azure-app-service-security

Name: azure-app-service-security
Author: vinayaklatthe

161stars34forks

How to install azure-app-service-security?

vinayaklatthe/microsoft-security-skills/azure-app-service-security

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-app-service-security

Installs into the current project.

Summary

Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening, Key Vault references for secrets, and front-end WAF (Front Door / App Gateway). WHEN

Files · 1

View on GitHub

SKILL.md

1	# Azure App Service Security
2
3	Azure App Service hosts web apps and APIs as a managed PaaS. Securing it means eliminating
4	secrets in config, removing public exposure where possible, enforcing modern transport, and
5	fronting it with a WAF when it has to be public.
6
7	## When to use
8	Hardening web apps and APIs hosted on Azure App Service. Use this skill to plan identity,
9	network, secrets, and transport posture for a Web App / API App.
10
11	Do not use this skill for Azure Functions only (similar but separate platform), AKS
12	workloads, or VM-hosted web apps.
13
14	## Pick the configuration by exposure pattern
15
16	\| Exposure \| Inbound \| Outbound \| Front-end \|
17	\|---\|---\|---\|---\|
18	\| Internal-only app (intranet, API for VNet workloads) \| Private endpoint, public access disabled \| VNet integration to spoke \| Internal Application Gateway \|
19	\| Public web app, sensitive data \| Public + access restrictions to WAF only \| VNet integration \| Front Door or App Gateway with WAF, Prevention mode \|
20	\| Public web app, basic \| Public, default \| None / VNet integration \| App Gateway with WAF \|
21	\| API consumed by partners \| Private endpoint + APIM in front \| VNet integration \| APIM (with WAF on APIM if public) \|
22	\| Background worker / no inbound \| Public access disabled \| VNet integration \| None \|
23
24	> Rule of thumb: if it doesn't need to be on the internet, use a private endpoint and
25	> disable public network access. If it does need to be on the internet, put **Front Door /
26	> App Gateway with WAF in Prevention mode** in front and restrict the app to accept traffic
27	> only from the WAF's IP range or service tag.
28
29	## Approach
30
31	1. Enable managed identity — System-assigned managed identity by default. Grant it
32	least-privilege roles on Azure SQL (`SQL DB Contributor` is wrong - use AAD auth +
33	contained user), Storage (`Storage Blob Data Reader`), Key Vault (`Key Vault Secrets
34	User`).
35	*Verify: app has managed identity; no SQL / Storage connection strings with embedded
36	passwords in config.*
37
38	2. Easy Auth for sign-in — Use built-in App Service authentication (Easy Auth) with
39	Microsoft Entra ID for OIDC sign-in without writing auth code. Configure the redirect
40	URI, token store, and `requireAuthentication = true` to gate the whole app.
41	*Verify: anonymous request returns 302 redirect to Entra sign-in; authenticated request
42	returns 200 with the user's principal claims.*
43
44	3. Secrets via Key Vault references — Store secrets in Key Vault; reference them in app
45	settings as `@Microsoft.KeyVault(SecretUri=...)`. No code change; managed identity reads
46	the secret at start / refresh.
47	*Verify: app settings show `Key Vault Reference` as Resolved; no plaintext secrets in
48	config.*
49
50	4. Network isolation — VNet integration for outbound (so the app can reach private
51	endpoints, on-prem via gateway). Private endpoint for inbound on sensitive apps.
52	Disable public access if private endpoint is used.
53	*Verify: app outbound IP is in the integrated subnet; inbound test from public internet
54	to private-endpoint-only app = 403 / connection refused.*
55
56	5. Transport hardening — Enforce HTTPS-only, minimum TLS 1.2 (TLS 1.3 preferred),
57	disable FTP (use FTPS or deployment center only), enable HSTS where appropriate.
58	*Verify: HTTP request 301-redirects to HTTPS; `httpsOnly = true`; `minTlsVersion = "1.2"`
59	or higher; `ftpsState = "Disabled"` if no FTP needed.*
60
61	6. WAF in front when public — Front Door (global) or App Gateway with WAF (regional) in
62	Prevention mode. Restrict App Service inbound to the WAF using **Access
63	Restrictions** with the WAF's service tag (`AzureFrontDoor.Backend`) or IP range and the
64	`X-Azure-FDID` header.
65	Verify: direct request to the App Service URL = 403; request via the WAF FQDN = 200.
66
67	7. Monitor + Defender — Diagnostic logs to Log Analytics, Defender for App Service on
68	the plan, App Insights for app telemetry. Alert on anomalous authentication failures.
69
70	## Guardrails
71	- **Remove public inbound exposure with private endpoints for sensitive apps; pair with WAF
72	for public apps.** Apps directly on the internet without a WAF are scanned constantly.
73	-

