to.

5. Keep enough resources to run two versions if you need to swap back.

You should test and watch every deployment. If you find a problem, fix it fast. Talk with your team and review what happened to do better next time.

Audit and Best Practices

Auditing helps you follow rules and improve your process. Use these best practices:

Note: In some industries, you must keep full audit trails and use strong access controls. Automate compliance reports and check them often.

For ongoing management, use version control for all code and infrastructure. Test your rollback steps. Watch your pipelines and stop them if something fails. Use peer reviews and keep backups. Use GitOps to manage deployments and approvals in a clear way.

---

You can turn on DevOps approvals for production slots by doing these things:

1. Make environments in Azure Pipelines. Set up staging and production slots.

2. Add approval checks. Pick who will approve before you deploy to production.

3. Change your pipeline. Add steps for manual approval and swapping slots.

DevOps approvals help keep your deployments safe. They also make it easy to track who did what. Good approvals stop risky changes and help you follow the rules. If you want more advanced approvals, try using multi-stage pipelines and release gates in Azure DevOps.

Tip: Microsoft Learn has step-by-step guides and fun lessons. These can help you learn about approval workflows and keeping your pipeline secure.

FAQ

What is a deployment slot in Azure App Service?

A deployment slot is a live app copy. You use it to test changes before moving them to production. This helps you avoid downtime and catch issues early.

How do DevOps approvals help my deployment process?

DevOps approvals add a checkpoint. You or your team must review and approve changes before they reach users. This step keeps your app safe and reduces mistakes.

Can I automate the approval process?

You can automate some approvals for low-risk changes. For high-risk updates, you should keep manual approvals. Use Azure DevOps policies to set these rules.

What happens if an approver does not respond?

If no one approves in time, the deployment will pause or fail. You can set a timeout in Azure DevOps to control what happens next.

How do I roll back a failed deployment?

You can swap the production slot with the staging slot to restore the last good version. This process is quick and does not cause downtime.