Azure Policy built-in definitions for Azure App Service
This page is an index of Azure Policy built-in policy definitions for Azure App Service. For additional Azure Policy built-ins for other services, see Azure Policy built-in definitions.
The name of each built-in policy definition links to the policy definition in the Azure portal. Use the link in the Version column to view the source on the Azure Policy GitHub repo.
Azure App Service
| Name (Azure portal) |
Description | Effect(s) | Version (GitHub) |
|---|---|---|---|
| [Preview]: App Service Plans should be Zone Redundant | App Service Plans can be configured to be Zone Redundant or not. When the 'zoneRedundant' property is set to 'false' for an App Service Plan, it is not configured for Zone Redundancy. This policy identifies and enforces the Zone Redundancy configuration for App Service Plans. | Audit, Deny, Disabled | 1.0.0-preview |
| App Service app slots should be injected into a virtual network | Injecting App Service Apps in a virtual network unlocks advanced App Service networking and security features and provides you with greater control over your network security configuration. Learn more at: https://docs.microsoft.com/azure/app-service/web-sites-integrate-with-vnet. | Audit, Deny, Disabled | 1.0.0 |
| App Service app slots should disable public network access | Disabling public network access improves security by ensuring that the App Service is not exposed on the public internet. Creating private endpoints can limit exposure of an App Service. Learn more at: https://aka.ms/app-service-private-endpoint. | Audit, Disabled, Deny | 1.0.0 |
| App Service app slots should enable configuration routing to Azure Virtual Network | By default, app configuration such as pulling container images and mounting content storage will not be routed through the regional virtual network integration. Using the API to set routing options to true enables configuration traffic through the Azure Virtual Network. These settings allow features like network security groups and user defined routes to be used, and service endpoints to be private. For more information, visit https://aka.ms/appservice-vnet-configuration-routing. | Audit, Deny, Disabled | 1.0.0 |
| App Service app slots should enable outbound non-RFC 1918 traffic to Azure Virtual Network | By default, if one uses regional Azure Virtual Network (VNET) integration, the app only routes RFC1918 traffic into that respective virtual network. Using the API to set 'vnetRouteAllEnabled' to true enables all outbound traffic into the Azure Virtual Network. This setting allows features like network security groups and user defined routes to be used for all outbound traffic from the App Service app. | Audit, Deny, Disabled | 1.0.0 |
| App Service app slots should have Client Certificates (Incoming client certificates) enabled | Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app. This policy applies to apps with Http version set to 1.1. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots should have local authentication methods disabled for FTP deployments | Disabling local authentication methods for FTP deployments improves security by ensuring that App Service slots exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | AuditIfNotExists, Disabled | 1.0.3 |
| App Service app slots should have local authentication methods disabled for SCM site deployments | Disabling local authentication methods for SCM sites improves security by ensuring that App Service slots exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | AuditIfNotExists, Disabled | 1.0.4 |
| App Service app slots should have remote debugging turned off | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 1.0.1 |
| App Service app slots should have resource logs enabled | Audit enabling of resource logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots should not have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled, Deny | 2.0.0 |
| App Service app slots should require FTPS only | Enable FTPS enforcement for enhanced security. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots should use an Azure file share for its content directory | The content directory of an app should be located on an Azure file share. The storage account information for the file share must be provided before any publishing activity. To learn more about using Azure Files for hosting app service content refer to https://go.microsoft.com/fwlink/?linkid=2151594. | Audit, Disabled | 1.0.0 |
| App Service app slots should use latest 'HTTP Version' | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots should use managed identity | Use a managed identity for enhanced authentication security | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots should use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for App Service apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | AuditIfNotExists, Disabled | 1.1.0 |
