Microsoft AzureOverview
Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering an App Service with Entra ID, the app will connect to other Azure services securely without usernames and passwords.
Rationale
App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services.
Default Value
By default, managed identity is disabled.
Remediation guidance
Remediate from Azure Portal
- Open the web app using the
Open in Azurebutton. - Under
Settingsection, Click onIdentity - Under the
System assignedpane, setStatustoOn. Alternatively, choose an user-assigned identity.
Remediate from Azure CLI
To register with Entra ID for an existing app, run the following command:
az webapp identity assign --resource-group --name
Remediate from PowerShell
To register with Entra ID for an existing app, run the following command:
Set-AzWebApp -AssignIdentity $True -ResourceGroupName <resource_Group_Name> -Name
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure App Service apps without managed identity
Connectors
Covered asset types
Expected check: eq true
{
sites(where: { managedIdentities_SOME: null }) {
...AssetFragment
}
}
