3.2AZ-104Intermediate
Est: ~15 mins•Verified: 2026-08

Azure VM Scale Sets (VMSS) & Azure App Services

Configure elastic compute with Virtual Machine Scale Sets (VMSS) autoscale rules, upgrade policies (Automatic, Rolling, Manual), and deploy high-availability web applications using Azure App Service plans and deployment slots.

Tags:#Azure#Compute#VMSS#Scale Sets#Autoscale#App Services#Deployment Slots#AZ-104
01

Overview

Enterprise compute workloads require dynamic elasticity to handle unpredictable traffic spikes while minimizing idle cloud costs. In Microsoft Azure, two primary compute services fulfill this requirement:

  1. Virtual Machine Scale Sets (VMSS): Manage and configure a collection of identical, auto-scaling VMs across fault domains and availability zones.
  2. Autoscale Engine: Automatically adjusts instance counts based on metric rules (CPU %, memory %, queue depth) or predictable schedules (time-based scaling).
  3. VMSS Upgrade Policies: Dictates how OS image and configuration updates propagate to VM instances:
  • Automatic: Instantly updates all instances simultaneously with zero guarantees on capacity (potential downtime).
  • Rolling: Batches updates in staggered waves, validating health probes before advancing to the next batch.
  • Manual: Administrator explicitly triggers the upgrade per instance (Update-AzVmssInstance).
  1. Azure App Service: Platform-as-a-Service (PaaS) hosting web applications and REST APIs without managing underlying OS, with zero-downtime Deployment Slots (Staging to Production swap).

---

02

When to Use: VMSS vs Azure App Services

CapabilityVMSS (IaaS)Azure App Service (PaaS)
Operating System ControlFull root/admin access to Windows Server or Linux.Fully managed by Microsoft; no OS patching or administrative access.
Networking & Custom AgentsFull custom VNet integration, custom drivers, legacy COM components.Easy VNet integration, hybrid connections, serverless integration.
Scaling MechanismMetric/schedule-driven VM instance provisioning (takes 3–7 mins).Metric-driven container/worker scaling (takes seconds to minutes).
Deployment MechanismCustom Script Extensions, Golden Images, Cloud-init.Git, CI/CD pipelines, Docker containers, zero-downtime slot swapping.

---

03

Prerequisites

Administrator Permissions:

  • Virtual Machine Contributor and Network Contributor on the target resource group (for VMSS).
  • Website Contributor on the App Service Plan and App Service resource.

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Virtual machine scale sets > [Your VMSS]
│   ├── Scaling (Configure Autoscale metric conditions: scale-out / scale-in)
│   ├── Operating system (Select base image & upgrade policy: Automatic/Rolling/Manual)
│   └── Instances (Inspect instance health, manually re-image or upgrade)
└── App Services > [Your Web App]
    ├── Scale up (Change App Service Plan tier: Basic, Standard, Premium)
    ├── Scale out (Configure Autoscale rules)
    └── Deployment slots (Add staging slot and perform Swap)

---

05

Step-by-Step Implementation

Step 1: Deploy a VM Scale Set with Flexible Orchestration

  1. Navigate to Virtual machine scale sets > + Create.
  2. Configure:
  • Orchestration mode: Flexible (recommended for mixed VM types and availability zone balancing).
  • Fault domain count: 1 (for zone-redundant) or 2–3 (for single zone).
  • Image: Windows Server 2022 Datacenter or Ubuntu Server 22.04 LTS.
  • Instance count: Set minimum 2, default 2, maximum 10.

Step 2: Configure Autoscale Metric Rules

  1. In the VMSS, navigate to Scaling > select Custom autoscale.
  2. Scale out rule:
  • Metric: Percentage CPU
  • Operator: Greater than
  • Threshold: 75%
  • Duration: 10 minutes
  • Action: Increase count by 2, Cool down: 5 minutes.
  1. Scale in rule:
  • Metric: Percentage CPU
  • Operator: Less than
  • Threshold: 25%
  • Action: Decrease count by 1, Cool down: 5 minutes.

Step 3: Configure App Service Deployment Slots

  1. Navigate to your App Service (must be on Standard (S1) tier or higher).
  2. Under Deployment, select Deployment slots > click + Add Slot.
  3. Name: staging
  4. Clone settings from: Production.
  5. Deploy new application code to the staging slot.
  6. Verify functionality via https://-staging.azurewebsites.net.
  7. Select Swap to exchange staging with production with zero downtime.