| App Service app slots that use Java should use a specified 'Java version' | Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Java version that meets your requirements. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots that use PHP should use a specified 'PHP version' | Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a PHP version that meets your requirements. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service app slots that use Python should use a specified 'Python version' | Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Python version that meets your requirements. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service apps should be injected into a virtual network | Injecting App Service Apps in a virtual network unlocks advanced App Service networking and security features and provides you with greater control over your network security configuration. Learn more at: https://docs.microsoft.com/azure/app-service/web-sites-integrate-with-vnet. | Audit, Deny, Disabled | 3.0.0 |
| App Service apps should disable public network access | Disabling public network access improves security by ensuring that the App Service is not exposed on the public internet. Creating private endpoints can limit exposure of an App Service. Learn more at: https://aka.ms/app-service-private-endpoint. | Audit, Disabled, Deny | 1.1.0 |
| App Service apps should enable configuration routing to Azure Virtual Network | By default, app configuration such as pulling container images and mounting content storage will not be routed through the regional virtual network integration. Using the API to set routing options to true enables configuration traffic through the Azure Virtual Network. These settings allow features like network security groups and user defined routes to be used, and service endpoints to be private. For more information, visit https://aka.ms/appservice-vnet-configuration-routing. | Audit, Deny, Disabled | 1.0.0 |
| App Service apps should enable outbound non-RFC 1918 traffic to Azure Virtual Network | By default, if one uses regional Azure Virtual Network (VNET) integration, the app only routes RFC1918 traffic into that respective virtual network. Using the API to set 'vnetRouteAllEnabled' to true enables all outbound traffic into the Azure Virtual Network. This setting allows features like network security groups and user defined routes to be used for all outbound traffic from the App Service app. | Audit, Deny, Disabled | 1.0.0 |
| App Service apps should have authentication enabled | Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the web app, or authenticate those that have tokens before they reach the web app. | AuditIfNotExists, Disabled | 2.0.1 |
| App Service apps should have Client Certificates (Incoming client certificates) enabled | Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app. This policy applies to apps with Http version set to 1.1. | AuditIfNotExists, Disabled | 1.0.0 |
| App Service apps should have local authentication methods disabled for FTP deployments | Disabling local authentication methods for FTP deployments improves security by ensuring that App Services exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | AuditIfNotExists, Disabled | 1.0.3 |
| App Service apps should have local authentication methods disabled for SCM site deployments | Disabling local authentication methods for SCM sites improves security by ensuring that App Services exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | AuditIfNotExists, Disabled | 1.0.3 |
| App Service apps should have remote debugging turned off | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 2.0.0 |
| App Service apps should have resource logs enabled | Audit enabling of resource logs on the app. This enables you to recreate activity trails for investigation purposes if a security incident occurs or your network is compromised. | AuditIfNotExists, Disabled | 2.0.1 |
| App Service apps should not have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app. | AuditIfNotExists, Disabled | 2.0.0 |
| App Service apps should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled, Deny | 4.0.0 |
| App Service apps should require FTPS only | Enable FTPS enforcement for enhanced security. | AuditIfNotExists, Disabled | 3.0.0 |
| App Service apps should use a SKU that supports private link | With supported SKUs, Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to apps, you can reduce data leakage risks. Learn more about private links at: https://aka.ms/private-link. | Audit, Deny, Disabled | 4.1.0 |
| App Service apps should use a virtual network service endpoint | Use virtual network service endpoints to restrict access to your app from selected subnets from an Azure virtual network. To learn more about App Service service endpoints, visit https://aka.ms/appservice-vnet-service-endpoint. | AuditIfNotExists, Disabled | 2.0.1 |
| App Service apps should use an Azure file share for its content directory | The content directory of an app should be located on an Azure file share. The storage account information for the file share must be provided before any publishing activity. To learn more about using Azure Files for hosting app service content refer to https://go.microsoft.com/fwlink/?linkid=2151594. | Audit, Disabled | 3.0.0 |
| App Service apps should use latest 'HTTP Version' | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. | AuditIfNotExists, Disabled | 4.0.0 |
| App Service apps should use managed identity | Use a managed identity for enhanced authentication security | AuditIfNotExists, Disabled | 3.0.0 |
