App Service apps should use managed identity

NIS2 Directive (EU 2022/2555)

• 2 Risk management policy
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• AC-2 Account Management
• Access Enforcement (AC-3)
• IA-2: Identification And Authentication
• IA-4 Identifier Management

FedRAMP Moderate Baseline Rev 4

• AC-2 (3): Disable Inactive Accounts
• AC-3 Access Enforcement
• IA-2 (2): Network Access To Non-Privileged Accounts
• IA-4 Identifier Management

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
• 3.5.1 Identify system users, processes acting on behalf of users, and devices
• 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
• 3.5.5 Prevent reuse of identifiers for a defined period

CIS Azure Benchmark v2.0.0

• 9.5 Ensure that Register with Azure Active Directory is enabled on App Service

CIS Azure Benchmark v2.1.0

• 9.4 Ensure that Register with Entra ID is enabled on App Service

CIS Azure Benchmark v3.0.0

• 9.5 Ensure that Register with Entra ID is enabled on App Service

CMMC 2.0 Level 2

• AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
• IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
• IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
• IA.L2-3.5.5 Prevent reuse of identifiers for a defined period

FedRAMP High

• AC-2 Account Management
• AC-3 Access Enforcement
• IA-2 Identification and Authentication (Organizational users)
• IA-4 Identifier Management