Azure Compliance ControlsAzure App Service
App Service apps should have remote debugging disabled
Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. The Azure Policy definitions apply to `Microsoft.Web/sites` resources whose kind does not contain `functionapp`.
What this control checks
App Service apps must have remoteDebuggingEnabled set to false (remote debugging turned off).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Configuration Settings (CM-6)
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.12: Monitor and control remote access sessions.
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 3.1.b Segregation of Functions
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- CM-6 Configuration Settings
- 0912.09s1Organizational.4-09.s 09.08 Exchange of Information
- 1194.01l2Organizational.2-01.l 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_remote_debugging_disabled - Checkov Check:
CKV_AZURE_72 - Powerpipe Control:
azure_compliance.control.appservice_api_app_remote_debugging_disabled - Azure Policy Definitions:
a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b,cb510bfd-1cba-4d9f-a230-cb0976f4bb71
Last reviewed: 2026-10-10