Microsoft AzureOverview
Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized Identity Provider. For a more effective, capable, and secure solution for Identity, Authentication, Authorization, and Accountability, a centralized Identity Provider such as Entra ID is strongly advised.
Rationale
Basic Authentication introduces an identity silo which can produce privileged access to a resource. This can be exploited in numerous ways and represents a significant vulnerability and attack vector.
Impact
An identity provider that can be used by the app service to authenticate users is required.
Remediation guidance
Remediate from Azure Portal
- Open the web app using the
Open in Azurebutton. - Under the
Settingsmenu item, click onConfiguration - Under the
General settingstab, scroll down to locate the two Basic Auth settings:
- Set the
SCM Basic Auth Publishing Credentialsradio button toOff - Set the
FTP Basic Auth Publishing Credentialsradio button toOff
CAUTION: The new settings are not yet applied. Applying them may cause your App Service resource to restart - proceed with caution. Click the Save button, then click Continue to apply the updated configuration.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure App Service sites allowing basic publishing auth
Connectors
Covered asset types
Expected check: eq []
{
sites(
where: {
basicPublishingCredentials_SOME: {
OR: [{ name: "ftp", allowed: true }, { name: "scm", allowed: true }]
}
}
) {
...AssetFragment
}
}