| App Service apps should use private link | Azure Private Link lets you connect your virtual networks to Azure services without a public IP address at the source or destination. The Private Link platform handles the connectivity between the consumer and services over the Azure backbone network. By mapping private endpoints to App Service, you can reduce data leakage risks. Learn more about private links at: https://aka.ms/private-link. | AuditIfNotExists, Disabled | 1.0.1 |
| App Service apps should use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for App Service apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | AuditIfNotExists, Disabled | 2.1.0 |
| App Service apps that use Java should use a specified 'Java version' | Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Java version that meets your requirements. | AuditIfNotExists, Disabled | 3.1.0 |
| App Service apps that use PHP should use a specified 'PHP version' | Periodically, newer versions are released for PHP software either due to security flaws or to include additional functionality. Using the latest PHP version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a PHP version that meets your requirements. | AuditIfNotExists, Disabled | 3.2.0 |
| App Service apps that use Python should use a specified 'Python version' | Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for App Service apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Python version that meets your requirements. | AuditIfNotExists, Disabled | 4.1.0 |
| App Service Environment apps should not be reachable over public internet | To ensure apps deployed in an App Service Environment are not accessible over public internet, one should deploy App Service Environment with an IP address in virtual network. To set the IP address to a virtual network IP, the App Service Environment must be deployed with an internal load balancer. | Audit, Deny, Disabled | 3.0.0 |
| App Service Environment should be configured with strongest TLS Cipher suites | The two most minimal and strongest cipher suites required for App Service Environment to function correctly are : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. | Audit, Disabled | 1.0.0 |
| App Service Environment should be provisioned with latest versions | Only allow App Service Environment version 2 or version 3 to be provisioned. Older versions of App Service Environment require manual management of Azure resources and have greater scaling limitations. | Audit, Deny, Disabled | 1.0.0 |
| App Service Environment should have internal encryption enabled | Setting InternalEncryption to true encrypts the pagefile, worker disks, and internal network traffic between the front ends and workers in an App Service Environment. To learn more, refer to https://docs.microsoft.com/azure/app-service/environment/app-service-app-service-environment-custom-settings#enable-internal-encryption. | Audit, Disabled | 1.0.1 |
| App Service Environment should have TLS 1.0 and 1.1 disabled | TLS 1.0 and 1.1 are out-of-date protocols that do not support modern cryptographic algorithms. Disabling inbound TLS 1.0 and 1.1 traffic helps secure apps in an App Service Environment. | Audit, Deny, Disabled | 2.0.1 |
| Configure App Service app slots to disable local authentication for FTP deployments | Disabling local authentication methods for FTP deployments improves security by ensuring that App Service slots exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | DeployIfNotExists, Disabled | 1.0.3 |
| Configure App Service app slots to disable local authentication for SCM sites | Disabling local authentication methods for SCM sites improves security by ensuring that App Service slots exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | DeployIfNotExists, Disabled | 1.0.3 |
| Configure App Service app slots to disable public network access | Disable public network access for your App Services so that it is not accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. | Modify, Disabled | 1.1.0 |
| Configure App Service app slots to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Modify, Disabled | 2.0.0 |
| Configure App Service app slots to turn off remote debugging | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | DeployIfNotExists, Disabled | 1.1.0 |
| Configure App Service app slots to use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for App Service apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | DeployIfNotExists, Disabled | 1.2.0 |
| Configure App Service apps to disable local authentication for FTP deployments | Disabling local authentication methods for FTP deployments improves security by ensuring that App Services exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | DeployIfNotExists, Disabled | 1.0.3 |
| Configure App Service apps to disable local authentication for SCM sites | Disabling local authentication methods for SCM sites improves security by ensuring that App Services exclusively require Microsoft Entra identities for authentication. Learn more at: https://aka.ms/app-service-disable-basic-auth. | DeployIfNotExists, Disabled | 1.0.3 |
| Configure App Service apps to disable public network access | Disable public network access for your App Services so that it is not accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. | Modify, Disabled | 1.1.0 |
| Configure App Service apps to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Modify, Disabled | 2.0.0 |
