Back to Checks
azure

App Service web app has HTTP logs enabled in diagnostic settings

app_http_logs_enabled
Service: appSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.web/sites

Azure App Service web apps diagnostic settings include HTTP request logging when the AppServiceHTTPLogs category (or the allLogs group) is enabled to capture web access events.

Prowler logoProwlerprowler-provider-azure

Risk

Without HTTP access logs, visibility into requests is lost, hindering detection of brute force, probing, and injection attempts. This weakens forensics and reduces confidentiality and integrity by masking data access paths and blocking reliable incident timelines.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_http_logs_enabled

Recommendation

Enable diagnostic settings with AppServiceHTTPLogs (or allLogs) and route logs to a centralized store. Enforce least privilege, retention, and tamper-resistant storage. Integrate with a SIEM for analytics and alerting, and periodically verify logging coverage across all apps and regions.

Remediation

CLI

az monitor diagnostic-settings create --name <example_resource_name> --resource /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Web/sites/<APP_NAME> --workspace <LOG_ANALYTICS_WORKSPACE_RESOURCE_ID> --logs '[{"category":"AppServiceHTTPLogs","enabled":true}]'

Terraform

# Enable HTTP Logs for App Service via Azure Monitor diagnostic setting
resource "azurerm_monitor_diagnostic_setting" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  target_resource_id         = "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Web/sites/<example_resource_name>"
  log_analytics_workspace_id = "<example_resource_id>" # Destination Log Analytics workspace

  log {                      # Critical: enables the HTTP Logs category
    category = "AppServiceHTTPLogs"
    enabled  = true
  }
}

NativeIaC

// Enable HTTP Logs for an existing App Service via Azure Monitor diagnostic setting
resource app 'Microsoft.Web/sites@2022-03-01' existing = {
  name: '<example_resource_name>'
}

resource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: '<example_resource_name>'
  scope: app
  properties: {
    workspaceId: '<example_resource_id>' // Destination Log Analytics workspace
    logs: [
      {
        category: 'AppServiceHTTPLogs' // Critical: enable the HTTP Logs category
        enabled: true                  // Critical: turns HTTP Logs on
      }
    ]
  }
}

Other

1In Azure Portal, go to your App Service > Monitoring > Diagnostic settings
2Click + Add diagnostic setting
3Under Logs, check AppServiceHTTPLogs (or select the allLogs category group)
4Choose a destination (Log Analytics workspace, Storage account, or Event Hub)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_http_logs_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, apps in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                if "functionapp" not in app.kind:
                    report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                    report.subscription = subscription_id
                    report.status = "FAIL"
                    if not app.monitor_diagnostic_settings:
                        report.status_extended = f"App {app.name} does not have a diagnostic setting in subscription {subscription_name} ({subscription_id})."
                    else:
                        for diagnostic_setting in app.monitor_diagnostic_settings:
                            report.status_extended = f"App {app.name} does not have HTTP Logs enabled in diagnostic setting {diagnostic_setting.name} in subscription {subscription_name} ({subscription_id})"
                            for log in diagnostic_setting.logs:
                                if log.category == "AppServiceHTTPLogs" and log.enabled:
                                    report.status = "PASS"
                                    report.status_extended = f"App {app.name} has HTTP Logs enabled in diagnostic setting {diagnostic_setting.name} in subscription {subscription_name} ({subscription_id})"
                                    break
                                elif log.category_group == "allLogs" and log.enabled:
                                    report.status = "PASS"
                                    report.status_extended = f"App {app.name} has allLogs category group which includes HTTP Logs enabled in diagnostic setting {diagnostic_setting.name} in subscription {subscription_name} ({subscription_id})"
                                    break
                    findings.append(report)

        return findings

References