Back to Checks
azure

App Service app has App Service Authentication enabled

app_ensure_auth_is_set_up
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.web/sites

Azure App Service can enforce built-in Authentication/Authorization (Easy Auth) so requests are authenticated by a provider before reaching app code.

This evaluates whether platform auth is enabled for the app and an identity provider is configured.

Prowler logoProwlerprowler-provider-azure

Risk

Without platform authentication, apps may accept anonymous requests, enabling unauthorized access to APIs and data. Attackers can enumerate endpoints and bypass weak app checks, risking data exposure (C), unauthorized changes (I), and automated abuse impacting availability (A).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_ensure_auth_is_set_up

Recommendation

Enable App Service Authentication/Authorization and set Require authentication for unauthenticated requests. Use Microsoft Entra or a trusted IdP, restrict tenants/audiences, enforce HTTPS, and apply least privilege with role/claim checks and Conditional Access for defense-in-depth. Avoid Allow anonymous requests.

Remediation

CLI

az webapp auth update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --enabled true

Terraform

# Enable App Service Authentication for an App Service (use azurerm_linux_web_app or azurerm_windows_web_app)
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  service_plan_id     = "<example_resource_id>"

  site_config {}

  auth_settings_v2 {
    auth_enabled = true # CRITICAL: Enables built-in authentication (Easy Auth)
  }
}

NativeIaC

// Enable App Service Authentication (Easy Auth) for an existing Web App
resource auth 'Microsoft.Web/sites/config@2022-03-01' = {
  name: '<example_resource_name>/authsettingsV2'
  properties: {
    platformEnabled: true // CRITICAL: Turns on built-in authentication for the app
  }
}

Other

1Sign in to the Azure Portal and go to App Services
2Select <APP_NAME> and open Authentication
3Click Add identity provider, choose Microsoft, and click Add
4Save changes
5This enables App Service Authentication for the app

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_ensure_auth_is_set_up(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Authentication is set up for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                if not app.auth_enabled:
                    report.status = "FAIL"
                    report.status_extended = f"Authentication is not set up for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References