Skip to main content

πŸ›‘οΈ Azure App Service is not registered with Microsoft Entra ID🟒

  • Contextual name: πŸ›‘οΈ App Service is not registered with Microsoft Entra ID🟒
  • ID: /ce/ca/azure/app-service/app-service-registered-with-microsoft-entra-id
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
βœ‰οΈ dec-x-1fc681bc1

Description​

Open File

Description​

Managed identity in App Service improves security by eliminating secrets in the app, such as credentials in connection strings. When registering an App Service with Entra ID, the app can connect to other Azure services securely without usernames and passwords.

Rationale​

App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turnkey solution for securing access to Azure SQL Database and other Azure services.

Audit​

From Azure Portal​
  1. In the Azure portal, open the portal menu in the upper left.
  2. Go to App Services.
  3. Select each app.
  4. Under the Settings section, select Identity.
  5. Under the System assigned pane, ensure Status is set to On.
From Azure CLI​

To check the Register with Entra ID status for an existing app, run the following command:

az webapp identity show \
    --resource-group {{resource-group-name}} \
    --name {{app-name}} \
    --query principalId

The output should return a unique principal ID.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Log in to the Azure portal using https://portal.azure.com.
  2. Go to App Services.
  3. Select each app.
  4. Under Settings, select Identity.
  5. Under the System assigned pane, set Status to On.

From Azure CLI​

To register with Entra ID for an existing app, run the following command:

az webapp identity assign \
    --resource-group {{resource-group-name}} \
    --name {{app-name}}

From PowerShell​

To register with Entra ID for an existing app, run the following command:

Set-AzWebApp `
    -AssignIdentity $True `
    -ResourceGroupName {{resource-group-name}} `
    -Name {{app-name}}

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
πŸ’Ό CIS Azure v1.1.0 β†’ πŸ’Ό 9.5 Ensure that Register with Azure Active Directory is enabled on App Service11no data
πŸ’Ό CIS Azure v1.3.0 β†’ πŸ’Ό 9.5 Ensure that Register with Azure Active Directory is enabled on App Service - Level 1 (Automated)11no data
πŸ’Ό CIS Azure v1.4.0 β†’ πŸ’Ό 9.5 Ensure that Register with Azure Active Directory is enabled on App Service - Level 1 (Automated)11no data
πŸ’Ό CIS Azure v1.5.0 β†’ πŸ’Ό 9.5 Ensure that Register with Azure Active Directory is enabled on App Service - Level 1 (Automated)11no data
πŸ’Ό CIS Azure v2.0.0 β†’ πŸ’Ό 9.5 Ensure that Register with Azure Active Directory is enabled on App Service - Level 1 (Automated)11no data
πŸ’Ό CIS Azure v2.1.0 β†’ πŸ’Ό 9.4 Ensure that Register with Entra ID is enabled on App Service - Level 1 (Automated)11no data
πŸ’Ό CIS Azure v3.0.0 β†’ πŸ’Ό 9.5 Ensure that Register with Entra ID is enabled on App Service (Automated)1no data
πŸ’Ό Cloudaware Framework β†’ πŸ’Ό Secure Access75no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό AC-2(1) Automated System Account Management (M)(H)26no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό AC-2(1) Automated System Account Management (M)(H)26no data
πŸ’Ό ISO/IEC 27001:2013 β†’ πŸ’Ό A.9.2.2 User access provisioning44no data
πŸ’Ό ISO/IEC 27001:2022 β†’ πŸ’Ό 5.15 Access control1431no data
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes1934no data
πŸ’Ό NIST CSF v1.1 β†’ πŸ’Ό PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)1923no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization43no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.AA-03: Users, services, and hardware are authenticated53no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties133no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό AC-2(1) Account Management _ Automated System Account Management426no data
πŸ’Ό SOC 2 β†’ πŸ’Ό CC6.1-4 Identifies and Authenticates Users46no data
πŸ’Ό SOC 2 β†’ πŸ’Ό CC6.1-8 Manages Identification and Authentication1824no data