📝 Azure App Service Basic Authentication is enabled 🟢

• Contextual name: 📝 Basic Authentication is enabled 🟢
• ID: /ce/ca/azure/app-service/disable-basic-authentication
• Located in: 📁 Azure App Service

Flags

• 🟢 Impossible policy
• 🟢 Policy with categories
• 🟢 Policy with type

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Enable App Service Authentication
• Internal
  • dec-x-ca52f63a

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-ca52f63a	2

Description

Open File

Description

Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized Identity Provider. For a more effective, capable, and secure solution for Identity, Authentication, Authorization, and Accountability, a centralized Identity Provider such as Entra ID is strongly advised.

Rationale

Basic Authentication introduces an identity silo which can produce privileged access to a resource. This can be exploited in numerous ways and represents a significant vulnerability and attack vector.

Impact

An Identity Provider that can be used by the App Service for authenticating users is required.

Audit

From Azure Portal

1. Search for, and open App Services from the search bar.
2. For each App Service listed.
3. Click on the App Service name.
4. Under the Settings menu item, click on Configuration.
5. Under the General settings tab, scroll down to locate the two Basic Auth settings:
   • SCM Basic Auth Publishing Credentials.
   • FTP Basic Auth Publishing Credentials.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Search for, and open App Services from the search bar.
2. For each App Service listed.
3. Click on the App Service name.
4. Under the Settings menu item, click on Configuration.
5. Under the General settings tab, scroll down to locate the two Basic Auth settings:
   • Set the SCM Basic Auth Publishing Credentials radio button to Off.
   • Set the FTP Basic Auth Publishing Credentials radio button to Off.

CAUTION: The new settings are not yet applied. Applying them may cause your App Service resource to restart - proceed with caution. Click the Save button, then click Continue to apply the updated configuration. Repeat this procedure for each App Service.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v3.0.0 → 💼 9.6 Ensure that 'Basic Authentication' is 'Disabled' (Manual)			1
💼 Cloudaware Framework → 💼 Secure Access			43
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	2	31	65
💼 FedRAMP High Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			13
💼 FedRAMP High Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)	2	15	17
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	20
💼 FedRAMP Low Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)			8
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		20
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	1		51
💼 FedRAMP Moderate Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			13
💼 FedRAMP Moderate Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)	2		17
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		20
💼 ISO/IEC 27001:2013 → 💼 A.9.2.3 Management of privileged access rights		3	4
💼 ISO/IEC 27001:2022 → 💼 5.10 Acceptable use of information and other associated assets		11	14
💼 ISO/IEC 27001:2022 → 💼 5.15 Access control		14	16
💼 ISO/IEC 27001:2022 → 💼 8.3 Information access restriction		10	11
💼 ISO/IEC 27001:2022 → 💼 8.4 Access to source code		8	9
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	22
💼 NIST CSF v1.1 → 💼 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties		17	35
💼 NIST CSF v1.1 → 💼 PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions		4	8
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	22
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained			31
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			23
💼 NIST CSF v2.0 → 💼 PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions			8
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			22
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			58
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage			40
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement	32	61	73
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(15) Information Flow Enforcement _ Detection of Unsanctioned Information		7	8
💼 NIST SP 800-53 Revision 5 → 💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption		11	13
💼 UK Cyber Essentials → 💼 1.3 Block unauthenticated inbound connections by default		2	3