| Configure App Service apps to turn off remote debugging | Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. | DeployIfNotExists, Disabled | 1.0.0 |
| Configure App Service apps to use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for App Service apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | DeployIfNotExists, Disabled | 1.1.0 |
| Configure Function app slots to disable public network access | Disable public network access for your Function apps so that it is not accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. | Modify, Disabled | 1.1.0 |
| Configure Function app slots to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Modify, Disabled | 2.0.0 |
| Configure Function app slots to turn off remote debugging | Remote debugging requires inbound ports to be opened on a Function app. Remote debugging should be turned off. | DeployIfNotExists, Disabled | 1.1.0 |
| Configure Function app slots to use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | DeployIfNotExists, Disabled | 1.2.0 |
| Configure Function apps to disable public network access | Disable public network access for your Function apps so that it is not accessible over the public internet. This can reduce data leakage risks. Learn more at: https://aka.ms/app-service-private-endpoint. | Modify, Disabled | 1.1.0 |
| Configure Function apps to only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Modify, Disabled | 2.0.0 |
| Configure Function apps to turn off remote debugging | Remote debugging requires inbound ports to be opened on Function apps. Remote debugging should be turned off. | DeployIfNotExists, Disabled | 1.0.0 |
| Configure Function apps to use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | DeployIfNotExists, Disabled | 1.1.0 |
| Enable logging by category group for App Service (microsoft.web/sites) to Log Analytics | Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Log Analytics workspace for App Service (microsoft.web/sites). | DeployIfNotExists, AuditIfNotExists, Disabled | 1.0.0 |
| Enable logging by category group for App Service Environments (microsoft.web/hostingenvironments) to Event Hub | Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to an Event Hub for App Service Environments (microsoft.web/hostingenvironments). | DeployIfNotExists, AuditIfNotExists, Disabled | 1.0.0 |
| Enable logging by category group for App Service Environments (microsoft.web/hostingenvironments) to Log Analytics | Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Log Analytics workspace for App Service Environments (microsoft.web/hostingenvironments). | DeployIfNotExists, AuditIfNotExists, Disabled | 1.0.0 |
| Enable logging by category group for App Service Environments (microsoft.web/hostingenvironments) to Storage | Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Storage Account for App Service Environments (microsoft.web/hostingenvironments). | DeployIfNotExists, AuditIfNotExists, Disabled | 1.0.0 |
| Enable logging by category group for Function App (microsoft.web/sites) to Log Analytics | Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Log Analytics workspace for Function App (microsoft.web/sites). | DeployIfNotExists, AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots should disable public network access | Disabling public network access improves security by ensuring that the Function app is not exposed on the public internet. Creating private endpoints can limit exposure of a Function App. Learn more at: https://aka.ms/app-service-private-endpoint. | Audit, Disabled, Deny | 1.0.0 |
| Function app slots should have Client Certificates (Incoming client certificates) enabled | Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app. This policy applies to apps with Http version set to 1.1. | AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots should have remote debugging turned off | Remote debugging requires inbound ports to be opened on Function apps. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots should not have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app. | AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled, Deny | 2.0.0 |
| Function app slots should require FTPS only | Enable FTPS enforcement for enhanced security. | AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots should use an Azure file share for its content directory | The content directory of a Function app should be located on an Azure file share. The storage account information for the file share must be provided before any publishing activity. To learn more about using Azure Files for hosting app service content refer to https://go.microsoft.com/fwlink/?linkid=2151594. | Audit, Disabled | 1.0.0 |
| Function app slots should use latest 'HTTP Version' | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. | AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots should use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | AuditIfNotExists, Disabled | 1.1.0 |
| Function app slots that use Java should use a specified 'Java version' | Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Java version that meets your requirements. | AuditIfNotExists, Disabled | 1.0.0 |
| Function app slots that use Python should use a specified 'Python version' | Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Python version that meets your requirements. | AuditIfNotExists, Disabled | 1.0.0 |
