Azure Compliance ControlsAzure App Service
App Service API apps should use managed identity
Use a managed identity for enhanced authentication security. The Azure Policy checks Microsoft.Web/sites that are not function apps. Checkov CKV_AZURE_71 checks that the managed identity provider is enabled for app services.
What this control checks
App Service apps must have a managed identity enabled (identity type set)
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_uses_managed_identity - Checkov Check:
CKV_AZURE_71 - Powerpipe Control:
azure_compliance.control.appservice_api_app_uses_managed_identity - Azure Policy Definition:
2b9ad585-36bc-4615-b300-fd4435808332 - KICS Query:
b61cce4b-0cc4-472b-8096-15617a6d769b
Last reviewed: 2026-10-10