App Service API apps should use managed identity
Use a managed identity for enhanced authentication security. The Azure Policy checks Microsoft.Web/sites that are not function apps. Checkov CKV_AZURE_71 checks that the managed identity provider is enabled for app services.
Use a managed identity for enhanced authentication security.
What this control checks
App Service apps must have a managed identity enabled (identity type set)
Common pitfalls
Function apps are excluded from the policy
The policy checks Microsoft.Web/sites where kind does not contain functionapp.
Policy only audits, effect can be Disabled
The effect parameter defaults to AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should use managed identity" (2b9ad585-36bc-4615-b300-fd4435808332); PowerPipe control azure_compliance.control.appservice_api_app_uses_managed_identity.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_71; KICS query "App Service Managed Identity Disabled" (b61cce4b-0cc4-472b-8096-15617a6d769b).
Framework-specific interpretation
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-3 (Access Enforcement), IA-2 (Identification and Authentication (Organizational users)) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_uses_managed_identity - Checkov Check:
CKV_AZURE_71 - Powerpipe Control:
azure_compliance.control.appservice_api_app_uses_managed_identity - Azure Policy Definition:
2b9ad585-36bc-4615-b300-fd4435808332 - KICS Query:
b61cce4b-0cc4-472b-8096-15617a6d769b
Last reviewed: 2026-10-10