updated docs

DEPLOY.md

@@ -19,20 +19,18 @@
 
 1. Run `npm install` from the VS Code Terminal to install the [node-fetch](https://www.npmjs.com/package/node-fetch) dependency.
 
-1. From the Azure Functions extension within VS Code, click `Deploy to Function App` (cloud icon) and select or create a Function App in Azure.
+1. From the Azure Functions extension within VS Code, click **Deploy to Function App** (cloud icon) and select or create a Function App in Azure.
 
-1. From the Azure Function in Azure Portal, click `Configuration` to add the following application settings using either the names & values previously pasted into `/api/local.settings.json` or new values for production resources.
+1. From the Azure Function in Azure Portal, click **Configuration** to add the following application settings using either the names & values previously pasted into `/api/local.settings.json` or new values for production resources.
     - AadTenantId
     - AppClientId
     - AppClientSecret
 
-1.  From the Azure Function in Azure Portal, click `CORS` to add `*` to the Allowed Origins.
-
-1. Copy the Function URL from VS Code or Azure Portal (including a key that adds code param) and open in a browser to confirm a successful response from the AAD Token API.
+1. Copy the Function URL from VS Code or Azure Portal (including a key that adds code param) and open in a browser to confirm a successful response from the AAD Token API. If needed, you can troubleshoot issues in the Portal by browsing to the **Functions** and **Code + Test** to debug logs while making an HTTP request.
 
 1. When a token is successfully returned from the API, override the `fetchToken()` reference to `apiUrl` within [src/App/helper.js](./src/App/helper.js#L26) using your new Function URL. It will be in this format: `https://APPNAME.azurewebsites.net/api/aad/token?code=DEFAULT_KEY`
 
-1. Push the app change to your code repo and continue to the application setup below.
+1. Push the app change to your code repo that will be the deployment source. *Please follow additional best practices for [Securing Azure Functions](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts) and note the [Security constraints with bringing your own functions to Azure Static Web Apps](https://docs.microsoft.com/en-us/azure/static-web-apps/functions-bring-your-own#security-constraints)*
 
 ## Application Setup
 1. Click the button below to create an Azure Static Web App using your GitHub repository:
@@ -48,8 +46,6 @@
     - Output location = `build`
 1. Click on 'Review + create' to create the Static Web App
 
-1. Once the resource is created, it will automatically deploy your app to a URL listed in the Azure portal.
-
 1. Click **Configuration** in the left nav to add the following app settings using either the names & values previously pasted into `/api/local.settings.json` or new values for production resources.
     - StorageConnectionString
     - AtlasAccountName
@@ -63,4 +59,6 @@
 
     *Note: By default, the [public/routes.json](./public/routes.json) is setup to only allow Azure Active Directory and requires the `admin` role. You can use the app's `/login` to gain initial access. Learn more about [authentication and authorization for Static Web Apps](https://docs.microsoft.com/en-us/azure/static-web-apps/authentication-authorization)*
 
+1. Copy the Static Web App URL from the **Overview** page, then go back to the Azure Function and click **CORS** to paste your app URL in the Allowed Origins.
+
 1. Open the Static Web App URL to confirm it is working the same as the [local deployment method](./README.md).

README.md

@@ -70,6 +70,8 @@ This application can be deployed in various ways to meet your needs. Because the
 ## Deploy to Azure
 Please review the [deployment documentation](./DEPLOY.md) for details. Due to the two methods of [API support in Azure Static Web Apps with Azure Functions](https://docs.microsoft.com/en-us/azure/static-web-apps/apis), you will need to deploy a separate Azure Function for the `/api/AadToken` endpoint.
 
+*Please follow additional best practices for [Securing Azure Functions](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts) and note the [Security constraints with bringing your own functions to Azure Static Web Apps](https://docs.microsoft.com/en-us/azure/static-web-apps/functions-bring-your-own#security-constraints)*
+
 ## Learn More
 
 **Microsoft Purview**