App Service web apps should have remote debugging disabled
Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off. The Azure Policy audit definition checks that `remoteDebuggingEnabled` equals `false` on `Microsoft.Web/sites` that are not function apps.
Remote debugging requires inbound ports to be opened on a web application.
What this control checks
Web apps pass when remote debugging is turned off and fail when it is turned on
Common pitfalls
Missing block passes the check
Checkov CKV_AZURE_72 inspects site_config/[0]/remote_debugging_enabled and expects False. The check uses missing_block_result=CheckResult.PASSED.
Function apps are not in scope
The policy rule applies to Microsoft.Web/sites where kind has notContains set to functionapp.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure App Service apps to turn off remote debugging" (a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b) and "App Service apps should have remote debugging turned off" (cb510bfd-1cba-4d9f-a230-cb0976f4bb71); PowerPipe control azure_compliance.control.appservice_web_app_remote_debugging_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_72.
Framework-specific interpretation
CIS Azure Benchmark v3.0.0: Mapped to 9.12 (Ensure that 'Remote debugging' is set to 'Off').
Framework mappings
The clauses this control is mapped to in each framework.
- 9.12 Ensure that 'Remote debugging' is set to 'Off'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_remote_debugging_disabled - Checkov Check:
CKV_AZURE_72 - Powerpipe Control:
azure_compliance.control.appservice_web_app_remote_debugging_disabled - Azure Policy Definitions:
a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b,cb510bfd-1cba-4d9f-a230-cb0976f4bb71
Last reviewed: 2026-10-11