App Service apps should have 'Register with Azure Active Directory' enabled
Checks that App Service web apps have a managed identity. Registering the identity with Azure Active Directory lets an app interact with other services without using username and password. Prowler checks for identity SystemAssigned or UserAssigned.
Missing managed identity drives reliance on stored secrets. Leaked credentials enable unauthorized access to SQL, Storage, or Key Vault, leading to data exfiltration, tampering, and lateral movement. Secret expiry or revocation can break connectivity, degrading availability.
What this control checks
Web app passes if a managed identity (SystemAssigned or UserAssigned) is configured; fails if none.
Common pitfalls
Function apps are excluded from the policy
Azure Policy 2b9ad585-36bc-4615-b300-fd4435808332 audits Microsoft.Web/sites whose kind does not contain functionapp.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should use managed identity" (2b9ad585-36bc-4615-b300-fd4435808332); Prowler check app_register_with_identity (prowler azure --checks app_register_with_identity); PowerPipe control azure_compliance.control.appservice_web_app_register_with_active_directory_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov checks CKV_AZURE_16 and CKV_AZURE_71; KICS query "App Service Managed Identity Disabled" (b61cce4b-0cc4-472b-8096-15617a6d769b); Trivy check AZU-0002.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 2.1.2.i (identify who is responsible for implementing the risk treatment measures and when they should be implemented;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;) and 3 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-3 (Access Enforcement), IA-2 (Identification and Authentication (Organizational users)) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.4 Ensure that Register with Entra ID is enabled on App Service
- 9.5 Ensure that Register with Entra ID is enabled on App Service
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_register_with_active_directory_enabled - Checkov Checks:
CKV_AZURE_16,CKV_AZURE_71 - Powerpipe Control:
azure_compliance.control.appservice_web_app_register_with_active_directory_enabled - Prowler Check:
app_register_with_identity - Azure Policy Definition:
2b9ad585-36bc-4615-b300-fd4435808332 - KICS Query:
b61cce4b-0cc4-472b-8096-15617a6d769b - Trivy Check:
AZU-0002
Last reviewed: 2026-10-11