📝 Azure App Service Authentication is disabled and Basic Authentication is enabled 🟢

• Contextual name: 📝 Authentication is disabled and Basic Authentication is enabled 🟢
• ID: /ce/ca/azure/app-service/enable-app-auth-and-disable-basic-auth
• Located in: 📁 Azure App Service

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • RELIABILITY
  • SECURITY

Similar Policies

• Cloud Conformity
  • Enable App Service Authentication
• Internal
  • dec-x-ca52f63a

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-ca52f63a	2

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure App Service
  • 🔌 Azure App Service - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching a Web Application or authenticate those with tokens before they reach the app. If an anonymous request is received from a browser, App Service will redirect to a logon page. To handle the logon process, a choice from a set of identity providers can be made, or a custom authentication mechanism can be implemented.

Rationale

By Enabling App Service Authentication, every incoming HTTP request passes through it before being handled by the application code. It also handles authentication of users with the specified provider (Entra ID, Facebook, Google, Microsoft Account, and Twitter), validation, storing and refreshing of tokens, managing the authenticated sessions and injecting identity information into request headers. Disabling HTTP Basic Authentication functionality further ensures legacy authentication methods are disabled within the application.

Impact

This is only required for App Services which require authentication. Enabling on site like a marketing or support website will prevent unauthenticated access which would be undesirable.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Login to Azure Portal using https://portal.azure.com.
2. Go to App Services.
3. Click on each App.
4. Under Setting section, click on Authentication.
5. If no identity providers are set up, then click Add identity provider.
6. Choose other parameters as per your requirements and click on Add.

To disable the Basic Auth Publishing Credentials setting, perform the following steps:

1. Login to Azure Portal using https://portal.azure.com.
2. Go to App Services.
3. Click on each App.
4. Under Settings, click on Configuration.
5. Click on the General Settings tab.
6. Under Platform settings, ensure Basic Auth Publishing Credentials is set to Off.

From Azure CLI

To set App Service Authentication for an existing app, run the following command:

az webapp auth update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --enabled true

Note: In order to access App Service authentication settings for Web app using Microsoft API requires Website contributor permission at subscription level. A custom role can be created in place of Website contributor to provide more specific permission and maintain the principle of least privileged access.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v1.1.0 → 💼 9.1 Ensure App Service Authentication is set on Azure App Service		1	1
💼 CIS Azure v1.3.0 → 💼 9.1 Ensure App Service Authentication is set on Azure App Service - Level 2 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 9.1 Ensure App Service Authentication is set up for apps in Azure App Service - Level 2 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 9.1 Ensure App Service Authentication is set up for apps in Azure App Service - Level 2 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 9.1 Ensure App Service Authentication is set up for apps in Azure App Service - Level 2 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 9.1 Ensure App Service Authentication is set up for apps in Azure App Service - Level 2 (Automated)			1
💼 CIS Azure v3.0.0 → 💼 9.2 Ensure App Service Authentication is set up for apps in Azure App Service (Automated)			1
💼 Cloudaware Framework → 💼 Secure Access			43
💼 Cloudaware Framework → 💼 System Configuration			24
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	2	31	65
💼 FedRAMP High Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			13
💼 FedRAMP High Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)	2	15	17
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	20
💼 FedRAMP Low Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)			8
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		20
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)	1		51
💼 FedRAMP Moderate Security Controls → 💼 AC-17(2) Protection of Confidentiality and Integrity Using Encryption (M)(H)			13
💼 FedRAMP Moderate Security Controls → 💼 CM-5 Access Restrictions for Change (L)(M)(H)	2		17
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		20
💼 ISO/IEC 27001:2013 → 💼 A.9.2.3 Management of privileged access rights		3	4
💼 ISO/IEC 27001:2022 → 💼 5.10 Acceptable use of information and other associated assets		11	14
💼 ISO/IEC 27001:2022 → 💼 5.15 Access control		14	16
💼 ISO/IEC 27001:2022 → 💼 8.3 Information access restriction		10	11
💼 ISO/IEC 27001:2022 → 💼 8.4 Access to source code		8	9
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	22
💼 NIST CSF v1.1 → 💼 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties		17	35
💼 NIST CSF v1.1 → 💼 PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions		4	8
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	22
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			89
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained			31
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			23
💼 NIST CSF v2.0 → 💼 PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions			8
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			22
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			58
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage			40
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement	32	61	73
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(15) Information Flow Enforcement _ Detection of Unsanctioned Information		7	8
💼 NIST SP 800-53 Revision 5 → 💼 AC-17(2) Remote Access _ Protection of Confidentiality and Integrity Using Encryption		11	13
💼 UK Cyber Essentials → 💼 1.3 Block unauthenticated inbound connections by default		2	3