Azure Web App - Route Different External Domains to Different Directories in "site"

I've searched high and low for the answer to my question and after weeding through possible solutions that might or might not have anything to do with my question, I broke down and here I am. I apologize before hand if this is a repeat.

Quick Background:

My background with Azure is limited, but I am learning.

We are in Germany. My customer has decided that we move all our websites to his Azure Platform from our current virtual server by STRATO. We have 5 websites that currently exist on the virtual server that need to be moved. All are PHP/MySQL, we have everything set up in our Azure for this, so no problem there.

Since the domain TLDs are .de and .plus and you cannot add these to Azure itself (something that continuously baffles me to this day), we have to do the DNS record edit by STRATO, that part I understand as well.

The directory structure is the folder "site" and then five separate subfolders, 1 per website. This is normal.

The Azure has one subdomain - xxx.azurewebsites.net, this points to the empty folder "wwwroot", which isn't a problem either.

Here are the two things that are driving me nuts:

1. How exactly do I point each incoming Domain to its specific subdirectory in the tree? Remembering that the websites are PHP and not ASP.NET, there is, of course, no web.config file.
2. Where is the "safe-zone" within the directory structure? By this, I mean the part of the subdirectory in the Azure tree that is not accessible by any domain. We have a directory that houses semi-sensitive information in the current structure that can only be accessed by the classes in each app, but is not accessible from the internet. I moved copies of the websites to subdirectories within "site", my thinking is the safe directory would normally be another directory under "site", but is my assumption correct? This question seems ultra-simple, but I have to be absolutely sure because of the contents in the folder.

I read in another post that we would require one Web App per incoming domain, I hope this isn't the case.

I will gladly provide any additional information if it would help.

Any help would be greatly appreciated! Thanks in advance.