| Function apps should disable public network access | Disabling public network access improves security by ensuring that the Function app is not exposed on the public internet. Creating private endpoints can limit exposure of a Function App. Learn more at: https://aka.ms/app-service-private-endpoint. | Audit, Disabled, Deny | 1.0.0 |
| Function apps should have authentication enabled | Azure App Service Authentication is a feature that can prevent anonymous HTTP requests from reaching the Function app, or authenticate those that have tokens before they reach the Function app. | AuditIfNotExists, Disabled | 3.0.0 |
| Function apps should have Client Certificates (Incoming client certificates) enabled | Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app. This policy applies to apps with Http version set to 1.1. | AuditIfNotExists, Disabled | 1.0.0 |
| Function apps should have remote debugging turned off | Remote debugging requires inbound ports to be opened on Function apps. Remote debugging should be turned off. | AuditIfNotExists, Disabled | 2.0.0 |
| Function apps should not have CORS configured to allow every resource to access your apps | Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app. | AuditIfNotExists, Disabled | 2.0.0 |
| Function apps should only be accessible over HTTPS | Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. | Audit, Disabled, Deny | 5.0.0 |
| Function apps should require FTPS only | Enable FTPS enforcement for enhanced security. | AuditIfNotExists, Disabled | 3.0.0 |
| Function apps should use an Azure file share for its content directory | The content directory of a Function app should be located on an Azure file share. The storage account information for the file share must be provided before any publishing activity. To learn more about using Azure Files for hosting app service content refer to https://go.microsoft.com/fwlink/?linkid=2151594. | Audit, Disabled | 3.0.0 |
| Function apps should use latest 'HTTP Version' | Periodically, newer versions are released for HTTP either due to security flaws or to include additional functionality. Using the latest HTTP version for web apps to take advantage of security fixes, if any, and/or new functionalities of the newer version. | AuditIfNotExists, Disabled | 4.0.0 |
| Function apps should use managed identity | Use a managed identity for enhanced authentication security | AuditIfNotExists, Disabled | 3.0.0 |
| Function apps should use the latest TLS version | Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities of the latest version. | AuditIfNotExists, Disabled | 2.1.0 |
| Function apps that use Java should use a specified 'Java version' | Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Java version that meets your requirements. | AuditIfNotExists, Disabled | 3.1.0 |
| Function apps that use Python should use a specified 'Python version' | Periodically, newer versions are released for Python software either due to security flaws or to include additional functionality. Using the latest Python version for Function apps is recommended in order to take advantage of security fixes, if any, and/or new functionalities of the latest version. This policy only applies to Linux apps. This policy requires you to specify a Python version that meets your requirements. | AuditIfNotExists, Disabled | 4.1.0 |
Release notes
October 2024
- TLS 1.3 is now supported in App Service apps and slots. The following policies have been updated to enforce setting the minimum TLS version to 1.3:
- "App Service apps should use the latest TLS version"
- "App Service app slots should use the latest TLS version"
- "Configure App Service apps to use the latest TLS version"
- "Configure App Service app slots to use the latest TLS version"
- "Function apps should use the latest TLS version"
- "Configure Function apps to use the latest TLS version"
- "Function app slots should use the latest TLS version"
- "Configure Function app slots to use the latest TLS version"
April 2023
- App Service apps that use Java should use the latest 'Java version'
- Rename of policy to "App Service apps that use Java should use a specified 'Java version'"
- Update policy so that it requires a version specification before assignment
- App Service apps that use Python should use the latest 'Python version'
- Rename of policy to "App Service apps that use Python should use a specified 'Python version'"
- Update policy so that it requires a version specification before assignment
- Function apps that use Java should use the latest 'Java version'
- Rename of policy to "Function apps that use Java should use a specified 'Java version'"
- Update policy so that it requires a version specification before assignment
- Function apps that use Python should use the latest 'Python version'
- Rename of policy to "Function apps that use Python should use a specified 'Python version'"
- Update policy so that it requires a version specification before assignment
- App Service apps that use PHP should use the latest 'PHP version'
- Rename of policy to "App Service apps that use PHP should use a specified 'PHP version'"
- Update policy so that it requires a version specification before assignment
