Document deploying AuthProxy on Azure App Service and Container Apps

[woksin]

Summary

Deploy AuthProxy on Azure with Microsoft Entra ID sign-in and network isolation for the services behind it.

Added

• A guide to deploying AuthProxy on Azure: registering the application in Microsoft Entra ID, restricting who may sign in, trusted proxies, Data Protection keys, streaming timeouts and health probes, with settings for App Service and Container Apps. (Document deploying AuthProxy on Azure (App Service, Container Apps) with backend isolation #156)
• Backend isolation recipes for App Service and Container Apps, with a direct-access probe that rejects unexpected HTTP responses and indeterminate transport failures, and requires both an expected status and a distinctive platform marker to accept an HTTP refusal. See Deploying on Azure. (Document deploying AuthProxy on Azure (App Service, Container Apps) with backend isolation #156)
• Container Apps guidance for upstream proxies that retains ForwardLimit=1 for publicly reachable origins in TrustAny mode, and requires origin restrictions or verified trusted hops plus a direct-origin spoofed-header check before increasing the limit. (Document deploying AuthProxy on Azure (App Service, Container Apps) with backend isolation #156)

[woksin]

Reviewer note: the guide links to pages added by #166 (services.md#timeouts-and-streaming) and #168 (configuration/data-protection.md), so merge those two first or the links 404 until they land. The Azure platform behaviour (private endpoints, access restrictions, internal ingress, probes, ingress timeouts) was checked against the Microsoft Learn sources; AuthProxy settings were checked against the configuration classes. Gotchas worth a look: Container Apps internal ingress is reachable from every app in the environment, and AuthProxy only supports a client secret for Entra (certificate/federated credentials are #149).