In this blog post Avoid Azure App Service Certificate Renewal Surprises Before 2027 we will explain why a certificate that appears to be automatically managed can still fail at renewal, what is changing in March 2027, and what technology leaders should do now.
The business risk is easy to underestimate. Your Azure application may be healthy, its certificate may show auto-renewal as enabled, and nobody may see an obvious warning until a renewal becomes stuck waiting for proof that your organisation still controls the domain.
If that certificate expires, customers and employees may see security warnings or lose access entirely. For a customer portal, booking system, integration endpoint or internal business application, a small administrative gap can quickly become an operational incident.
What an Azure App Service Certificate actually does
Azure App Service is Microsoft’s managed platform for hosting websites, business applications and application programming interfaces, which allow different systems to exchange information. A certificate protects the connection to an application by encrypting information sent between the user and Azure.
CPI Consulting helps organisations design, build and secure Azure AI solutions, from Azure OpenAI and Microsoft Foundry to agents, governance and production deployment.
Visit CPI ConsultingIt also confirms that the application using a company domain, such as portal.example.com.au, is authorised to use that name. Before issuing or renewing the certificate, the certificate provider must therefore verify that the applicant controls the domain.
This is called domain ownership validation. It does not assess whether the business itself is trustworthy; it simply proves that the person requesting the certificate controls the relevant domain or its technical configuration.
What changes in March 2027
Microsoft has confirmed that email-based validation for purchased Azure App Service Certificates will stop in March 2027. This is the method where an approval message is sent to an address associated with the domain and someone clicks a link to confirm ownership.
After the change, organisations will need to use another supported option, such as App Service verification, domain verification or manual verification through a DNS TXT record. DNS, or the Domain Name System, is the service that connects a domain name to the systems behind it.
This article focuses on purchased App Service Certificates, often shortened to ASC. They are different from free App Service Managed Certificates, known as ASMC, even though both can protect applications hosted on Azure.
For a closer look at the retirement of email approval, read our related guide on why Azure App Service email validation ends in 2027. The bigger issue covered here is how this change fits into the wider certificate renewal process.
Why auto-renewal may not be enough
Auto-renewal can create a false sense of security. Azure can manage the renewal workflow, store the certificate in Azure Key Vault and synchronise it with an App Service application, but it cannot always complete a new certificate order without valid domain ownership evidence.
Certificate lifetimes are also becoming shorter. App Service Certificates issued from March 2026 have a validity period of 198 days, and domain validation may need to be completed more frequently for issuance, renewal or rekeying.
Rekeying means creating a replacement certificate with new encryption keys. It is sometimes required after a security concern or configuration change, but it can also trigger another validation step.
The business outcome is straightforward. Certificate management is no longer an annual calendar reminder; it is an ongoing operational process that needs ownership, monitoring and access to DNS.
Where renewal failures usually begin
1. Nobody knows who controls DNS
The Azure team may manage the application while an external agency, domain registrar or former IT provider controls DNS. When Azure requests a TXT record, the application owner discovers that nobody has current login details or approval authority.
Resolving that issue during a planned review is inconvenient. Resolving it while a customer-facing application is approaching certificate expiry is considerably more expensive.
2. Email approval is embedded in the process
Some organisations have renewed certificates for years using an address such as admin@ or administrator@. The process works until March 2027, but it may not work at the next renewal after the retirement takes effect.
Check the actual validation method rather than assuming that auto-renewal has removed the dependency.
3. Azure Key Vault access has changed
Azure Key Vault securely stores certificates, passwords and other sensitive information. A renewal can be issued successfully but still fail to reach the application if permissions, subscriptions or resource relationships have changed.
This often happens after a cloud clean-up, security hardening project or handover between providers. The change may look harmless at the time because the current certificate continues working until renewal.
4. The renewed certificate is not bound to every application
A certificate binding tells Azure which certificate should protect a particular domain. Businesses with multiple production slots, regional environments or applications sharing a certificate need to confirm that every required binding updates correctly.
Do not treat “certificate issued” as the end of the test. Confirm that the live application is presenting the new certificate and that monitoring is checking the public endpoint.
A common scenario for a growing business
Consider a 200-person company with a customer portal hosted on Azure App Service. The certificate was purchased several years ago, auto-renewal is enabled, and domain approval has historically gone to an email inbox maintained by the company’s previous web developer.
The internal IT team manages Microsoft 365 and Azure, but DNS remains with the developer’s registrar account. When the next renewal requires a different validation method, Azure cannot complete it without a DNS change that nobody inside the company can authorise.
The technical fix may only require a small TXT record. The real delay comes from finding the domain owner, recovering access, passing identity checks and coordinating changes between several parties.
An inventory and ownership review completed now turns that potential outage into a routine task.
What your IT team should do before March 2027
- Inventory purchased App Service Certificates. Record the certificate name, protected domains, expiry date, renewal setting, business owner, application owner and DNS provider.
- Confirm the current validation method. Flag every certificate that still depends on email approval.
- Verify DNS access. Ensure at least two authorised people can make or approve DNS changes. Store recovery details in an approved password management system.
- Select a replacement validation method. DNS TXT validation is often a practical choice because it provides clear evidence of domain control, but the right method depends on how the domain and application are managed.
- Check Azure Key Vault and application permissions. Confirm Azure can store, retrieve and synchronise the renewed certificate.
- Test the complete lifecycle. Validate issuance, storage, synchronisation, binding and the certificate presented by the live endpoint.
- Add monitoring and escalation. Alerts should reach a monitored service channel, not one employee’s inbox. Set warnings early enough to allow for DNS access or provider delays.
Your team can use Azure CLI, Microsoft’s command-line management tool, to support the inventory process. For example:
az resource list \
--resource-type Microsoft.CertificateRegistration/certificateOrders \
--output table
az resource show \
--resource-group <ResourceGroupName> \
--name <CertificateName> \
--resource-type Microsoft.CertificateRegistration/certificateOrders
az webapp config ssl list \
--resource-group <ResourceGroupName> \
--name <AppName>These commands help locate certificate order resources and review certificates associated with an application. They should support, rather than replace, a documented review of domain ownership and business impact.
Treat certificate renewal as business continuity
The March 2027 change is not simply an Azure configuration update. It is a reminder that ownership of domains, certificates and cloud permissions must remain clear when employees, agencies and IT providers change.
CloudProInc approaches these reviews from both an operational and security perspective. As a Microsoft Partner and Wiz Security Integrator with more than 20 years of enterprise IT experience, we look beyond the certificate itself to the Azure application, Key Vault configuration, access controls, monitoring and recovery process.
If you are unsure which Azure applications still rely on email validation, or whether auto-renewal will work end to end, we are happy to review the setup and identify the gaps before they become renewal surprises.