- App Service app slots that use Python should use a specified 'Python version'
- New policy created
- Function app slots that use Python should use a specified 'Python version'
- New policy created
- App Service app slots that use PHP should use a specified 'PHP version'
- New policy created
- App Service app slots that use Java should use a specified 'Java version'
- New policy created
- Function app slots that use Java should use a specified 'Java version'
- New policy created
November 2022
- Deprecation of policy App Service apps should enable outbound non-RFC 1918 traffic to Azure Virtual Network
- Replaced by a policy with the same display name based on the site property to support Deny effect
- Deprecation of policy App Service app slots should enable outbound non-RFC 1918 traffic to Azure Virtual Network
- Replaced by a policy with the same display name based on the site property to support Deny effect
- App Service apps should enable outbound non-RFC 1918 traffic to Azure Virtual Network
- New policy created
- App Service app slots should enable outbound non-RFC 1918 traffic to Azure Virtual Network
- New policy created
- App Service apps should enable configuration routing to Azure Virtual Network
- New policy created
- App Service app slots should enable configuration routing to Azure Virtual Network
- New policy created
October 2022
- Function app slots should have remote debugging turned off
- New policy created
- App Service app slots should have remote debugging turned off
- New policy created
- Function app slots should use latest 'HTTP Version'
- New policy created
- Function app slots should use the latest TLS version
- New policy created
- App Service app slots should use the latest TLS version
- New policy created
- App Service app slots should have resource logs enabled
- New policy created
- App Service app slots should enable outbound non-RFC 1918 traffic to Azure Virtual Network
- New policy created
- App Service app slots should use managed identity
- New policy created
- App Service app slots should use latest 'HTTP Version'
- New policy created
- Deprecation of policy Configure App Services to disable public network access
- Replaced by "Configure App Service apps to disable public network access"
- Deprecation of policy App Services should disable public network access
- Replaced by "App Service apps should disable public network access" to support Deny effect
- App Service apps should disable public network access
- New policy created
- App Service app slots should disable public network access
- New policy created
- Configure App Service apps to disable public network access
- New policy created
- Configure App Service app slots to disable public network access
- New policy created
- Function apps should disable public network access
- New policy created
- Function app slots should disable public network access
- New policy created
- Configure Function apps to disable public network access
- New policy created
- Configure Function app slots to disable public network access
- New policy created
- Configure App Service app slots to turn off remote debugging
- New policy created
- Configure Function app slots to turn off remote debugging
- New policy created
- Configure App Service app slots to use the latest TLS version
- New policy created
- Configure Function app slots to use the latest TLS version
- New policy created
- App Service apps should use latest 'HTTP Version'
- Update scope to include Windows apps
- Function apps should use latest 'HTTP Version'
- Update scope to include Windows apps
- App Service Environment apps should not be reachable over public internet
- Modify policy definition to remove check on API version
September 2022
- App Service apps should be injected into a virtual network
- Update scope of policy to remove slots
- Creation of "App Service app slots should be injected into a virtual network" to monitor slots
- Update scope of policy to remove slots
- App Service app slots should be injected into a virtual network
- New policy created
- Function apps should have 'Client Certificates (Incoming client certificates)' enabled
- Update scope of policy to remove slots
- Creation of "Function app slots should have 'Client Certificates (Incoming client certificates)' enabled" to monitor slots
- Update scope of policy to remove slots
- Function app slots should have 'Client Certificates (Incoming client certificates)' enabled
- New policy created
- Function apps should use an Azure file share for its content directory
- Update scope of policy to remove slots
- Creation of "Function app slots should use an Azure file share for its content directory" to monitor slots
- Update scope of policy to remove slots
- Function app slots should use an Azure file share for its content directory
- New policy created
- App Service apps should have 'Client Certificates (Incoming client certificates)' enabled
- Update scope of policy to remove slots
- Creation of "App Service app slots should have 'Client Certificates (Incoming client certificates)' enabled" to monitor slots
- Update scope of policy to remove slots
- App Service app slots should have 'Client Certificates (Incoming client certificates)' enabled
- New policy created
- App Service apps should use an Azure file share for its content directory
- Update scope of policy to remove slots