---

06

Azure PowerShell & Azure CLI

PowerShell: Configure VMSS Rolling Upgrade Policy and Autoscale

PowerShell
# Connect and set context
Connect-AzAccount
Set-AzContext -SubscriptionId "<YOUR-SUBSCRIPTION-ID>"

$rgName = "rg-compute-core"
$vmssName = "vmss-web-prod"

# 1. Update VMSS Upgrade Policy to Rolling
$vmss = Get-AzVmss -ResourceGroupName $rgName -VMScaleSetName $vmssName
$vmss.UpgradePolicy.Mode = "Rolling"
$vmss.UpgradePolicy.RollingUpgradePolicy = New-Object Microsoft.Azure.Management.Compute.Models.RollingUpgradePolicy
$vmss.UpgradePolicy.RollingUpgradePolicy.MaxBatchInstancePercent = 20
$vmss.UpgradePolicy.RollingUpgradePolicy.MaxUnhealthyInstancePercent = 20
$vmss.UpgradePolicy.RollingUpgradePolicy.MaxUnhealthyUpgradedInstancePercent = 5
$vmss.UpgradePolicy.RollingUpgradePolicy.PauseTimeBetweenBatches = "PT0M"

Update-AzVmss -ResourceGroupName $rgName -Name $vmssName -VirtualMachineScaleSet $vmss

Write-Host "VMSS Upgrade Policy set to Rolling successfully." -ForegroundColor Green

Azure CLI: Swap App Service Deployment Slots

Bash / Shell
# Swap staging slot into production with zero downtime
az webapp deployment slot swap \
  --resource-group "rg-compute-core" \
  --name "app-ecommerce-core" \
  --slot "staging" \
  --target-slot "production"

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
VMSS instances automatically distribute evenly across specified Availability Zones (Zone 1, 2, 3).
Simulating high CPU load triggers scale-out rule within the defined 10-minute window.
During VMSS OS upgrades, health probe ensures at least 80% capacity remains healthy and online.
App Service deployment slot swap redirects production traffic without dropping active HTTP sessions.
App settings marked as Deployment slot setting remain pinned to the slot and do not swap.
08

Common Pitfalls & Troubleshooting Matrix

IssueRoot CauseResolution
VMSS flappping (rapid scale out and in)Scale-in threshold is too close to scale-out threshold.Increase margin between rules (e.g., scale out > 75%, scale in < 25%) and set cooldown to 10 mins.
App Service Swap fails with 500 errorConnection strings or database credentials swapped unexpectedly.Mark environment-specific configurations as Slot Setting (sticky) so they do not move during swap.
Rolling upgrade halts halfwayApplication health probe fails on newly upgraded batch of instances.Check application logs on failed instances; rolling upgrade halts to protect remaining healthy instances.
Cannot create deployment slotApp Service Plan is running on Free (F1), Shared (D1), or Basic (B1) tiers.Scale up the App Service Plan to Standard (S1), Premium (P1v3), or Isolated.

---

09

Real-World Architecture / Flow

Interactive Topology & Workflow
Incoming Web Trafficgateway
Stage 1
Flow & Verification Handshake
Azure Load Balancer / App Gatewaygateway
Stage 2
Flow & Verification Handshake
VMSS Instance 01 VMSS Instance 02compute
Stage 3
Flow & Verification Handshake
(Zone 1default

Healthy) (Zone 2 - Healthy)

Stage 4
Flow & Verification Handshake
Autoscale Enginecompute
Stage 5

---

10

Audit & Monitoring

  • Monitor VMSS autoscale actions in Activity Log:
  • Microsoft.Insights/autoscalesettings/scaleup/action
  • Microsoft.Insights/autoscalesettings/scaledown/action
  • Configure Application Insights on App Service to detect HTTP 5xx spikes during deployments.

---

11

Rollback & Emergency Recovery

  • Revert App Service Slot Swap:
  • Simply trigger the Swap operation again between production and staging to instantly restore the previous version.
  • Rollback VMSS Model:
  • Update the VMSS image reference back to the previous image version/tag and run Update-AzVmssInstance.

---

12

Official Documentation Reference

---

13

Exam Blueprint & Pro Tips (AZ-104)

Exam Blueprint & High-Yield Traps

AZ-104 High-Yield Rules:

  1. Upgrade Policy Modes: Remember that Automatic upgrades all instances at once. Rolling upgrades in batches using health probes. Manual requires admin intervention.
  2. Slot Sticky Settings: Database connection strings, API endpoints, and slot settings marked as Deployment slot setting do not swap. General code and application files do swap.
  3. Minimum Tier for Slots: Staging slots require Standard (S1) tier or higher. Basic tier does NOT support slots or autoscale.
  4. Scale-in Rule Rule-of-Thumb: Always include both scale-out and scale-in rules. Scale-in should have an adequate cool-down time to avoid resource flapping.
PREVIOUS TOPIC3.1 Virtual Machines: Availability Zones & Azure BastionNEXT TOPIC4.1 Virtual Networks: Subnets & VNet Peering