People who liked this also viewed

6 picks

Type

azure-app-service-security

161stars34forks

View on GitHub

How to install azure-app-service-security?

vinayaklatthe/microsoft-security-skills/azure-app-service-security

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-app-service-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure App Service Security
2
3	Azure App Service hosts web apps and APIs as a managed PaaS. Securing it means eliminating
4	secrets in config, removing public exposure where possible, enforcing modern transport, and
5	fronting it with a WAF when it has to be public.
6
7	## When to use
8	Hardening web apps and APIs hosted on Azure App Service. Use this skill to plan identity,
9	network, secrets, and transport posture for a Web App / API App.
10
11	Do not use this skill for Azure Functions only (similar but separate platform), AKS
12	workloads, or VM-hosted web apps.
13
14	## Pick the configuration by exposure pattern
15
16	\| Exposure \| Inbound \| Outbound \| Front-end \|
17	\|---\|---\|---\|---\|
18	\| Internal-only app (intranet, API for VNet workloads) \| Private endpoint, public access disabled \| VNet integration to spoke \| Internal Application Gateway \|
19	\| Public web app, sensitive data \| Public + access restrictions to WAF only \| VNet integration \| Front Door or App Gateway with WAF, Prevention mode \|
20	\| Public web app, basic \| Public, default \| None / VNet integration \| App Gateway with WAF \|
21	\| API consumed by partners \| Private endpoint + APIM in front \| VNet integration \| APIM (with WAF on APIM if public) \|
22	\| Background worker / no inbound \| Public access disabled \| VNet integration \| None \|
23
24	> Rule of thumb: if it doesn't need to be on the internet, use a private endpoint and
25	> disable public network access. If it does need to be on the internet, put **Front Door /
26	> App Gateway with WAF in Prevention mode** in front and restrict the app to accept traffic
27	> only from the WAF's IP range or service tag.
28
29	## Approach
30
31	1. Enable managed identity — System-assigned managed identity by default. Grant it
32	least-privilege roles on Azure SQL (`SQL DB Contributor` is wrong - use AAD auth +
33	contained user), Storage (`Storage Blob Data Reader`), Key Vault (`Key Vault Secrets
34	User`).
35	*Verify: app has managed identity; no SQL / Storage connection strings with embedded
36	passwords in config.*
37
38	2. Easy Auth for sign-in — Use built-in App Service authentication (Easy Auth) with
39	Microsoft Entra ID for OIDC sign-in without writing auth code. Configure the redirect
40	URI, token store, and `requireAuthentication = true` to gate the whole app.
41	*Verify: anonymous request returns 302 redirect to Entra sign-in; authenticated request
42	returns 200 with the user's principal claims.*
43
44	3. Secrets via Key Vault references — Store secrets in Key Vault; reference them in app
45	settings as `@Microsoft.KeyVault(SecretUri=...)`. No code change; managed identity reads
46	the secret at start / refresh.
47	*Verify: app settings show `Key Vault Reference` as Resolved; no plaintext secrets in
48	config.*
49
50	4. Network isolation — VNet integration for outbound (so the app can reach private
51	endpoints, on-prem via gateway). Private endpoint for inbound on sensitive apps.
52	Disable public access if private endpoint is used.
53	*Verify: app outbound IP is in the integrated subnet; inbound test from public internet
54	to private-endpoint-only app = 403 / connection refused.*
55
56	5. Transport hardening — Enforce HTTPS-only, minimum TLS 1.2 (TLS 1.3 preferred),
57	disable FTP (use FTPS or deployment center only), enable HSTS where appropriate.
58	*Verify: HTTP request 301-redirects to HTTPS; `httpsOnly = true`; `minTlsVersion = "1.2"`
59	or higher; `ftpsState = "Disabled"` if no FTP needed.*
60
61	6. WAF in front when public — Front Door (global) or App Gateway with WAF (regional) in
62	Prevention mode. Restrict App Service inbound to the WAF using **Access
63	Restrictions** with the WAF's service tag (`AzureFrontDoor.Backend`) or IP range and the
64	`X-Azure-FDID` header.
65	Verify: direct request to the App Service URL = 403; request via the WAF FQDN = 200.
66
67	7. Monitor + Defender — Diagnostic logs to Log Analytics, Defender for App Service on
68	the plan, App Insights for app telemetry. Alert on anomalous authentication failures.
69
70	## Guardrails
71	- **Remove public inbound exposure with private endpoints for sensitive apps; pair with WAF
72	for public apps.** Apps directly on the internet without a WAF are scanned constantly.
73	-

People who liked this also viewed

6 picks

Type