Skip to main content

Enable Always On For App Services

More Info:​

Ensure that your Azure App Services web applications stay loaded all the time by enabling the Always On feature.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

Enabling Always On for App Services in Azure ensures that your web application is always running and responsive. Here are the steps to remediate this misconfiguration in Azure using the Azure console:

  1. Log in to the Azure portal (https://portal.azure.com/).

  2. Navigate to the App Service that needs to be remediated.

  3. Click on the "Configuration" blade on the left-hand side of the screen.

  4. Scroll down to the "General settings" section and locate the "Always On" setting.

  5. Toggle the switch next to "Always On" to the "On" position.

  6. Click "Save" to apply the changes.

  7. Restart the App Service to ensure that the changes take effect.

Once you have completed these steps, your App Service will be configured to use Always On, ensuring that it is always running and responsive.

Using CLI

To remediate the misconfiguration "Enable Always On for App Services" in Azure using Azure CLI, you can follow these steps:

  1. Open the Azure CLI command prompt.

  2. Run the following command to set the resource group where the App Service is deployed:

az configure --defaults group=<resource-group-name>
  1. Run the following command to enable Always On for the App Service:
az webapp config set --always-on true --name <app-service-name> --resource-group <resource-group-name>
  1. Verify that Always On is enabled for the App Service by running the following command:
az webapp config show --name <app-service-name> --resource-group <resource-group-name> --query alwaysOn

This command should return a value of "true", indicating that Always On is enabled for the App Service.

By following these steps, you can remediate the misconfiguration "Enable Always On for App Services" in Azure using Azure CLI.

Using Python

To remediate the misconfiguration "Enable Always On For App Services" in Azure using Python, follow these steps:

  1. Import the necessary libraries:
from azure.identity import DefaultAzureCredential
from azure.mgmt.web import WebSiteManagementClient
  1. Authenticate with Azure using the DefaultAzureCredential:
credential = DefaultAzureCredential()
  1. Instantiate a WebSiteManagementClient object:
subscription_id = '<your-subscription-id>'
resource_group_name = '<your-resource-group-name>'
webapp_name = '<your-webapp-name>'

client = WebSiteManagementClient(credential, subscription_id)
  1. Get the current configuration of the web app:
webapp = client.web_apps.get(resource_group_name, webapp_name)
  1. Check if Always On is enabled:
if webapp.always_on:
    print('Always On is already enabled.')
else:
    print('Always On is not enabled.')
  1. If Always On is not enabled, update the configuration:
webapp.always_on = True
client.web_apps.create_or_update(resource_group_name, webapp_name, webapp)
print('Always On has been enabled.')

The complete code to remediate the misconfiguration "Enable Always On For App Services" in Azure using Python would look like this:

from azure.identity import DefaultAzureCredential
from azure.mgmt.web import WebSiteManagementClient

credential = DefaultAzureCredential()

subscription_id = '<your-subscription-id>'
resource_group_name = '<your-resource-group-name>'
webapp_name = '<your-webapp-name>'

client = WebSiteManagementClient(credential, subscription_id)

webapp = client.web_apps.get(resource_group_name, webapp_name)

if webapp.always_on:
    print('Always On is already enabled.')
else:
    webapp.always_on = True
    client.web_apps.create_or_update(resource_group_name, webapp_name, webapp)
    print('Always On has been enabled.')
Using Terraform
resource "azurerm_linux_web_app" "APP_SERVICE_NAME" {
  name                = "APP_SERVICE_NAME"          # replace with your App Service name
  resource_group_name = azurerm_resource_group.RG_NAME.name
  location            = azurerm_resource_group.RG_NAME.location
  service_plan_id     = azurerm_service_plan.APP_SERVICE_PLAN_NAME.id

  site_config {
    always_on = true
    # keep any other existing site_config settings here (e.g. ftps_state, http2_enabled, etc.)
  }
}

Substitute:

  • APP_SERVICE_NAME with your App Service name.
  • RG_NAME with your existing azurerm_resource_group resource name.
  • APP_SERVICE_PLAN_NAME with your existing azurerm_service_plan resource name.

This change is in-place (no resource replacement); terraform plan should show an update to the existing App Service with site_config.always_on changing from false (or unset) to true.