Azure Compliance ControlsAzure App Service
App Service apps should have App Service authentication configured
Azure App Service authentication can prevent anonymous HTTP requests from reaching the web app, or authenticate those that have tokens before they reach the web app. Prowler checks that platform auth is enabled and an identity provider is configured.
What this control checks
App Service apps must have App Service authentication configured.
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
- 9.1 Ensure App Service Authentication is set on Azure App Service
- 9.1 Ensure App Service Authentication is set up for apps in Azure App Service
- 9.1 Ensure App Service Authentication is set up for apps in Azure App Service
- 9.1 Ensure App Service Authentication is set up for apps in Azure App Service
- 9.1 Ensure App Service Authentication is set up for apps in Azure App Service
- 9.2 Ensure App Service Authentication is set up for apps in Azure App Service
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_authentication_enabled - Checkov Check:
CKV_AZURE_13 - Powerpipe Control:
azure_compliance.control.appservice_authentication_enabled - Prowler Check:
app_ensure_auth_is_set_up - Azure Policy Definition:
95bccee9-a7f8-4bec-9ee9-62c3473701fc - Trivy Check:
AZU-0003
Last reviewed: 2026-10-10