--- title: "Upgrade an existing App Service web app" slug: "upgrade-an-existing-app-service-web-app" description: "Upgrade the Azure App Service inbound web app to .NET 10, configure managed identity and BISAdmin, then connect and test D365 F&SCM." tags: ["Task", "Connectivity Studio", "CS"] status: "new" updated: 2026-11-10T08:21:41Z published: 2026-11-10T08:21:41Z canonical: "docs.staedean.com/upgrade-an-existing-app-service-web-app" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.staedean.com/llms.txt > Use this file to discover all available pages before exploring further. # Upgrade an existing App Service web app If you already run a previous version of the inbound web app in Azure App Service, upgrade it to the new version. The new version connects to D365 F&SCM with the system-assigned managed identity of the web app. An app role controls who can edit the web app settings. You keep your existing web app, app registration and authentication setup. You only add the settings that the new version requires. > [!NOTE] > **Note** > > For a new installation, start with [Set up Azure Web App](/data-management/docs/set-up-azure-web-app). ## Deploy the new version Update the runtime stack of the existing web app, and deploy the ZIP file of the new version from STAEDEAN Support. Update the runtime stack first, because the new version requires .NET 10. 1. In the Azure portal, open the web app, and go to **Settings** > **Configuration** > **General settings**. 2. In the **.NET version** field, select **.NET 10 (LTS)**. For more information, refer to [Configure ASP.NET Core apps](https://learn.microsoft.com/en-us/azure/app-service/configure-language-dotnetcore). 3. Click **Save**, and confirm. 4. Deploy the ZIP file to the web app. Follow the steps in [Set up Azure Web App > Deploy the code to the web app](/data-management/docs/set-up-azure-web-app#deploy-the-code-to-the-web-app). ## Enable the managed identity Enable the system-assigned managed identity of the web app. The web app uses this identity to call D365 F&SCM, so no client secret, client ID or tenant ID is stored for that call. For more information, refer to [Add a system-assigned identity](https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity#add-a-system-assigned-identity). 1. In the Azure portal, open the web app, and go to **Settings** > **Identity**. 2. On the **System assigned** tab, set **Status** to **On**. 3. Click **Save**, and confirm with **Yes**. ## Assign the BISAdmin app role Users with the **BISAdmin** app role can change the settings of the web app. Without this role, the **Edit settings** button is not shown. Create the app role on the existing app registration, and assign it to users or groups in the enterprise application. For more information, refer to [Add app roles to your application](https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps) and [Assign users and groups to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal). 1. On the app registration, go to **App roles**, and click **Create app role**. 2. Enter the values for the app role. > [!NOTE] > **Note** > > Enter the value exactly as `BISAdmin`. The web app checks for this value to show the **Edit settings** button. - **Display name**: Enter `BISAdmin`. - **Allowed member types**: Select **Users/Groups**. - **Value**: Enter `BISAdmin`. - **Description**: Enter a description, for example `BISAdmin role`. - **Do you want to enable this app role?**: Select the checkbox. 3. Click **Apply**. 4. On the **Overview** page of the app registration, click the **Managed application in local directory** link. This link opens the enterprise application of the app registration. You assign users and groups to the app role in the enterprise application. 5. Go to **Users and groups**, and click **Add user/group**. 6. Select the users or groups that manage the web app settings, select the **BISAdmin** role, and click **Assign**. 7. If a user or group also has the **Default Access** role, select that assignment, and click **Remove assignment**. Keep only the **BISAdmin** assignment for these users and groups. ## Restart the web app Restart the web app to apply the identity and app role settings. 1. On the web app, go to the **Overview** page. 2. Click **Restart**, and confirm. ## Register the managed identity in D365 F&SCM The new version connects to D365 F&SCM with the managed identity of the web app. Register this identity in **Microsoft Entra ID applications**. Follow the steps in [Register Microsoft Entra ID application in D365 F&SCM](/data-management/docs/register-microsoft-entra-id-application-in-d365-fscm). > [!NOTE] > **Note** > > - Add a new record for the managed identity. Do not change or remove the existing record for the app registration. > - Use the **Application ID** of the managed identity, not the **Application (client) ID** of the app registration. ## Test the web app Check that you can edit the web app settings, and test the connection to D365 F&SCM. For more information, refer to [Configure the App Service web app](/data-management/docs/configure-the-app-service-web-app). 1. Sign out of the Azure portal completely, and sign in again. This makes sure that your new role assignment is used. 2. In the Azure portal, open the web app, and click **Browse** or click the **Default domain** link. 3. Click **Edit settings**. > [!NOTE] > **Note** > > - Only users with the **BISAdmin** app role see the **Edit settings** button. > - Role changes can take a few minutes to apply. If the button is still not shown, sign out of the web app and sign in again. 4. In the **URI** field, enter the web address of the D365 F&SCM environment. 5. In the **Company** field, enter the legal entity to connect to. 6. Click **Save changes**. 7. Click **Test connection**. If the connection succeeds, the status changes to **Connected**. ## Related - [Set up inbound web service - Azure App Service](/set-up-inbound-web-service-azure-app-service.md)