Identify Source App — Confirm the function app name, resource group, region, and current hosting plan
Check Region Compatibility — Verify the target plan is available in the app’s region
Verify Language Stack — Confirm the app’s runtime is supported on the target plan
Verify Stack Version — Confirm the runtime version is supported on the target plan in the region
Check Deployment Slots — Determine if slots are in use (Flex Consumption doesn’t support slots)
Check Certificates — Determine whether TLS/SSL certificates are used and plan for the documented site-scoped certificate model, limits, and Linux certificate-loading paths
Check Blob Triggers — Verify blob triggers use EventGrid source (container polling not supported in Flex Consumption)
Scan Source for Windows Dependencies — Recommended but skippable. Static-analyze source code or deployment package for Win32/COM/WMI/registry/cert-store usage, Windows-only packages, Windows-RID targeting, and shell-outs to Windows tools. See dependency-scan.md for the procedure and severity rubric. Findings populate §11 of the report; Blocker findings advisorily flip §1 Upgrade Readiness to Needs Attention (never hard-blocks).
Assess Dependencies — Review upstream and downstream service dependencies and plan mitigation strategies
⚠️ MANDATORY: Use these exact section headings in every assessment report. Do NOT rename, reorder, or omit sections.
The report MUST be saved as <UPGRADE_DIR>/upgrade-assessment-report.md. See Artifact Output Policy for how <UPGRADE_DIR> resolves (default: .azure-upgrade/<source-app-name>/).
| Source code Windows dependency scan | ✅ / ⚠️ / ⏭ Skipped | See §11 |
## 3. App Settings Inventory
> Record setting names only. Never include app-setting values in the assessment.
> For surviving names containing `:`, mark **Migrate?** as `Convert` and record the Linux target name with `:` replaced by `__`. Note that .NET configuration maps `__` back to `:`.
| Setting | Migrate? | Notes |
|---------|----------|-------|
| | Yes / No / Convert | |
## 4. Managed Identities
| Type | Principal ID | Roles | Action |
|------|-------------|-------|--------|
| System-assigned | | | Recreate in new app |
| User-assigned | | | Reassign to new app |
## 5. Application Configurations
| Configuration | Current Value | Migrate? | Notes |
| TLS/SSL certificates | | | Re-add used certificates with the site-scoped certificate process |
| Explicit Azure Files mounts | | No | Catalog custom ID, account, share, type, and mount path; Windows Consumption doesn't support these mounts |
| Access restrictions | | | |
| Built-in auth | | Conditional | Configure and validate in Step 4f.auth, or record as deferred |
| Function access keys | | Conditional | Choose target-generated keys or preserve source host and HTTP-function keys; system and master keys aren't copied |
## 6. Trigger & Binding Analysis
| Function | Trigger Type | Source | Migration Risk | Mitigation |
> 📝 **Heuristic aid, not a guarantee.** The findings table reflects pattern matches only — uncommon Windows APIs, dynamically-loaded native libraries, transitive package dependencies, reflection-based calls, and runtime-generated code may not appear. The app owner is responsible for verifying no Windows dependencies remain.
>
> If `Scan ran? = No`, write a single line in place of the findings table: *"User declined the source code dependency scan. Migration proceeded without static analysis of Windows dependencies."*
>
> See [dependency-scan.md](dependency-scan.md) for the categories, severity rubric, and per-language patterns.