Braintree Insights | 19 August 2026
Managed Instance on Azure App Service is generally available for legacy Windows workloads, but it supports Entra ID and managed identity only, with no domain join, NTLM or Kerberos, and South Africa North is not on the region list.
What changed
Microsoft announced general availability on 18 August 2026. The Learn overview, updated the same day, states the service is generally available for Windows web apps in select regions and is limited to Pv4 and Pmv4 pricing plans, with no support for Linux or containers. The supported regions are East Asia, West Central US, North Europe, East US, Australia East, Central India and South India. Microsoft states that more regions will be added over time.
The operational risk is easy to miss because the service can continue to look healthy. The control becomes visible only when a capacity request fails, an unsupported runtime is removed, or an extension blocks an enforced ERP update. Waiting for that moment transfers a planned decision into an incident.
What the term means in plain language
Managed Instance on Azure App Service is a plan-scoped hosting option for Windows web applications that need operating system customisation, optional private networking and secure integration with Azure resources. It targets workloads that depend on COM components, registry values and MSI installers, while keeping App Service’s managed patching, scaling, diagnostics and identity features.
This distinction matters because product status is not the same as business readiness. Availability, support and compatibility are separate questions. A service can be available but unsupported, supported but capacity-constrained, or technically updated while a customer-specific process has stopped working.
Why this matters to a South African organisation
South African teams often operate with tight specialist capacity, rand-sensitive budgets and business processes that cannot be paused while a replacement is sourced. Localisation, regional cloud capacity and long procurement lead times can narrow the recovery options. The practical response is to use the available test window before it becomes an emergency window.
The consequence belongs to the business process, not only the technology team. Finance month-end, customer transactions, data pipelines and ERP extensions all cross technical and operational ownership. A change should therefore be accepted only when the service owner and the business owner can see the same evidence.
The hidden exposure
Managed Instance on Azure App Service is generally available for legacy Windows workloads, but it supports Entra ID and managed identity only, with no domain join, NTLM or Kerberos, and South Africa North is not on the region list.
Normal operation is weak evidence. It proves only that yesterday’s combination of platform, configuration and workload completed. It does not prove that the next capacity allocation, lifecycle enforcement or major release will preserve the same result. An owner needs an inventory, a representative test and a dated decision.
Decision path
The announcement frames this as migration with minimal configuration and no code changes. That holds for the runtime and for Windows-specific dependencies, and it does not hold for authentication. The Learn limitations table restricts authentication to Entra ID and managed identity, and explicitly excludes domain join, NTLM and Kerberos. A line-of-business application built against Active Directory integrated authentication therefore requires an identity change, which is a different size of project from a hosting move. The second decision is geographic: with no South African region, the choice is to run the workload offshore and accept the data residency position, or to wait.
Record the alternatives that were rejected and why. That prevents the next reviewer from reopening the entire question without context. Where the preferred path cannot be completed inside seven days, approve a time-bound exception with a responsible owner, expiry date and compensating control.
Technical test plan
Determine the application’s current authentication mode before anything else, including any service accounts, delegated identities or integrated security connection strings. Inventory Windows-specific dependencies: COM registrations, GAC assemblies, MSI-installed components, Windows services, MSMQ use and UNC path access. Confirm the workload is a web application, because WebJobs, TCP and named pipes are not supported. Note that local storage is limited to 2 GB and is not persisted across restarts, so anything durable must move to Azure Files or a storage mount. Assess eligible workloads with Azure Migrate and reproduce the configuration through install scripts rather than interactive RDP changes, which are lost on restart.
Use production-representative conditions without exposing production data unnecessarily. Capture the starting configuration, exact version, time of test and expected result. A pass requires evidence from the real workflow, not only a successful login or an unchanged dashboard.
Primary owner
Primary owner: Application owner with the identity owner.
The named owner coordinates platform, application, commercial and business-process decisions. Contributors may perform the work, but accountability cannot be distributed across a meeting invite. The owner closes the test, exception and evidence record.
Action within seven days
Action within seven days: Establish how the candidate application authenticates users today. Where it relies on Windows authentication against Active Directory, scope the identity change before any migration planning begins.
Start with the highest-consequence workload. Assign the people, date and pass criteria before the test begins. If the first test fails, record the failure as evidence and open remediation with a deadline rather than hiding it behind a general project status.
Evidence to retain
Evidence to retain: Application authentication mode, dependency inventory, target region decision with data residency sign-off, and the Azure Migrate assessment output.
Store the evidence with the platform or change record. Include source exports and machine-readable results where possible. The next reviewer should be able to reproduce the conclusion without rebuilding it from email, chat or memory.
Frequently asked questions
Does this run in South Africa North?
Not currently. Microsoft’s region list is East Asia, West Central US, North Europe, East US, Australia East, Central India and South India, and Microsoft states more regions will be added over time.
Does a legacy .NET Framework app really need no changes?
The runtime supports .NET Framework 3.5, 4.8 and .NET 8 without code changes. Authentication is the exception: Entra ID and managed identity only, with no domain join, NTLM or Kerberos.
Which pricing plans are supported?
Pv4 and Pmv4 only, on Windows. Linux and containers are not supported, and the option is not available inside an App Service Environment.
How are persistent configuration changes made?
Through zipped PowerShell install scripts stored in Azure Storage and run at startup. Changes made in an RDP session are temporary and lost after a restart or platform maintenance.
The Braintree view
Microsoft’s announcement supplies the platform fact. The customer control begins after that fact: identify the exposed process, name the owner, test the real dependency and retain a decision that can survive audit or staff turnover. Braintree can help structure the inventory, build the representative test and translate the result into a controlled implementation plan.
Use the seven-day action as the entry point. Do not wait for a renewal, support refusal or enforced update to reveal work that can be measured now.
