Back to Checks
azure

App Service web app has a managed identity configured

app_register_with_identity
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.web/sites

Azure App Service web apps are configured with a managed identity (identity: SystemAssigned or UserAssigned) for token-based access to Azure resources without embedded credentials

Prowler logoProwlerprowler-provider-azure

Risk

Missing managed identity drives reliance on stored secrets. Leaked credentials enable unauthorized access to SQL, Storage, or Key Vault, leading to data exfiltration, tampering, and lateral movement. Secret expiry or revocation can break connectivity, degrading availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_register_with_identity

Recommendation

Enable a managed identity and use it for all service-to-service access. Apply least privilege on target resources and eliminate secrets from code and app settings. Remove legacy credentials, rotate residual keys, and monitor usage for defense in depth. Use system-assigned per app; user-assigned for reuse or separation.

Remediation

CLI

az webapp identity assign --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME>

Terraform

# Enable system-assigned managed identity on the App Service app (use azurerm_linux_web_app or azurerm_windows_web_app)
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = azurerm_resource_group.<example_resource_name>.location
  resource_group_name = azurerm_resource_group.<example_resource_name>.name
  service_plan_id     = azurerm_service_plan.<example_resource_name>.id

  site_config {}

  identity {                    # Critical: enables managed identity
    type = "SystemAssigned"    # Creates a system-assigned identity for the app
  }
}

NativeIaC

// Enable system-assigned managed identity on an existing App Service app
resource app 'Microsoft.Web/sites@2022-09-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  identity: {
    type: 'SystemAssigned' // Critical: enables a managed identity for the app
  }
}

Other

1Sign in to the Azure portal
2Go to App Services and select your app
3Under Settings, select Identity
4On the System assigned tab, set Status to On
5Click Save and confirm

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_register_with_identity(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"App '{app.name}' in subscription '{subscription_name} ({subscription_id})' has an identity configured."

                if not app.identity:
                    report.status = "FAIL"
                    report.status_extended = f"App '{app.name}' in subscription '{subscription_name} ({subscription_id})' does not have an identity configured."

                findings.append(report)

        return findings

References