What is Managed Instance on App Service?
Managed Instance on Azure App Service is a plan-scoped hosting option for Windows web apps that need operating system customization, optional private networking and secure integration with Azure resources. It targets legacy or infrastructure-dependent workloads that rely on Component Object Model components, registry access or Microsoft Installer packages, while retaining App Service’s managed patching, scaling, diagnostics and identity features.
Microsoft notes that Managed Instance is generally available for Windows web apps in select regions and is limited to the Pv4 and Pmv4 pricing plans. More regions will be added over time. Linux and containers are not supported.
Core Features
Network and compute isolation: Plan-level virtual network integration, which can be added after creation, with private endpoints, custom routing, NSG support, NAT gateways, route tables and private DNS, plus dedicated compute for predictable performance.
Custom component support: PowerShell install scripts configure COM components, registry values, IIS configuration and ACLs, MSI installers, non-Microsoft components and Windows services, GAC installations, Windows features such as the MSMQ client and server roles, and custom frameworks.
Registry adapters and Key Vault: Registry keys can be defined at the plan level with secret values stored in Azure Key Vault.
Flexible storage: Azure Files with Key Vault integration, UNC paths and network share access, scripted drive mapping, and 2 GB of local, non-persistent storage.
Managed identity and operations: System-assigned and user-assigned identities at the plan level enable keyless authentication. The platform manages load balancing, patching and scaling, including horizontal autoscale and vertical scale for Pv4 and Pmv4.
Diagnostics over just-in-time RDP: Azure Bastion provides access to logs, Event Viewer and IIS Manager; virtual network integration is required.
Typical Use Cases
Legacy Windows compatibility: Applications with COM components, registry modifications and MSI installers that need IIS Manager access and RDP for diagnostics, plus network shares via UNC paths.
Migration with minimal refactoring: Lift and improve for legacy .NET Framework apps and gradual modernization without complete rewrites.
Windows-specific customization: PowerShell install scripts for startup configuration, Windows features like MSMQ or server roles, and custom non-Microsoft components in the GAC.
Compliance-driven isolation: Plan-level network isolation for regulated environments.
Benefits
- Run infrastructure-dependent Windows applications without managing VMs yourself
- Retain the managed App Service capabilities for patching, scaling and diagnostics
- Plan-level network isolation with private endpoints and custom routing
- Secure configuration through Key Vault-backed registry adapters and managed identity
- Diagnostic access via just-in-time RDP through Azure Bastion instead of permanently open access
- Integration with common CI/CD paths through GitHub Actions, Azure DevOps and zip or package deploy
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you in migrating existing Windows applications to Managed Instance on App Service: dependency analysis, authoring and testing install scripts, network and Key Vault design, logging strategy, and building the CI/CD pipeline.
Contact us for a no-obligation consultation on modernizing .NET applications on Azure.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Managed Instance on App Service?
Managed Instance on Azure App Service is a plan-scoped hosting option for Windows web apps that need operating system customization, optional private networking and secure integration with Azure resources. It targets legacy or infrastructure-dependent workloads using COM, registry or MSI while retaining App Service's managed patching, scaling, diagnostics and identity features.
Is Managed Instance generally available?
Microsoft states: 'Managed Instance is generally available for Windows web apps in select regions and is limited to Pv4 and Pmv4 pricing plans.' Microsoft will add more regions over time. Linux and containers are not supported.
In which regions is Managed Instance available?
The documentation names East Asia, West Central US, North Europe, East US, Australia East, Central India and South India.
How are persistent system customizations applied?
Through configuration (install) scripts: you upload zipped PowerShell scripts to Azure Storage, accessed via managed identity. The scripts run at startup for persistent configuration. Changes made in an RDP session are temporary and lost after restart or platform maintenance.
How does RDP access work?
RDP is just-in-time access via Azure Bastion and requires virtual network integration. Over RDP you can reach logs, Event Viewer and IIS Manager for diagnostics. Microsoft notes that RDP is diagnostics-only.
When is standard App Service or an App Service Environment the better choice?
According to Microsoft, standard App Service suits modern, cloud-native development with multiple languages, Linux or containerized workloads and no need for OS customization. An App Service Environment addresses enterprise-scale isolation with fully isolated, dedicated infrastructure, deployments supporting 100+ applications and complete network boundary control.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
