Impossible to export key-values to an "App Service" in different environnement (in another resource group or subscription)

[Philippe85]

An App Configuration is planned to manage groups of key-values for each environnements (with labels).

If we have a subscription for each environnement, we need to have only one App Configuration to store data for all environnement (with labels). So, we need to be able to export App Configuration to App Service in another subscription/resourcegroup.

It is possible manually in Azure Portal, but not by automation with Azure CLI or Azure PowerShell.
az appconfig kv export can work only in the same resource group ! So it is unusable.

[avanigupta]

Hello @Philippe85, you can achieve this by providing the complete resource ID of your App Service as an argument to the az appconfig kv export command:

az appconfig kv export -n <AppConfigName> -d appservice --appservice-account /subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupId>/providers/Microsoft.Web/sites/<AppServiceName>

[Philippe85]

Thank you @avanigupta.

With the resource ID, I can export key/values to an App Service in other resource group, but in the same subscription.
If the App Configuration and the App Service resources are in differents subscriptions, I get this error :

Failed to read key-values from appservice.
(ResourceGroupNotFound) Resource group 'xxx' could not be found.

xxx is the ResourceGroupId in this resource ID :
/subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupId>/providers/Microsoft.Web/sites/<AppServiceName>

[avanigupta]

@Philippe85, in Azure CLI, you can only set one subscription as your default subscription. This means that if your default subscription is the one which contains your AppConfig store, you will not be able to access your AppService instance for the import/export commands. You can still achieve inter-subscription import/export by making 2 changes:

1. Set your default subscription as the one which contains AppService:
In your example above, if xxx is the subscription that contains your AppService instance, you can run this command in Azure CLI before running the import/export commands:
az account set -s "xxx"

2. Connect to AppConfig using connection string:
Since your default subscription no longer contains the AppConfig store, you cannot connect using the store name.

az appconfig kv export --connection-string <AppConfigConnectionString> -d appservice --appservice-account /subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupId>/providers/Microsoft.Web/sites/<AppServiceName>

Alternatively, if want to use AAD authentication and have the proper roles assigned to your identity, you can also provide AppConfig endpoint with login auth mode:

az appconfig kv export --auth-mode login --endpoint <AppConfigEndpoint> -d appservice --appservice-account /subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupId>/providers/Microsoft.Web/sites/<AppServiceName>

[Philippe85]

Thank you. I succeeded to export data to an App Service in another subscription with the connection string.
But I would use the solution using AAD authentication and in Azure CLI, with this command:
az appconfig kv export --auth-mode login --endpoint <AppConfigEndpoint> -d appservice --appservice-account /subscriptions/<SubscriptionId>/resourceGroups/<ResourceGroupId>/providers/Microsoft.Web/sites/<AppServiceName>

I have this error :

Failed to connect to MSI. Please make sure MSI is configured correctly.
Get Token request returned: <Response [400]>

[avanigupta]

Are you running these commands on your local machine?
I'm assuming you ran az login --identity which is used for managed identity login. The command needs to be run from an Azure VM with managed identity configured. For more details, please check Sign in with a managed identity.

[zhenlan]

@Philippe85 please reopen if further assistance is needed.