Skip to content
  1. We help small teams achieve big things.
  2. Our Technical Fellow just became a Microsoft MVP!
  3. We run the Azure Weekly newsletter.
  4. We just won 2 awards.
  5. We just published Programming C# 8.0 book.
  6. We run the Power BI Weekly newsletter.
  7. Our NDC London 2020 talk is now available online!
  8. We are school STEM ambassadors.
Howard van Rooijen By Howard van Rooijen Co-Founder
Azure Web Apps: Package Restore against a private NuGet Feed

Microsoft Azure Web Apps (formerly known as Azure Websites) has a very useful inbuilt continuous integration and deployment engine called Kudu (it's also open source; under an Apache 2.0 license, and you can also host it outside of Azure). Kudu supports a continuous integration and deployment workflow against VSO, GitHub, TeamCity, Hudson and BitBucket.

If you package any of your tools or libraries as private NuGet packages, exposed publically via authenticated private feeds using TeamCity, MyGet, ProGet or a custom NuGet Server, performing a package restore as part of the build process will fail as NuGet requires valid credentials to access the private feed.

A workaround is to add a custom NuGet.config file, stored at the same level as your .SLN file which will contain an entry for your private NuGet feed and also credentials stored in plain text. You cannot use encrypted credentials as the encryption is generated on a per-machine basis. It is also advisable to create a unique set of credential per application you are deploying with only enough rights to see the packages they require.

When you deploy via Kudu, this should allow the build process to discover your private feed, authenticate & restore your packages.

If you do not require authentication against your private feed, remove the <packageSourceCredentials> element.

In NuGet v3.0 the ability to read credentials from environmental variables has been added. This allows you to add your credentials via the app settings UI in the Azure Portal. This is a much better approach to take as it ensures that your NuGet feed credentials are not committed to your source control repo.

@HowardvRooijen

Sign up to Azure Weekly to receive Azure related news and articles direct to your inbox every Sunday, or follow @azureweekly on Twitter.

Howard van Rooijen

Co-Founder

Howard van Rooijen

Howard spent 10 years as a technology consultant helping some of the UK's best known organisations work smarter, before founding endjin in 2010. He's a Microsoft ScaleUp Mentor, and a Microsoft Azure MVP, and helps small teams achieve big things using data, AI and Microsoft Azure.