Why does removeServerHeader work in an Azure Web App?

A blog post from Microsoft in 2013 states:

Our customers asked us to allow these headers to be disabled on Azure Web Sites, and so with the recent release of Windows Azure Web Sites, we have enabled this to be done.

It then goes on to give an example of using removeServerHeader and says it's part of the Request Filtering module:

The removal of these headers is facilitated with the Request Filtering module...

Interestingly their documentation for IIS 10 Request Filtering confirms that the removeServerHeader attribute was added to IIS 10 as you have found out.

New in IIS 10.0

IIS 10.0 added the removeServerHeader attribute to suppress sending the HTTP server header to remote clients.

So I would say that the reason it works on Azure Web Sites is because Microsoft pushed this feature out to Azure Web Sites at the request of customers in 2013 - presumably as part of an Azure-specific version of the Request Filtering module. They have since integrated it as standard into the IIS 10 Request Filtering module.

Various sources show that Azure websites run a customized build of IIS that is not available on any Windows release.

Your web job runs in the same environment as the associated website. To get detailed information about the site and it's environment use Kudu. You can access it by browsing to the URL:

{yoursite}.scm.azurewebsites.net

Then select the environment tab at the top.