Azure App Service: how to inventory and safely restore application settings wiped by an incomplete Terraform app_settings apply

Hello Grant Augustin,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having Azure App Service configuration loss issues after a Terraform deployment overwrite removed existing App Settings and Key Vault references.

The fact is that Terraform treats the app_settings block as an authoritative configuration state. During deployment, any App Settings not explicitly defined in Terraform were removed from the Azure App Service configuration, which resulted in deleted application settings, broken Key Vault references, configuration drift, and runtime failures after the application restart.

What you can do to fix is to:

• Immediately stop all Terraform apply or CI/CD deployment operations to prevent additional configuration overwrites
• Export the current App Service configuration before making changes using:

    az webapp config appsettings list \
    --resource-group <resource-group-name> \
    --name <app-service-name>
  

• Recover deleted App Settings from the most reliable available source, preferably:
  • Azure App Service Backups
  • ARM/Bicep deployment history
  • Terraform repository history
  • Pipeline artifacts
  • Azure Key Vault secret inventory
• Restore missing settings and Key Vault references safely using Azure CLI:

    az webapp config appsettings set \
    --resource-group <resource-group-name> \
    --name <app-service-name> \
    --settings KEY=value
  

• Validate Managed Identity access, Key Vault resolution, startup logs, and application health before restarting or redeploying the application
• Redesign the Terraform deployment model so Terraform fully manages all App Settings and Key Vault references, or intentionally exclude dynamic settings using:

    lifecycle {
    ignore_changes = [
    app_settings
    ]
  

After restoring the missing App Settings and implementing a controlled Terraform configuration management strategy, the Azure App Service configuration becomes stable again, prevents future destructive overwrites, and restores normal application runtime behavior.

Use the below resource links for more reading and implementation guidance:

Configure App Settings in Azure App Service

Back up and restore Azure App Service

Terraform AzureRM Linux Web App Documentation

Terraform Lifecycle Meta-Arguments Documentation

Azure Resource Manager Deployment History Documentation

Azure Key Vault Secrets Overview

I hope this is helpful! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.