Azure WebApp (Windows) - You do not have permission to view this directory or page

I have simple NodeJS app created by npx express-generator myExpressApp --view ejs following this instruction - https://learn.microsoft.com/en-us/azure/app-service/quickstart-nodejs?tabs=linux&pivots=development-environment-vscode#create-your-nodejs-application

I use GitHub actions task azure/webapps-deploy@v3 and it's deployed to Linux-based WebApp as a charm
However if I deploy to Windows-based WebApp I'm getting You do not have permission to view this directory or page. on the WebApp's page
Deploy logs in Windows-based WebApp are all good
I tried zip and msdeploy for type in azure/webapps-deploy@v3, result is the same
How it could be fixed?

Even I am getting same error when I deployed the app using GitHub actions.

In this MSDoc it is clearly mentioned the requirement of web.config file while running the app in Windows.

• Deploying the app using GitHub actions will not add the config file. Manually add the web.config file from KUDU in the site/wwwroot directory.

  

  Sample web.config file:

  
  <?xml version="1.0" encoding="utf-8"?>
  <configuration>
    <system.webServer>
      <webSocket enabled="false" />
      <handlers>
        <add name="iisnode" path="bin/www" verb="*" modules="iisnode"/>
      </handlers>
      <rewrite>
        <rules>
          <rule name="NodeInspector" patternSyntax="ECMAScript" stopProcessing="true">
            <match url="^bin/www\/debug[\/]?" />
          </rule>
          <rule name="StaticContent">
            <action type="Rewrite" url="public{PATH_INFO}"/>
          </rule>       
          <rule name="DynamicContent">
            <conditions>
              <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="True"/>
            </conditions>
            <action type="Rewrite" url="bin/www"/>
          </rule>
        </rules>
      </rewrite>  
      <security>
        <requestFiltering>
          <hiddenSegments>
            <remove segment="bin"/>
          </hiddenSegments>
        </requestFiltering>
      </security>
  
      <httpErrors existingResponse="PassThrough" />
  
    </system.webServer>
  </configuration>
  
  

If you are deploying from VSCode, then add SCM_DO_BUILD_DURING_DEPLOYMENT Application setting with value true.

• Add the setting from VSCode or directly from the portal.

VSCode:

Portal:

• Redeploy the app once again from VSCode.

Output:

• Also make sure your Physical Path is mapped to site\wwwroot under Path Mappings.