Azure Compliance ControlsAzure App Service
App Service apps should not allow CORS access from every resource
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app. The policy flags App Service apps with CORS configured to allow every resource.
What this control checks
App Service apps must not have allowedOrigins set to * in CORS configuration
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- CM-6 Configuration Settings
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
- 0901.09s1Organizational.1-09.s 09.08 Exchange of Information
- 0916.09s2Organizational.4-09.s 09.08 Exchange of Information
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_cors_no_star - Checkov Check:
CKV_AZURE_57 - Powerpipe Controls:
azure_compliance.control.appservice_api_app_cors_no_star,azure_compliance.control.appservice_web_app_cors_no_star - Azure Policy Definition:
5744710e-cc2f-4ee8-8809-3b11e89f4bc9
Last reviewed: 2026-10-10