we are deploying some app services into Azure behind an Azure web application firewall, we already have some applications running on servers behind them, these are secured end to end using SSL. But what I can’t get my head around is what security or protection we are to implement on the app services and how, I’m thinking it must be Azure AD OAuth or something similar, am I on the right track? Or is there a way I’ve missed, or can we use certificates?
SnapOverflow
If all you are looking to do is enable end to end encryption of traffic between App Gateway and your app then you can do this. This doc details how to enable e2e encryption with App Gateway.
If you want to authenticate the connection between App Gateway and your backend then that is more tricky. Currently App Gateway does not support mutual TLS authentication, or any sort of token based auth.