Azure web role vs worker role: what they were, and where to move them before March 2027

If you've inherited an Azure application built more than a few years ago, you may find a .csdef file describing a web role and a worker role. These come from Azure Cloud Services, one of Azure's original platform services. Both versions of it are now retired or retiring, so it's worth knowing what you've got and where it should go.

Web role vs worker role

Microsoft's own definitions are short:

• Web role: "Automatically deploys and hosts your app through Internet Information Services (IIS)."
• Worker role: "Doesn't use IIS, and runs your app standalone."

In practice, the web role served the website or API, and the worker role did background work: processing queue messages, running scheduled jobs, crunching data. A typical app had one of each, talking through a storage queue. Both ran on Windows virtual machines that Azure managed for you, with the guest operating system patched by the platform.

The dates

• Cloud Services (classic) was retired on 31 August 2024. Microsoft's page says existing deployments "will be stopped and shut down by Microsoft and the data will be permanently lost starting October 2024."
• Cloud Services (extended support), the Azure Resource Manager version that most customers moved to, was deprecated on 31 March 2025 and will be fully retired on 31 March 2027.

Extended support kept the same web and worker role model, the same .csdef, .cscfg and .cspkg files, and the same runtime code. Only the deployment and management layer changed. So if you moved from classic to extended support, you bought time but you still have web and worker roles to replace.

Where to move them

Microsoft lists these targets for Cloud Services (extended support): Virtual Machine Scale Sets, Azure Container Apps, App Service, Azure Kubernetes Service and Azure Service Fabric. Here's how the roles usually map:

Old Cloud Services apps often run on .NET Framework. App Service and Windows containers both support .NET Framework, so you don't have to rewrite in modern .NET just to move. But it's a good moment to check, because .NET 8 and older versions are reaching end of support.

Find what you still have

List every Cloud Services (extended support) deployment you can see across your subscriptions with Azure Resource Graph:

1
2
3az graph query -q "resources
| where type =~ 'microsoft.compute/cloudservices'
| project name, resourceGroup, subscriptionId, location" -o table

Then, for each one, open the package's ServiceDefinition.csdef to see its roles. A <WebRole> element is a web role and a <WorkerRole> element is a worker role.

Checklist

• Find every cloud service and list its web and worker roles.
• Choose a target for each role: App Service for web, Functions or Container Apps for background work.
• Move configuration from .cscfg into app settings or Key Vault, and certificates into Key Vault.
• Plan the cut-over well before 31 March 2027, and test it.