Azure Policy built-in definitions for Azure Container Apps

This page is an index of Azure Policy built-in policy definitions for Azure Container Apps. For additional Azure Policy built-ins for other services, see Azure Policy built-in definitions.

The name of each built-in policy definition links to the policy definition in the Azure portal. Use the link in the Version column to view the source on the Azure Policy GitHub repo.

Policy definitions

Name (Azure portal)	Description	Effect(s)	Version (GitHub)
Authentication should be enabled on Container Apps	Container Apps Authentication is a feature that can prevent anonymous HTTP requests from reaching the Container App, or authenticate those that have tokens before they reach the Container App	AuditIfNotExists, Disabled	1.0.1
Container App environments should use network injection	Container Apps environments should use virtual network injection to: 1.Isolate Container Apps from the public internet 2.Enable network integration with resources on-premises or in other Azure virtual networks 3.Achieve more granular control over network traffic flowing to and from the environment.	Audit, Disabled, Deny	1.0.2
Container App should configure with volume mount	Enforce the use of volume mounts for Container Apps to ensure availability of persistent storage capacity.	Audit, Deny, Disabled	1.0.1
Container Apps environment should disable public network access	Disable public network access to improve security by exposing the Container Apps environment through an internal load balancer. This removes the need for a public IP address and prevents internet access to all Container Apps within the environment.	Audit, Deny, Disabled	1.0.1
Container Apps should disable external network access	Disable external network access to your Container Apps by enforcing internal-only ingress. This will ensure inbound communication for Container Apps is limited to callers within the Container Apps environment.	Audit, Deny, Disabled	1.0.1
Container Apps should only be accessible over HTTPS	Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Disabling 'allowInsecure' will result in the automatic redirection of requests from HTTP to HTTPS connections for container apps.	Audit, Deny, Disabled	1.0.1
Managed Identity should be enabled for Container Apps	Enforcing managed identity ensures Container Apps can securely authenticate to any resource that supports Azure AD authentication	Audit, Deny, Disabled	1.0.1

Next steps

• See the built-ins on the Azure Policy GitHub repo.
• Review the Azure Policy definition structure.
• Review Understanding policy effects.