Check ID: app_http_logs_enabled
Provider: Azure
Service: app
Severity: LOW
Categories: logging
Resource type: microsoft.web/sites

What this check verifies

Azure App Service web apps diagnostic settings include HTTP request logging when the AppServiceHTTPLogs category (or the allLogs group) is enabled to capture web access events.

Risk

Without HTTP access logs, visibility into requests is lost, hindering detection of brute force, probing, and injection attempts. This weakens forensics and reduces confidentiality and integrity by masking data access paths and blocking reliable incident timelines.

Recommendation

Enable diagnostic settings with AppServiceHTTPLogs (or allLogs) and route logs to a centralized store. Enforce least privilege, retention, and tamper-resistant storage. Integrate with a SIEM for analytics and alerting, and periodically verify logging coverage across all apps and regions.

Remediation

az monitor diagnostic-settings create --name <example_resource_name> --resource /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Web/sites/<APP_NAME> --workspace <LOG_ANALYTICS_WORKSPACE_RESOURCE_ID> --logs '[{"category":"AppServiceHTTPLogs","enabled":true}]'

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_http_logs_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks