Azure Compliance ControlsAzure App Service
App Service apps should not allow CORS access from every resource
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app. The Azure Policy check applies to Microsoft.Web/sites resources whose kind does not contain functionapp.
What this control checks
App Service apps should not allow CORS access from every resource
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- CM-6 Configuration Settings
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- AC-4 Information Flow Enforcement
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_cors_no_star - Powerpipe Control:
azure_compliance.control.appservice_web_app_cors_no_star - Azure Policy Definition:
5744710e-cc2f-4ee8-8809-3b11e89f4bc9
Last reviewed: 2026-10-11