Azure Compliance ControlsAzure App Service
App Service apps should have 'Register with Azure Active Directory' enabled
Checks that App Service web apps have a managed identity. Registering the identity with Azure Active Directory lets an app interact with other services without using username and password. Prowler checks for identity SystemAssigned or UserAssigned.
What this control checks
Web app passes if a managed identity (SystemAssigned or UserAssigned) is configured; fails if none.
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.4 Ensure that Register with Entra ID is enabled on App Service
- 9.5 Ensure that Register with Entra ID is enabled on App Service
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_register_with_active_directory_enabled - Checkov Checks:
CKV_AZURE_16,CKV_AZURE_71 - Powerpipe Control:
azure_compliance.control.appservice_web_app_register_with_active_directory_enabled - Prowler Check:
app_register_with_identity - Azure Policy Definition:
2b9ad585-36bc-4615-b300-fd4435808332 - KICS Query:
b61cce4b-0cc4-472b-8096-15617a6d769b - Trivy Check:
AZU-0002
Last reviewed: 2026-10-11