Pipeline: 9.5 Ensure that Register with Entra ID is enabled on App Service

Description

Managed service identity in App Service provides more security by eliminating secrets from the app, such as credentials in the connection strings. When registering an App Service with Entra ID, the app will connect to other Azure services securely without the need for usernames and passwords.

App Service provides a highly scalable, self-patching web hosting service in Azure. It also provides a managed identity for apps, which is a turn-key solution for securing access to Azure SQL Database and other Azure services.

Remediation

From Azure Portal

Login to Azure Portal using https://portal.azure.com.
Go to App Services.
Click on each App.
Under Setting section, Click on Identity.
Under the System assigned pane, set Status to On.

From Azure CLI

To register with Entra ID for an existing app, run the following command:

az webapp identity assign --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME>

From PowerShell

To register with Entra ID for an existing app, run the following command:

Set-AzWebApp -AssignIdentity $True -ResourceGroupName <resource_Group_Name> -Name <App_Name>

Default Value

By default, Managed service identity via Entra ID is disabled.

Run the pipeline

To run this pipeline from your terminal:

flowpipe pipeline run azure_cis.pipeline.cis_v300_9_5

Use this pipeline

To call this pipeline from your pipeline, use a step:

step "pipeline" "step_name" {
  pipeline = azure_cis.pipeline.cis_v300_9_5  
}

Params

Name	Type	Required	Description	Default
database	connection.steampipe	Yes	Database connection string.	`connection.steampipe.default`
notifier	notifier	Yes	The name of the notifier to use for sending notification messages.	`notifier.default`
notification_level	string	Yes	The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.	`info`
approvers	list(notifier)	Yes	List of notifiers to be used for obtaining action/approval decisions.	`notifier.default`

Outputs

This pipeline has no outputs.