Control: 9.5 Ensure that Register with Azure Active Directory is enabled on App Service

Description

Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in App Service, the app will connect to other Azure services securely without the need for usernames and passwords.

App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services.

Remediation

From Azure Portal

Login to Azure Portal using https://portal.azure.com.
Go to App Services.
Click on each App.
Under Setting section, Click on Identity.
Under the System assigned pane, set Status to On.

From Azure CLI

To set Register with Azure Active Directory feature for an existing app, run the following command

az webapp identity assign --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME>

From PowerShell

To register with Azure Active Directory feature for an existing app, run the following command:

Set-AzWebApp -AssignIdentity $True -ResourceGroupName <resource_Group_Name> - Name <App_Name>

Default Value

By default, Managed service identity via Azure AD is disabled.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v200_9_5

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v200_9_5 --share

SQL

This control uses a named query:

select
  app.id as resource,
  case
    when identity = '{}' then 'alarm'
    else 'ok'
  end as status,
  case
    when identity = '{}' then name || ' register with azure active directory disabled.'
    else name || ' register with azure active directory enabled.'
  end as reason
  
  , app.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_app_service_web_app as app
  left join azure_subscription as sub on sub.subscription_id = app.subscription_id;