App Service apps should use managed identity
Use a managed identity for enhanced authentication security. Azure App Service web apps are configured with a managed identity (SystemAssigned or UserAssigned) for token-based access to Azure resources without embedded credentials.
Missing managed identity drives reliance on stored secrets. Leaked credentials enable unauthorized access to SQL, Storage, or Key Vault, leading to data exfiltration, tampering, and lateral movement. Secret expiry or revocation can break connectivity, degrading availability.
What this control checks
App Service apps must use a managed identity instead of stored credentials
Common pitfalls
Function apps are excluded from the policy
Azure Policy 2b9ad585-36bc-4615-b300-fd4435808332 targets Microsoft.Web/sites where kind does not contain functionapp.
The effect can be set to AuditIfNotExists or Disabled
The effect parameter has a defaultValue of AuditIfNotExists. The allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should use managed identity" (2b9ad585-36bc-4615-b300-fd4435808332); Prowler check app_register_with_identity (prowler azure --checks app_register_with_identity); PowerPipe control azure_compliance.control.appservice_web_app_uses_managed_identity.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_71; KICS query "App Service Managed Identity Disabled" (b61cce4b-0cc4-472b-8096-15617a6d769b).
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 2.1.2.i (identify who is responsible for implementing the risk treatment measures and when they should be implemented;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;) and 3 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-2 (Account Management), AC-3 (Access Enforcement), IA-2 (Identification and Authentication (organizational Users)) and 1 more clause.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-2 (Account Management), AC-3 (Access Enforcement), IA-2 (Identification and Authentication (Organizational users)) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- AC-2 Account Management
- Access Enforcement (AC-3)
- IA-2: Identification And Authentication
- IA-4 Identifier Management
FedRAMP Moderate Baseline Rev 4
- AC-2 (3): Disable Inactive Accounts
- AC-3 Access Enforcement
- IA-2 (2): Network Access To Non-Privileged Accounts
- IA-4 Identifier Management
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.5.1 Identify system users, processes acting on behalf of users, and devices
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- 3.5.6 Disable identifiers after a defined period of inactivity
- 9.5 Ensure that Register with Azure Active Directory is enabled on App Service
- 9.4 Ensure that Register with Entra ID is enabled on App Service
- 9.5 Ensure that Register with Entra ID is enabled on App Service
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- IA.L1-3.5.1 Identify system users, processes acting on behalf of users, and devices
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.5 Prevent reuse of identifiers for a defined period
1 more clause
- IA.L2-3.5.6 Disable identifiers after a defined period of inactivity
- AC-2 Account Management
- AC-3 Access Enforcement
- IA-2 Identification and Authentication (Organizational users)
- IA-4 Identifier Management
Related controls
- App Service web apps should require HTTPS for all access
- SQL servers should have an Azure Active Directory administrator configured
- Service Bus namespaces should have Azure Active Directory (Azure AD) authentication configured
- App Service apps should use the latest TLS version
- Function apps should have virtual network integration enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_uses_managed_identity - Checkov Check:
CKV_AZURE_71 - Powerpipe Control:
azure_compliance.control.appservice_web_app_uses_managed_identity - Prowler Check:
app_register_with_identity - Azure Policy Definition:
2b9ad585-36bc-4615-b300-fd4435808332 - KICS Query:
b61cce4b-0cc4-472b-8096-15617a6d769b
Last reviewed: 2026-10-11