Use identity-based authentication for App Configuration#
Security · App Configuration · Rule · 2022_09 · Important
Authenticate App Configuration clients with Entra ID identities.
Description#
Every request to an Azure App Configuration resource must be authenticated. App Configuration supports authenticating requests using either Entra ID (previously Azure AD) identities or access keys. Using Entra ID identities:
- Centralizes identity management and auditing.
- Allows granting of permissions using role-based access control (RBAC).
- Provides support for advanced security features such as conditional access and multi-factor authentication (MFA) when applicable.
To require clients to use Entra ID to authenticate requests, you can disable the usage of access keys for an Azure App Configuration resource.
When you disable access key authentication for an Azure App Configuration resource, any existing access keys for that resource are deleted. Any subsequent requests to the resource using the previously existing access keys will be rejected. Only requests that are authenticated using Entra ID will succeed.
Recommendation#
Consider only using Entra ID identities to access App Configuration data. Then disable authentication based on access keys or SAS tokens.
Examples#
Configure with Azure template#
To deploy configuration stores that pass this rule:
- Set the
properties.disableLocalAuth
property totrue
.
For example:
{
"type": "Microsoft.AppConfiguration/configurationStores",
"apiVersion": "2023-03-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"sku": {
"name": "standard"
},
"properties": {
"disableLocalAuth": true,
"enablePurgeProtection": true,
"publicNetworkAccess": "Disabled"
}
}
Configure with Bicep#
To deploy configuration stores that pass this rule:
- Set the
properties.disableLocalAuth
property totrue
.
For example:
resource store 'Microsoft.AppConfiguration/configurationStores@2023-03-01' = {
name: name
location: location
sku: {
name: 'standard'
}
properties: {
disableLocalAuth: true
enablePurgeProtection: true
publicNetworkAccess: 'Disabled'
}
}
Configure with Bicep Public Registry#
To deploy App Configuration Stores that pass this rule:
- Set the
params.disableLocalAuth
parameter totrue
.
For example:
module br_public_store 'br/public:app/app-configuration:1.1.2' = {
name: 'store'
params: {
skuName: 'Standard'
disableLocalAuth: true
enablePurgeProtection: true
publicNetworkAccess: 'Disabled'
replicas: [
{
name: 'eastus'
location: 'eastus'
}
]
}
}
Configure with Azure Policy#
To address this issue at runtime use the following policies:
Name | Resource |
---|---|
App Configuration stores should have local authentication methods disabled | /providers/Microsoft.Authorization/policyDefinitions/b08ab3ca-1062-4db3-8803-eec9cae605d6 |
Configure App Configuration stores to disable local authentication methods | /providers/Microsoft.Authorization/policyDefinitions/72bc14af-4ab8-43af-b4e4-38e7983f9a1f |
Links#
- SE:05 Identity and access management
- IM-1: Use centralized identity and authentication system
- Authorize access to Azure App Configuration using Microsoft Entra ID
- Disable access key authentication
- Azure security baseline for Azure App Configuration
- Azure Policy built-in definitions for Azure App Configuration
- Bicep public registry
- Azure deployment reference