- Creation of "App Service app slots should use an Azure file share for its content directory" to monitor slots
- Update scope of policy to remove slots
- App Service app slots should use an Azure file share for its content directory
- New policy created
- Function app slots should require FTPS only
- New policy created
- App Service app slots should require FTPS only
- New policy created
- Function app slots should not have CORS configured to allow every resource to access your apps
- New policy created
- App Service app slots should not have CORS configured to allow every resource to access your app
- New policy created
- Function apps should only be accessible over HTTPS
- Update scope of policy to remove slots
- Creation of "Function app slots should only be accessible over HTTPS" to monitor slots
- Add "Deny" effect
- Creation of "Configure Function apps to only be accessible over HTTPS" for enforcement of policy
- Update scope of policy to remove slots
- Function app slots should only be accessible over HTTPS
- New policy created
- Configure Function apps to only be accessible over HTTPS
- New policy created
- Configure Function app slots to only be accessible over HTTPS
- New policy created
- App Service apps should use a SKU that supports private link
- Update list of supported SKUs of policy to include the Workflow Standard tier for Logic Apps
- Configure App Service apps to use the latest TLS version
- New policy created
- Configure Function apps to use the latest TLS version
- New policy created
- Configure App Service apps to turn off remote debugging
- New policy created
- Configure Function apps to turn off remote debugging
- New policy created
August 2022
- App Service apps should only be accessible over HTTPS
- Update scope of policy to remove slots
- Creation of "App Service app slots should only be accessible over HTTPS" to monitor slots
- Add "Deny" effect
- Creation of "Configure App Service apps to only be accessible over HTTPS" for enforcement of policy
- Update scope of policy to remove slots
- App Service app slots should only be accessible over HTTPS
- New policy created
- Configure App Service apps to only be accessible over HTTPS
- New policy created
- Configure App Service app slots to only be accessible over HTTPS
- New policy created
July 2022
- Deprecation of the following policies:
- Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On'
- Ensure that 'Python version' is the latest, if used as a part of the API app
- CORS should not allow every resource to access your API App
- Managed identity should be used in your API App
- Remote debugging should be turned off for API Apps
- Ensure that 'PHP version' is the latest, if used as a part of the API app
- API apps should use an Azure file share for its content directory
- FTPS only should be required in your API App
- Ensure that 'Java version' is the latest, if used as a part of the API app
- Ensure that 'HTTP Version' is the latest, if used to run the API app
- Latest TLS version should be used in your API App
- Authentication should be enabled on your API app
- Function apps should have 'Client Certificates (Incoming client certificates)' enabled
- Update scope of policy to include slots
- Update scope of policy to exclude Logic apps
- Ensure WEB app has 'Client Certificates (Incoming client certificates)' set to 'On'
- Rename of policy to "App Service apps should have 'Client Certificates (Incoming client certificates)' enabled"
- Update scope of policy to include slots
- Update scope of policy to include all app types except Function apps
- Ensure that 'Python version' is the latest, if used as a part of the Web app
- Rename of policy to "App Service apps that use Python should use the latest 'Python version'"
- Update scope of policy to include all app types except Function apps
- Ensure that 'Python version' is the latest, if used as a part of the Function app
- Rename of policy to "Function apps that use Python should use the latest 'Python version'"
- Update scope of policy to exclude Logic apps
- CORS should not allow every resource to access your Web Applications
- Rename of policy to "App Service apps should not have CORS configured to allow every resource to access your apps"
- Update scope of policy to include all app types except Function apps
- CORS should not allow every resource to access your Function Apps
- Rename of policy to "Function apps should not have CORS configured to allow every resource to access your apps"
- Update scope of policy to exclude Logic apps
- Managed identity should be used in your Function App
- Rename of policy to "Function apps should use managed identity"
- Update scope of policy to exclude Logic apps
- Managed identity should be used in your Web App
- Rename of policy to "App Service apps should use managed identity"
- Update scope of policy to include all app types except Function apps
- Remote debugging should be turned off for Function Apps
- Rename of policy to "Function apps should have remote debugging turned off"
- Update scope of policy to exclude Logic apps
- Remote debugging should be turned off for Web Applications
- Rename of policy to "App Service apps should have remote debugging turned off"
- Update scope of policy to include all app types except Function apps
