# Azure App Service Security

> Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening, Key Vault references for secrets, and front-end WAF (Front Door / App Gateway). WHEN: App Service security, secure web app on Azure, Easy Auth, App Service managed identity, private endpoint web app, VNe…

- **Type:** Skill
- **Install:** `agentstack add skill-vinayaklatthe-microsoft-security-skills-azure-app-service-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [vinayaklatthe](https://agentstack.voostack.com/s/vinayaklatthe)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** https://github.com/vinayaklatthe/microsoft-security-skills/tree/main/skills/azure-app-service-security

## Install

```sh
agentstack add skill-vinayaklatthe-microsoft-security-skills-azure-app-service-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Azure App Service Security

Azure App Service hosts web apps and APIs as a managed PaaS. Securing it means eliminating
secrets in config, removing public exposure where possible, enforcing modern transport, and
fronting it with a WAF when it has to be public.

## When to use
Hardening web apps and APIs hosted on Azure App Service. Use this skill to plan identity,
network, secrets, and transport posture for a Web App / API App.

**Do not use this skill** for Azure Functions only (similar but separate platform), AKS
workloads, or VM-hosted web apps.

## Pick the configuration by exposure pattern

| Exposure | Inbound | Outbound | Front-end |
|---|---|---|---|
| **Internal-only app** (intranet, API for VNet workloads) | Private endpoint, public access disabled | VNet integration to spoke | Internal Application Gateway |
| **Public web app, sensitive data** | Public + access restrictions to WAF only | VNet integration | Front Door or App Gateway with WAF, Prevention mode |
| **Public web app, basic** | Public, default | None / VNet integration | App Gateway with WAF |
| **API consumed by partners** | Private endpoint + APIM in front | VNet integration | APIM (with WAF on APIM if public) |
| **Background worker / no inbound** | Public access disabled | VNet integration | None |

> **Rule of thumb:** if it doesn't need to be on the internet, use a **private endpoint** and
> disable public network access. If it does need to be on the internet, put **Front Door /
> App Gateway with WAF in Prevention mode** in front and restrict the app to accept traffic
> only from the WAF's IP range or service tag.

## Approach

1. **Enable managed identity** — System-assigned managed identity by default. Grant it
   least-privilege roles on Azure SQL (`SQL DB Contributor` is wrong - use AAD auth +
   contained user), Storage (`Storage Blob Data Reader`), Key Vault (`Key Vault Secrets
   User`).
   *Verify: app has managed identity; no SQL / Storage connection strings with embedded
   passwords in config.*

2. **Easy Auth for sign-in** — Use built-in **App Service authentication (Easy Auth)** with
   Microsoft Entra ID for OIDC sign-in without writing auth code. Configure the redirect
   URI, token store, and `requireAuthentication = true` to gate the whole app.
   *Verify: anonymous request returns 302 redirect to Entra sign-in; authenticated request
   returns 200 with the user's principal claims.*

3. **Secrets via Key Vault references** — Store secrets in Key Vault; reference them in app
   settings as `@Microsoft.KeyVault(SecretUri=...)`. No code change; managed identity reads
   the secret at start / refresh.
   *Verify: app settings show `Key Vault Reference` as Resolved; no plaintext secrets in
   config.*

4. **Network isolation** — **VNet integration** for outbound (so the app can reach private
   endpoints, on-prem via gateway). **Private endpoint** for inbound on sensitive apps.
   Disable public access if private endpoint is used.
   *Verify: app outbound IP is in the integrated subnet; inbound test from public internet
   to private-endpoint-only app = 403 / connection refused.*

5. **Transport hardening** — Enforce **HTTPS-only**, minimum TLS 1.2 (TLS 1.3 preferred),
   disable FTP (use FTPS or deployment center only), enable HSTS where appropriate.
   *Verify: HTTP request 301-redirects to HTTPS; `httpsOnly = true`; `minTlsVersion = "1.2"`
   or higher; `ftpsState = "Disabled"` if no FTP needed.*

6. **WAF in front when public** — Front Door (global) or App Gateway with WAF (regional) in
   **Prevention mode**. Restrict App Service inbound to the WAF using **Access
   Restrictions** with the WAF's service tag (`AzureFrontDoor.Backend`) or IP range and the
   `X-Azure-FDID` header.
   *Verify: direct request to the App Service URL = 403; request via the WAF FQDN = 200.*

7. **Monitor + Defender** — Diagnostic logs to Log Analytics, **Defender for App Service** on
   the plan, App Insights for app telemetry. Alert on anomalous authentication failures.

## Guardrails
- **Remove public inbound exposure with private endpoints for sensitive apps; pair with WAF
  for public apps.** Apps directly on the internet without a WAF are scanned constantly.
- **Use managed identity + Key Vault references to eliminate secrets in config.** Connection
  strings in app settings are an audit finding waiting to happen.
- **Enforce HTTPS-only and modern TLS; disable legacy protocols and FTP.** TLS 1.0 / 1.1 and
  FTP are immediate audit failures.
- **Easy Auth doesn't replace authorisation.** It authenticates; you still need to check
  roles / claims in code for sensitive actions.
- **Access Restrictions are the lock on the back door.** Without restricting App Service to
  the WAF's IPs / FDID header, attackers bypass the WAF by hitting the App Service URL
  directly.
- **Defender for App Service catches things AV doesn't.** Webshell upload, anomalous app
  behaviour - enable on the plan.

## Common anti-patterns
- **"Connection string in app settings as plaintext"** - Visible to anyone with Reader on
  the app. Key Vault reference.
- **"Public App Service URL with WAF as 'recommended add-on later'"** - Attackers bypass the
  WAF on day one. Lock down access restrictions when WAF goes in.
- **"FTP enabled for legacy deployment"** - Cleartext credentials. Use FTPS or deployment
  center.
- **"HTTPS-only off because of one legacy callback"** - Fix the callback. Don't downgrade
  the whole app.
- **"Easy Auth + 'allow anonymous to /api/*'"** - Defeats the gate. Authenticate everything;
  authorise inside.
- **"VNet integration without disabling public access"** - You added security but didn't
  remove the old door.

## Example prompts
- `Harden an Azure App Service web app with Easy Auth, managed identity, and TLS.`
- `How do I lock down App Service with private endpoints and VNet integration?`
- `Use Key Vault references for App Service secrets instead of plain app settings.`
- `Put Front Door with WAF in front of App Service and lock the back door.`
- `Disable FTP, enforce HTTPS-only, and set minimum TLS 1.2.`
- `Review my App Service network and authentication configuration for security gaps.`

## Microsoft Learn
- App Service security: https://learn.microsoft.com/azure/app-service/overview-security
- Easy Auth: https://learn.microsoft.com/azure/app-service/overview-authentication-authorization
- Key Vault references: https://learn.microsoft.com/azure/app-service/app-service-key-vault-references
- Networking features: https://learn.microsoft.com/azure/app-service/networking-features
- Private endpoints: https://learn.microsoft.com/azure/app-service/networking/private-endpoint
- Access restrictions: https://learn.microsoft.com/azure/app-service/app-service-ip-restrictions
- TLS / HTTPS: https://learn.microsoft.com/azure/app-service/configure-ssl-bindings
- Defender for App Service: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-app-service-introduction

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [vinayaklatthe](https://github.com/vinayaklatthe)
- **Source:** [vinayaklatthe/microsoft-security-skills](https://github.com/vinayaklatthe/microsoft-security-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-vinayaklatthe-microsoft-security-skills-azure-app-service-security
- Seller: https://agentstack.voostack.com/s/vinayaklatthe
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.