Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article describes the Policy guardrails in place to ensure Azure App Service is deployed securely.
App Service GitHub Repository
App Service Policies Built in
| Name | Description | Version | Type | Effect | Policy definition |
|---|---|---|---|---|---|
| App Service apps should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 4.0.0 | Built-in | AuditDeny | Link |
| Function apps should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 5.0.0 | Built-in | AuditDeny | Link |
| Function app slots should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 2.0.0 | Built-in | AuditDeny | Link |
| App Service app slots should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 2.0.0 | Built-in | AuditDeny | Link |
| App Service app slots shouldn't have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) shouldn't allow all domains to access your app. Allow only required domains to interact with your app. | 1.0.0 | Built-in | AuditIfNotExist | Link |
| App Service app slots should have remote debugging turned off | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | 1.0.1 | Built-in | AuditIfNotExist | Link |
| App Service apps should have remote debugging turned off | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | 2.0.0 | Built-in | AuditIfNotExist | Link |
| App Service apps shouldn't have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) shouldn't allow all domains to access your app. Allow only required domains to interact with your app. | 2.0.0 | Built-in | AuditIfNotExist | Link |
| Configure App Service app slots to turn off remote debugging | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | 1.1.0 | Built-in | Deploy | Link |
| Configure Function app slots to turn off remote debugging | Remote debugging requires inbound ports to be opened on a Function app. Remote debugging should be turned off. | 1.1.0 | Built-in | Deploy | Link |
| Configure Function apps to turn off remote debugging | Remote debugging requires inbound ports to be opened on Function apps. Remote debugging should be turned off. | 1.0.0 | Built-in | Deploy | Link |
| Function app slots should have remote debugging turned off | Remote debugging requires inbound ports to be opened on Function apps. Remote debugging should be turned off. | 1.0.0 | Built-in | AuditIfNotExist | Link |
| Function app slots shouldn't have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) shouldn't allow all domains to access your Function app. Allow only required domains to interact with your Function app. | 1.0.0 | Built-in | AuditIfNotExist | Link |
| Function apps should have remote debugging turned off | Remote debugging requires inbound ports to be opened on Function apps. Remote debugging should be turned off. | 2.0.0 | Built-in | AuditIfNotExist | Link |
| Function apps shouldn't have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) shouldn't allow all domains to access your Function app. Allow only required domains to interact with your Function app. | 2.0.0 | Built-in | AuditIfNotExist | Link |
App Service Policies Custom
| Name | Description | Version | Type | Effect | Policy definition |
|---|---|---|---|---|---|
| App Service apps should disable public network access | Disabling public network access improves security by ensuring that the App Service isn't exposed on the public internet. Creating private endpoints can limit exposure of an App Service. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.0.0 | Custom | AuditDeny | N/A |
| App Service app slots should disable public network access | Disabling public network access improves security by ensuring that the App Service isn't exposed on the public internet. Creating private endpoints can limit exposure of an App Service. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.0.0 | Custom | AuditDeny | N/A |
| App Service Environment should have internal encryption enabled | Setting InternalEncryption to true encrypts the pagefile, worker disks, and internal network traffic between the front ends and workers in an App Service Environment. To learn more, see /azure/app-service/environment/app-service-app-service-environment-custom-settings#enable-internal-encryption. |
1.0.1 | Custom | Audit | N/A |
| App Service app slots should use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for App Service apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | 1.0.0 | Custom | AuditIfNotExist | N/A |
| App Service app slots should use latest 'HTTP Version' | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. | 1.0.0 | Custom | AuditIfNotExist | N/A |
| Configure Function apps to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 2.0.0 | Custom | Modify | N/A |
| Configure Function app slots to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 2.0.0 | Custom | Modify | N/A |
| Configure App Service apps to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 2.0.0 | Custom | Modify | N/A |
| Configure App Service app slots to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | 2.0.0 | Custom | Modify | N/A |
| App Service apps should use managed identity | Use a managed identity for enhanced authentication security | 3.0.0 | Custom | AuditIfNotExist | N/A |
| Function apps should use managed identity | Use a managed identity for enhanced authentication security | 3.0.0 | Custom | AuditIfNotExist | N/A |
| App Service apps should use latest 'HTTP Version' | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. | 4.0.0 | Custom | AuditIfNotExist | N/A |
| App Service apps should have resource logs enabled | Audit enabling of resource logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised. | 2.0.1 | Custom | AuditIfNotExist | N/A |
| App Service Environment should be provisioned with latest versions | Only allow App Service Environment version 2 or version 3 to be provisioned. Older versions of App Service Environment require manual management of Azure resources and have greater scaling limitations. | 1.0.0 | Custom | AuditDeny | N/A |
| App Service app slots should have resource logs enabled | Audit enabling of resource logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised. | 1.0.0 | Custom | AuditIfNotExist | N/A |
| App Service apps that use Java should use a specified 'Java version' | Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Java version that meets your requirements. | 3.1.0 | Custom | AuditIfNotExist | N/A |
| App Service apps that use Python should use a specified 'Python version' | Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Python version that meets your requirements. | 4.1.0 | Custom | AuditIfNotExist | N/A |
| App Service apps that use PHP should use a specified 'PHP version' | Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a PHP version that meets your requirements. | 3.2.0 | Custom | AuditIfNotExist | N/A |
| Function apps that use Java should use a specified 'Java version' | Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Java version that meets your requirements. | 3.1.0 | Custom | AuditIfNotExist | N/A |
| Function apps that use Python should use a specified 'Python version' | Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Python version that meets your requirements. | 3.1.0 | Custom | AuditIfNotExist | N/A |
| App Service app slots should use managed identity | Use a managed identity for enhanced authentication security | 1.0.0 | Custom | AuditIfNotExist | N/A |
| App Service apps should have authentication enabled | Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the web app, or authenticate those that have tokens before they reach the web app. | 2.0.1 | Custom | AuditIfNotExist | N/A |
| Function apps should have authentication enabled | Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the Function app, or authenticate those that have tokens before they reach the Function app. | 3.0.0 | Custom | AuditIfNotExist | N/A |
| Function app slots should disable public network access | Disabling public network access improves security by ensuring that the Function app isn't exposed on the public internet. Creating private endpoints can limit exposure of a Function App. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.0.0 | Custom | AuditDeny | N/A |
| Function apps should disable public network access | Disabling public network access improves security by ensuring that the Function app isn't exposed on the public internet. Creating private endpoints can limit exposure of a Function App. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.0.0 | Custom | AuditDeny | N/A |
| Configure Function apps to disable public network access | Disable public network access for your Function apps so that it isn't accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.1.0 | Custom | Modify | N/A |
| Configure Function app slots to disable public network access | Disable public network access for your Function apps so that it isn't accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.1.0 | Custom | Modify | N/A |
| Configure App Service apps to disable public network access | Disable public network access for your App Services so that it isn't accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. |
1.1.0 | Custom | Modify | N/A |