Which Azure App Service Apps Can Use an Uploaded Private Certificate?

AZ-500 By islever Editorial Last updated

Plan and implement security for public access to Azure resources

Short answer

B App1 and App2 only can use Cert1 because they share the same resource group, region, and operating system webspace.

Question

You have an Azure subscription that contains the Azure App Service web apps shown in the following table. You upload a private key certificate named Cert1.pfx to App1. Which apps can use Cert1? - Exhibit: Which Azure App Service Apps Can Use an Uploaded Private Certificate?
  1. App1 only
  2. App1 and App2 only Correct Answer
  3. App1 and App4 only
  4. App1, App2, and App3 only
  5. App1, App2, App3, and App4

Key Takeaways

This question tests the App Service webspace sharing rule for private certificates, and the common trap is assuming the certificate is isolated to the single app it was uploaded to.

When a private certificate is uploaded to an Azure App Service web app, it is stored in a deployment unit (webspace) bound to the resource group, region, and OS. This page establishes that apps sharing these three attributes can use the certificate.

Common mistake: Choosing App1 only (Option A) because one assumes an uploaded private certificate is exclusively bound to the specific app rather than shared across the webspace.

Expert Analysis

Why the Answer Is Correct

The correct answer is B because when a private key certificate is uploaded to an Azure App Service app, it is stored in a deployment unit called a webspace. This webspace is bound to the App Service plan's resource group, region, and operating system combination. Since App1 and App2 share the same resource group, region, and OS, they exist in the same webspace and both can use the certificate.

Why the Other Options Are Wrong

Option A is incorrect because it assumes the certificate is only available to the app it was uploaded to, ignoring the webspace sharing behavior. Options C, D, and E are incorrect because they include App3 or App4, which reside in different regions or resource groups and therefore exist in different webspaces, making the certificate inaccessible to them.

Community Comment Notes

Several commenters referenced the official documentation stating that a private certificate is stored in a deployment unit bound to the "resource group, region, and operating system combination". As Apptech noted, "only App1 and App2 can use Certificate" because they share these three attributes. Some users mistakenly selected A despite quoting this shared webspace behavior.

Official Reference

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal

This link opens the official vendor documentation in a new tab.

Exam Strategy

For App Service certificate questions, remember the 'webspace' rule: private certificates are shared across apps in the same resource group, region, and OS combination. Do not assume certificates are isolated to a single app.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Pamban 👍 9 Answered A
    I would go with as as per below explanation After you add a private certificate to an app, the certificate is stored in a deployment unit that's bound to the App Service plan's resource group, region, and operating system combination, internally called a webspace. That way, the certificate is accessible to other apps in the same resource group, region, and OS combination. Private certificates uploaded or imported to App Service are shared with App Services in the same deployment unit. Link: https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex
  2. Jimmy500 👍 3
    After you add a private certificate to an app, the certificate is stored in a deployment unit that's bound to the App Service plan's resource group, region, and operating system combination, internally called a webspace. That way, the certificate is accessible to other apps in the same resource group, region, and OS combination. Private certificates uploaded or imported to App Service are shared with App Services in the same deployment unit. You can add up to 1000 private certificates per webspace. I think A
  3. Apptech 👍 1
    Store certificate in Azure Key Vault: make sure to use the same subscription and resource group as your App Service app. For that reason only App1 and App2 can use Certificate. https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal
  4. jaci 👍 1
    When you upload a certificate to App Service, it's stored in the App Service instance's Key Vault. Key Vault is a global service in Azure, meaning it can be accessed from different regions.
  5. Alagong 👍 1
    Why not A?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Entra Permissions Management Highly Privileged Roles

S-grade

Restricting AKS API server access to specific networks is done with authorized IP address ranges

S-grade

Cross-tenant access settings for B2B collaboration apply only to Microsoft Entra ID tenants, not to Google or Microsoft accounts

S-grade

Creating an allow list of a partner's cloud apps for your users is configured via Outbound access settings in Cross-tenant access settings

S-grade

← Back to AZ-500 Study Guide