Check ID:
Provider: Azure
Service:
Severity: LOW
Categories:
Resource type:
app_http_logs_enabledProvider: Azure
Service:
appSeverity: LOW
Categories:
loggingResource type:
microsoft.web/sitesWhat this check verifies
Azure App Service web apps diagnostic settings include HTTP request logging when theAppServiceHTTPLogs category (or the allLogs group) is enabled to capture web access events.
Risk
Without HTTP access logs, visibility into requests is lost, hindering detection of brute force, probing, and injection attempts. This weakens forensics and reduces confidentiality and integrity by masking data access paths and blocking reliable incident timelines.Recommendation
Enable diagnostic settings withAppServiceHTTPLogs (or allLogs) and route logs to a centralized store. Enforce least privilege, retention, and tamper-resistant storage. Integrate with a SIEM for analytics and alerting, and periodically verify logging coverage across all apps and regions.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation
- https://docs.microsoft.com/en-us/azure/app-service/troubleshoot-diagnostic-logs
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_http_logs_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks