App Service apps should have App Service authentication configured

Azure App Service authentication can prevent anonymous HTTP requests from reaching the web app, or authenticate those that have tokens before they reach the web app. Prowler checks that platform auth is enabled and an identity provider is configured.

Without platform authentication, apps may accept anonymous requests, enabling unauthorized access to APIs and data. Attackers can enumerate endpoints and bypass weak app checks, risking data exposure (C), unauthorized changes (I), and automated abuse impacting availability (A).

What this control checks

App Service apps must have App Service authentication configured.

Common pitfalls

Fill out auth_settings with auth backend settings

The auth_settings block needs to be filled out with the appropriate auth backend settings.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should have authentication enabled" (95bccee9-a7f8-4bec-9ee9-62c3473701fc); Prowler check app_ensure_auth_is_set_up (prowler azure --checks app_ensure_auth_is_set_up); PowerPipe control azure_compliance.control.appservice_authentication_enabled.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_13; Trivy check AZU-0003.

Framework-specific interpretation

NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.1.2.c (ensure that access is only granted to users that have been adequately authenticated.), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...) and 6 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIS2 Directive (EU 2022/2555)

2 Risk management policy
5 Supply chain security
6 Security in network and information systems acquisition, development and maintenance
11 Access control

BSI C5:2025

IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.

CIS Azure Benchmark v1.3.0