> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit appservice authentication disabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "App Service Authentication Disabled" misconfiguration in AZURE using the AZURE console, you can follow these steps:

        1. Open the AZURE console and navigate to the App Service that needs to be remediated.
        2. Click on the "Authentication/Authorization" option from the left-hand menu.
        3. Under the "Authentication Providers" section, select the "Azure Active Directory" option.
        4. Select the "Express" option to set up authentication quickly or "Advanced" to configure custom settings.
        5. Follow the prompts to configure the authentication settings as per your requirements. You can choose to enable/disable different authentication providers such as Facebook, Google, Twitter, and Microsoft.
        6. Once you have configured the authentication settings, click on the "Save" button to apply the changes.

        By following these steps, you can remediate the "App Service Authentication Disabled" misconfiguration in AZURE using the AZURE console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "App Service Authentication Disabled" misconfiguration in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI on your local machine or in the Azure portal.

        2. Login to your Azure account using the command:

           ```
           az login
           ```

        3. Select the subscription that contains the affected App Service using the command:

           ```
           az account set --subscription <subscription_id>
           ```

        4. Get the resource ID of the affected App Service using the command:

           ```
           az webapp show --name <app_service_name> --resource-group <resource_group_name> --query id --output tsv
           ```

        5. Enable App Service Authentication for the App Service using the command:

           ```
           az webapp auth update --ids <app_service_resource_id> --enabled true
           ```

        6. Configure the authentication settings for the App Service. For example, you can configure authentication using Azure Active Directory, Facebook, Google, Microsoft Account, or Twitter. Here's an example command to configure authentication using Azure Active Directory:

           ```
           az webapp auth update --ids <app_service_resource_id> --aad-allowed-token-audiences https://<your_aad_app_id>/ --aad-client-id <your_aad_app_id> --aad-client-secret <your_aad_app_secret> --aad-token-issuer-url https://sts.windows.net/<your_aad_tenant_id>/
           ```

           Note: Replace the placeholders `<your_aad_app_id>`, `<your_aad_app_secret>`, and `<your_aad_tenant_id>` with your actual Azure Active Directory application ID, application secret, and tenant ID, respectively.

        7. Verify that App Service Authentication is enabled for the App Service using the command:

           ```
           az webapp auth show --ids <app_service_resource_id>
           ```

           This command should return the authentication settings for the App Service.

        That's it! You have successfully remediated the "App Service Authentication Disabled" misconfiguration for Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "App Service Authentication Disabled" misconfiguration in Azure using Python, follow these steps:

        1. Import the necessary modules:

        ```
        from azure.mgmt.web import WebSiteManagementClient
        from azure.common.credentials import ServicePrincipalCredentials
        ```

        2. Set up the credentials for accessing the Azure resource:

        ```
        subscription_id = '<subscription_id>'
        client_id = '<client_id>'
        secret = '<client_secret>'
        tenant = '<tenant_id>'

        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=secret,
            tenant=tenant
        )
        ```

        3. Instantiate the `WebSiteManagementClient`:

        ```
        web_client = WebSiteManagementClient(credentials, subscription_id)
        ```

        4. Get the list of web apps:

        ```
        web_apps = web_client.web_apps.list()
        ```

        5. For each web app, check if the app service authentication is disabled. If it is disabled, enable it:

        ```
        for web_app in web_apps:
            if not web_app.site_auth_enabled:
                web_client.web_apps.update_site_auth_settings(
                    resource_group_name='<resource_group_name>',
                    name=web_app.name,
                    site_auth_enabled=True
                )
        ```

        6. Replace `<subscription_id>`, `<client_id>`, `<client_secret>`, `<tenant_id>`, and `<resource_group_name>` with the appropriate values.

        7. Save the Python script and run it to remediate the misconfiguration.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_linux_web_app" "APP_SERVICE" {
          name                = "APP_SERVICE_NAME"              # replace with your App Service name
          resource_group_name = "RESOURCE_GROUP_NAME"           # replace with your resource group name
          location            = "AZURE_REGION"                  # e.g. "eastus"
          service_plan_id     = azurerm_service_plan.APP_SVC_PLAN.id

          site_config {
            application_stack {
              docker_image_name   = "DOCKER_IMAGE:TAG"          # or other stack config
              docker_registry_url = "DOCKER_REGISTRY_URL"
            }
          }

          # Enable App Service Authentication so anonymous requests are not allowed
          auth_settings_v2 {
            auth_enabled = true

            # This example uses Azure AD (Microsoft Entra ID) as the default provider
            default_provider = "azureactivedirectory"

            login {
              # Force unauthenticated or anonymous users to be redirected to the login page
              routes {
                unauthenticated_client_action = "RedirectToLoginPage"
              }
            }

            active_directory_v2 {
              tenant_authentication_mode = "Default"
              tenant_id                  = "AAD_TENANT_ID"       # replace with your tenant ID

              # Use either client_id alone for system-assigned, or client_secret_setting_name for secret in app settings
              client_id = "AAD_APP_CLIENT_ID"                    # replace with your app registration (client) ID
              # client_secret_setting_name = "AAD_CLIENT_SECRET_APP_SETTING_NAME"
            }

            http_settings {
              require_https = true
            }

            # Disable anonymous access for backend APIs
            global_validation {
              unauthenticated_client_action = "RedirectToLoginPage"
            }
          }
        }
        ```

        If your App Service is Windows-based, use `azurerm_windows_web_app` with the same `auth_settings_v2` block. This change updates configuration only (it typically restarts the app but does not force replacement).

        After updating your Terraform, `terraform plan` should show an in-place update on the App Service resource with `auth_settings_v2.auth_enabled` changing from `false` (or absent) to `true`, plus the new authentication configuration arguments being added.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>