1# Post-Deployment Steps
2 
3Execute critical post-deployment configuration after infrastructure provisioning completes.
4 
5> ⚠️ **Run AFTER `azd up` or `azd provision` completes successfully**
6 
7## When to Apply
8 
9Post-deployment steps are required when your deployment includes:
10 
11| Scenario | Required Actions |
12|----------|-----------------|
13| **ASP.NET Core + Azure SQL + Managed Identity** | Grant managed identity SQL access, apply EF migrations |
14| **App Service + Azure SQL + Entra auth** | Grant App Service identity database permissions |
15| **Container Apps + SQL Database** | Configure managed identity access, run migrations |
16 
17## ASP.NET Core + EF Core + Azure SQL
18 
19Complete workflow for apps using Entity Framework with Azure SQL Database.
20 
21### Prerequisites
22 
23- `azd up` or `azd provision` completed successfully
24- App Service or Container App has system-assigned managed identity enabled
25- Azure SQL Server configured with Entra ID admin
26- EF Core project with migrations
27 
28### Step 1: Grant Managed Identity SQL Access
29 
30Grant the App Service or Container App's managed identity permissions on the SQL database.
31 
32See [SQL Managed Identity Access](sql-managed-identity.md) for detailed SQL scripts and examples.
33 
34**Quick Template:**
35 
36```bash
37# Get the app identity name from azd
38eval $(azd env get-values)
39APP_NAME=$SERVICE_API_NAME  # or SERVICE_WEB_NAME
40 
41# Connect as Entra admin and grant permissions
42# See sql-managed-identity.md for connection patterns
43```
44 
45**PowerShell:**
46```powershell
47# Get the app identity name from azd
48azd env get-values | ForEach-Object {
49    $name, $value = $_.Split('=', 2)
50    Set-Item "env:$name" $value
51}
52$AppName = $env:SERVICE_API_NAME  # or SERVICE_WEB_NAME
53 
54# Connect as Entra admin and grant permissions
55# See sql-managed-identity.md for connection patterns
56```
57 
58### Step 2: Apply EF Core Migrations
59 
60Apply Entity Framework migrations to create database schema.
61 
62See [EF Core Migrations](ef-migrations.md) for deployment patterns and troubleshooting.
63 
64**Quick Options:**
65 
66| Method | Command | Use When |
67|--------|---------|----------|
68| **azd hook** | Add `postprovision` hook in `azure.yaml` | Automated deployments |
69| **Manual** | `dotnet ef database update` | One-time or troubleshooting |
70| **SQL Script** | `dotnet ef migrations script --idempotent` | Pre-generated scripts |
71 
72### Step 3: Verify Deployment
73 
74```bash
75# Get app endpoint
76ENDPOINT=$(azd env get-values | grep SERVICE_.*_URI | cut -d'=' -f2)
77 
78# Health check
79curl -f "$ENDPOINT/health" || echo "Health check failed"
80 
81# Test database connectivity
82curl -f "$ENDPOINT/api/test-db" || echo "Database connection failed"
83```
84 
85**PowerShell:**
86```powershell
87# Get app endpoint
88$Endpoint = azd env get-values | Select-String -Pattern 'SERVICE_.*_URI' |
89    Select-Object -First 1 | ForEach-Object { ($_ -split '=', 2)[1] }
90 
91# Health check
92try { Invoke-WebRequest "$Endpoint/health" } catch { Write-Output "Health check failed" }
93 
94# Test database connectivity
95try { Invoke-WebRequest "$Endpoint/api/test-db" } catch { Write-Output "Database connection failed" }
96```
97 
98**Expected Result:**
99- HTTP 200 from health endpoint
100- No SQL authentication errors in logs
101- Application starts successfully
102 
103## Common Issues
104 
105| Error | Cause | Solution |
106|-------|-------|----------|
107| `Login failed for user '<token-identified principal>'` | Managed identity not granted SQL access | Follow [sql-managed-identity.md](sql-managed-identity.md) |
108| `Cannot open database` | Firewall rules block access | Check SQL firewall, ensure "Allow Azure services" enabled |
109| `Invalid object name` | Migrations not applied | Run EF migrations per [ef-migrations.md](ef-migrations.md) |
110| `No such table` | Schema missing | Apply migrations or check connection string database name |
111 
112## Best Practices
113 
1141. **Automate with azd hooks** — Add `postprovision` hook to `azure.yaml` for repeatable deployments
1152. **Use idempotent scripts** — Generate SQL with `dotnet ef migrations script --idempotent`
1163. **Verify incrementally** — Test SQL access, then migrations, then endpoint
1174. **Log everything** — Enable verbose logging during initial setup for troubleshooting
118 
119## References
120 
121- [SQL Managed Identity Access](sql-managed-identity.md)
122- [EF Core Migrations](ef-migrations.md)
123- [Verification Steps](verify.md)
124