Skip to main content

🛡️ Azure App Service Basic Authentication is enabled🟢⚪

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-ca52f63a2

Description​

Open File

Description​

Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized Identity Provider. For a more effective, capable, and secure solution for Identity, Authentication, Authorization, and Accountability, a centralized Identity Provider such as Entra ID is strongly advised.

Rationale​

Basic Authentication introduces an identity silo which can produce privileged access to a resource. This can be exploited in numerous ways and represents a significant vulnerability and attack vector.

Impact​

An Identity Provider that can be used by the App Service for authenticating users is required.

Audit​

From Azure Portal​
  1. Search for, and open App Services from the search bar.
  2. For each App Service listed.
  3. Click on the App Service name.
  4. Under the Settings menu item, click on Configuration.
  5. Under the General settings tab, scroll down to locate the two Basic Auth settings:
    • SCM Basic Auth Publishing Credentials.
    • FTP Basic Auth Publishing Credentials.

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Search for, and open App Services from the search bar.
  2. For each App Service listed.
  3. Click on the App Service name.
  4. Under the Settings menu item, click on Configuration.
  5. Under the General settings tab, scroll down to locate the two Basic Auth settings:
    • Set the SCM Basic Auth Publishing Credentials radio button to Off.
    • Set the FTP Basic Auth Publishing Credentials radio button to Off.

CAUTION: The new settings are not yet applied. Applying them may cause your App Service resource to restart - proceed with caution. Click the Save button, then click Continue to apply the updated configuration. Repeat this procedure for each App Service.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v3.0.0 → 💼 9.6 Ensure that 'Basic Authentication' is 'Disabled' (Manual)1no data
💼 Cloudaware Framework → 💼 Secure Access70no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)237101no data
💼 FedRAMP High Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)20no data
💼 FedRAMP High Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)21416no data
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)61436no data
💼 FedRAMP Low Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)8no data
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)136no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)185no data
💼 FedRAMP Moderate Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)20no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)216no data
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)436no data
💼 ISO/IEC 27001:2013 → 💼 A.9.2.3 Management of privileged access rights312no data
💼 ISO/IEC 27001:2022 → 💼 5.10 Acceptable use of information and other associated assets1127no data
💼 ISO/IEC 27001:2022 → 💼 5.15 Access control1431no data
💼 ISO/IEC 27001:2022 → 💼 8.3 Information access restriction1024no data
💼 ISO/IEC 27001:2022 → 💼 8.4 Access to source code822no data
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes1934no data
💼 NIST CSF v1.1 → 💼 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties1756no data
💼 NIST CSF v1.1 → 💼 PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions413no data
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)1923no data
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented4791no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events170no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained86no data
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization43no data
💼 NIST CSF v2.0 → 💼 PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions13no data
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated53no data
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties131no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected180no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected156no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected176no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage119no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269116no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains3133no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(15) Information Flow Enforcement _ Detection of Unsanctioned Information910no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption1220no data
💼 SOC 2 → 💼 CC6.1-8 Manages Identification and Authentication1824no data
💼 UK Cyber Essentials → 💼 1.3 Block unauthenticated inbound connections by default23no data