Skip to main content

Description

Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized identity provider. For a more effective, capable, and secure solution for identity, authentication, authorization, and accountability, a centralized identity provider such as Entra ID is strongly advised.

Rationale​

Basic Authentication introduces an identity silo which can produce privileged access to a resource. This can be exploited in numerous ways and represents a significant vulnerability and attack vector.

Impact​

An identity provider that the App Service can use for authenticating users is required.

Audit​

From Azure Portal​

  1. Search for and open App Services from the search bar.
  2. For each App Service listed, do the following:
  3. Select the App Service name.
  4. Under the Settings menu item, click on Configuration.
  5. Under the General settings tab, scroll down to locate the two Basic Auth settings:
    • SCM Basic Auth Publishing Credentials.
    • FTP Basic Auth Publishing Credentials.

Both radio buttons should indicate a status of Off.

Repeat this procedure for each App Service.

From Azure Policy​

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

Default Value​

Both parameters for Basic Authentication (SCM and FTP) are set to On by default.

References​

  1. https://learn.microsoft.com/en-us/azure/app-service/configure-basic-auth-disable?tabs=portal