- Ensure that 'PHP version' is the latest, if used as a part of the WEB app
- Rename of policy to "App Service apps that use PHP should use the latest 'PHP version'"
- Update scope of policy to include all app types except Function apps
- App Service slots should have local authentication methods disabled for SCM site deployment
- Rename of policy to "App Service app slots should have local authentication methods disabled for SCM site deployments"
- App Service should have local authentication methods disabled for SCM site deployments
- Rename of policy to "App Service apps should have local authentication methods disabled for SCM site deployments"
- App Service slots should have local authentication methods disabled for FTP deployments
- Rename of policy to "App Service app slots should have local authentication methods disabled for FTP deployments"
- App Service should have local authentication methods disabled for FTP deployments
- Rename of policy to "App Service apps should have local authentication methods disabled for FTP deployments"
- Function apps should use an Azure file share for its content directory
- Update scope of policy to include slots
- Update scope of policy to exclude Logic apps
- Web apps should use an Azure file share for its content directory
- Rename of policy to "App Service apps should use an Azure file share for its content directory"
- Update scope of policy to include slots
- Update scope of policy to include all app types except Function apps
- FTPS only should be required in your Function App
- Rename of policy to "Function apps should require FTPS only"
- Update scope of policy to exclude Logic apps
- FTPS should be required in your Web App
- Rename of policy to "App Service apps should require FTPS only"
- Update scope of policy to include all app types except Function apps
- Ensure that 'Java version' is the latest, if used as a part of the Function app
- Rename of policy to "Function apps that use Java should use the latest 'Java version'"
- Update scope of policy to exclude Logic apps
- Ensure that 'Java version' is the latest, if used as a part of the Web app
- Rename of policy to "App Service apps that use Java should use the latest 'Java version"
- Update scope of policy to include all app types except Function apps
- App Service should use private link
- Rename of policy to "App Service apps should use private link"
- Configure App Services to use private DNS zones
- Rename of policy to "Configure App Service apps to use private DNS zones"
- App Service Apps should be injected into a virtual network
- Rename of policy to "App Service apps should be injected into a virtual network"
- Update scope of policy to include slots
- Ensure that 'HTTP Version' is the latest, if used to run the Web app
- Rename of policy to "App Service apps should use latest 'HTTP Version'"
- Update scope of policy to include all app types except Function apps
- Ensure that 'HTTP Version' is the latest, if used to run the Function app
- Rename of policy to "Function apps should use latest 'HTTP Version'"
- Update scope of policy to exclude Logic apps
- Latest TLS version should be used in your Web App
- Rename of policy to "App Service apps should use the latest TLS version"
- Update scope of policy to include all app types except Function apps
- Latest TLS version should be used in your Function App
- Rename of policy to "Function apps should use the latest TLS version"
- Update scope of policy to exclude Logic apps
- App Service Environment should disable TLS 1.0 and 1.1
- Rename of policy to "App Service Environment should have TLS 1.0 and 1.1 disabled"
- Resource logs in App Services should be enabled
- Rename of policy to "App Service apps should have resource logs enabled"
- Authentication should be enabled on your web app
- Rename of policy to "App Service apps should have authentication enabled"
- Authentication should be enabled on your Function app
- Rename of policy to "Function apps should have authentication enabled"
- Update scope of policy to exclude Logic apps
- App Service Environment should enable internal encryption
- Rename of policy to "App Service Environment should have internal encryption enabled"
- Function apps should only be accessible over HTTPS
- Update scope of policy to exclude Logic apps
- App Service should use a virtual network service endpoint
- Rename of policy to "App Service apps should use a virtual network service endpoint"
- Update scope of policy to include all app types except Function apps
June 2022
- Deprecation of policy API App should only be accessible over HTTPS
- Web Application should only be accessible over HTTPS
- Rename of policy to "App Service apps should only be accessible over HTTPS"
- Update scope of policy to include all app types except Function apps
- Update scope of policy to include slots
- Function apps should only be accessible over HTTPS
- Update scope of policy to include slots
- App Service apps should use a SKU that supports private link
- Update logic of policy to include checks on App Service plan tier or name so that the policy supports Terraform deployments
- Update list of supported SKUs of policy to include the Basic and Standard tiers
Next steps
- See the built-ins on the Azure Policy GitHub repo.
- Review the Azure Policy definition structure.
- Review Understanding policy effects.