Using Dev Tunnels to share your local web server
I was recently building a prototype app for some work, and wanted to share it with my team. Usually I would turn to something like ngrok, but I was curious if there was anything new, and anything that was more native to where I work (Microsoft).
Turns out, one of the technologies enabling VSCode Codespaces, Microsoft's Dev Tunnel, was the answer!
Dev Tunnels can also give you a public HTTPS URL pointing at a port on your laptop in three commands. Perfect for sharing a running webapp with coworkers (or with M365 agents/Copilot connectors) without standing up infra.
Setup
On macOS at least... There's other install instructions too.
brew install --cask devtunnelHost a local port
Whichever port you want to host, say a local express, flask, rails app or whatever...
devtunnel host -p 5050This prints a tunnel ID like `kind-cat-q7qlggx.use2` and a URL that proxies to `localhost:5050` on your machine.
Restrict access to the Microsoft tenant
This one was a bonus for me! You can also restrict access to it if you're setup with AAD or Entra at your company.
By default the URL is anonymous. To require a Microsoft AAD sign-in (so only people in the tenant can hit it):
devtunnel access create kind-cat-q7qlggx.use2 --tenantNow anyone hitting the URL has to auth as a Microsoft employee, which is the right default for sharing internal-only tools, demos, or webhooks.
Why it matters
- No ngrok account
- No firewall changes
- No temporary App Service.
- Tenant-scoped access means you can safely point AAD-protected services (M365 connectors, Copilot plugins, Teams app manifests) at your laptop while iterating
- Tunnel survives reboots once `host` is running; the URL is stable per tunnel ID so you can wire it into a manifest once.
Gotchas to remember
The host process has to keep running — when you close the terminal the tunnel goes down. --tenant only gates who can reach the URL; your app still needs to verify the AAD token itself if you care about identity inside the app.
