Control: 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
Description
Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in App Service, the app will connect to other Azure services securely without the need for usernames and passwords.
App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services.
Remediation
From Azure Portal
- Login to Azure Portal using https://portal.azure.com
- Go to
App Services
- Click on each App
- Under
Setting
section, Click onIdentity
- Under the
System assigned
pane, setStatus
toOn
From Azure CLI
To set Register with Azure Active Directory feature for an existing app, run the following command
az webapp identity assign --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME>
From PowerShell
To register with Azure Active Directory feature for an existing app, run the following command:
Set-AzWebApp -AssignIdentity $True -ResourceGroupName <resource_Group_Name> - Name <App_Name>
Default Value
By default, Managed service identity via Azure AD is disabled.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v150_9_5
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v150_9_5 --share
SQL
This control uses a named query:
appservice_web_app_register_with_active_directory_enabled