Azure Compliance ControlsAzure App Service
App Service web apps should have remote debugging disabled
Remote debugging requires inbound ports to be opened on a web application. Remote debugging should be turned off. The Azure Policy audit definition checks that `remoteDebuggingEnabled` equals `false` on `Microsoft.Web/sites` that are not function apps.
What this control checks
Web apps pass when remote debugging is turned off and fail when it is turned on
Framework mappings
The clauses this control is mapped to in each framework.
- 9.12 Ensure that 'Remote debugging' is set to 'Off'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_remote_debugging_disabled - Checkov Check:
CKV_AZURE_72 - Powerpipe Control:
azure_compliance.control.appservice_web_app_remote_debugging_disabled - Azure Policy Definitions:
a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b,cb510bfd-1cba-4d9f-a230-cb0976f4bb71
Last reviewed: 2026-10-11