Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
app_ensure_auth_is_set_upProvider: Azure
Service:
appSeverity: MEDIUM
Categories:
identity-accessResource type:
microsoft.web/sitesWhat this check verifies
Azure App Service can enforce built-in Authentication/Authorization (Easy Auth) so requests are authenticated by a provider before reaching app code. This evaluates whether platform auth is enabled for the app and an identity provider is configured.Risk
Without platform authentication, apps may accept anonymous requests, enabling unauthorized access to APIs and data. Attackers can enumerate endpoints and bypass weak app checks, risking data exposure (C), unauthorized changes (I), and automated abuse impacting availability (A).Recommendation
Enable App Service Authentication/Authorization and setRequire authentication for unauthenticated requests. Use Microsoft Entra or a trusted IdP, restrict tenants/audiences, enforce HTTPS, and apply least privilege with role/claim checks and Conditional Access for defense-in-depth. Avoid Allow anonymous requests.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az webapp auth update —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —enabled true
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/AppService/enable-app-service-authentication.html
- https://learn.microsoft.com/en-us/azure/app-service/scenario-secure-app-authentication-app-service
- https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_ensure_auth_is_set_up. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks