Azure App Service is now a trigger destination for Azure Managed Connectors

Azure Managed Connectors, currently in public preview, now lets you choose Azure App Service as a trigger destination. Connector events can be delivered directly to applications running on App Service, including ASP.NET Core, Java, Node.js, and Python applications.

This is a new capability in the Managed Connectors public preview. It is not the announcement of a separate App Service preview.

What's new

When you create a trigger in the Managed Connectors portal, App Service now appears as a first-class destination alongside Azure Functions and the generic HTTP endpoint option.

After selecting an existing App Service app, you configure:

• The application route that receives the event. New triggers default to POST /api/webhook, and the route can be edited.
• The Connector Namespace managed identity used to authenticate the callback.
• The Microsoft Entra audience expected by the receiving application.

Managed Connectors then records the selected App Service resource, route, managed identity, and audience as part of the trigger configuration. You no longer need to select the generic HTTP destination and manually assemble the App Service callback URL.

What are managed connectors?

Managed connectors provide a consistent way for applications to integrate with services such as Office 365, SharePoint, Teams, Dataverse, and Salesforce. A Connector Namespace manages connections and connector operations so developers do not need to build a separate OAuth flow and service-specific client for every integration.

Managed connectors support both directions:

• Triggers deliver events to your application, such as a new Outlook email or a file added to SharePoint.
• Actions let your application call operations such as posting a Teams message, flagging an email, or creating a list item.

The App Service destination makes the trigger side a first-class option for existing web applications and APIs.

How it works

1. In the Managed Connectors portal, create a trigger and select App Service as its destination.
2. Select the web app, callback route, Connector Namespace managed identity, and Microsoft Entra audience.
3. When the source event occurs, Managed Connectors requests a token using the selected managed identity and sends the event to the App Service route.
4. App Service built-in authentication validates the token before the request reaches application code.
5. The application processes the event and can use Managed Connectors actions to continue the workflow.

The callback is an ordinary authenticated HTTP request, so the application can use its normal framework, routing, dependency injection, logging, monitoring, and deployment practices.

Configure receiving-app authentication

The App Service destination configures the Managed Connectors side of the callback. The receiving application must still be configured to trust it.

The reference sample uses App Service built-in authentication, also known as Easy Auth, with:

• A Microsoft Entra application that identifies the receiving application and its audience.
• A secretless federated credential configuration.
• The Connector Namespace managed identity pinned as an allowed principal.
• Authentication required for requests reaching the application.

This configuration rejects unauthenticated requests and allows callbacks carrying the expected managed-identity token. The Managed Connectors trigger wizard does not currently create or update the App Service authentication configuration automatically.

Try the end-to-end sample

The Managed Connectors on Azure App Service email-triage sample demonstrates a complete workflow:

1. An Office 365 Outlook trigger delivers a new email to an ASP.NET Core application on App Service.
2. App Service built-in authentication validates the managed-identity callback.
3. The application classifies the message and enriches the sender through the Office 365 Users connector.
4. Important mail produces a Microsoft Teams triage card.
5. The application flags the source email in Outlook.

The repository includes the application, Bicep infrastructure, App Service authentication configuration, Connector Namespace connections, and an Azure Developer CLI deployment flow.

We validated the complete workflow end to end: the authenticated callback reached POST /api/webhook, the application processed the event, a Teams card was posted, and the source Outlook message was flagged.

Current limitations

• The capability is configured through the Managed Connectors portal, not the App Service portal.
• The wizard configures the Managed Connectors trigger but does not configure App Service built-in authentication on the selected web app.
• The current sample authentication setup requires a Microsoft Entra application, audience configuration, federated credential, and allowed-principal configuration.
• Depending on the application's Easy Auth configuration, authentication can apply to the whole application rather than only the connector callback route.
• The reference sample validates one push-trigger scenario; it is not a compatibility statement for every connector and operation.

What's next

The first-class App Service destination removes the generic callback URL step and provides an App Service-aware trigger experience in Azure Managed Connectors.

We are also exploring ways to simplify receiving-side authentication so applications can establish connector-scoped trust without manually assembling the App Service authentication configuration.

Try the reference sample and share feedback on the connectors and App Service scenarios you want to use.