Free tool · no signup · runs in your browser
Azure App Service (Kudu/SCM) Hardening Checklist
22 checks for the part of App Service that deploys and manages your app: publishing credentials, network access to the Kudu/SCM site, deployment identity, logging and runtime settings. Tick what you have done, mark what does not apply, and export the result as Markdown for a ticket or an audit file.
Context: Google Threat Intelligence Group (GTIG) and Mandiant’s report “ARTEX and Friends: Enter Agentic Offensive Frameworks” (30 October 2026) recommends restricting Kudu/SCM access, disabling basic publishing authentication and limiting access to publishing credentials.
Publishing credentials
With it off, the SCM (Kudu) site and Web Deploy accept Microsoft Entra ID tokens instead of a reusable username and password.
Where: App > Settings > Configuration > General settings > SCM Basic Auth Publishing Credentials: Off. CLI concept: basicPublishingCredentialsPolicies "scm" with properties.allow=false.
FTP only supports basic authentication, so turning it off removes a password-based way to change site files.
Where: App > Settings > Configuration > General settings > FTP Basic Auth Publishing Credentials: Off. CLI concept: basicPublishingCredentialsPolicies "ftp" with properties.allow=false.
Microsoft recommends disabling FTP, or at least plain FTP, so credentials and content are never sent in clear text.
Where: App > Settings > Configuration > General settings > Platform settings > FTP state: Disabled. CLI: az webapp config set --ftps-state Disabled.
A custom role that excludes the write permission keeps basic auth off even for people who can otherwise manage the app.
Where: Subscription > Access control (IAM) > Add custom role, excluding Microsoft.Web/sites/basicPublishingCredentialsPolicies/Write and Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies/Write.
The audit and remediation policies find apps and slots that still allow FTP or SCM basic auth across every subscription.
Where: Azure Policy > Definitions: the built-in audit and remediation policies for FTP and SCM basic authentication, for apps and for slots.
Resetting issues a new password, so an old publishing profile stops working (integrations that use it must be reconfigured).
Where: App > Deployment Center > FTPS credentials (or Local Git/FTPS credentials) > Application-scope > Reset. CLI concept: the "newpassword" resource action on Microsoft.Web/sites.
User-scope credentials work on every app the account can access, so one leaked pair reaches many apps.
Where: App > Deployment Center > FTPS credentials > User-scope > Reset (this deletes the user name and password and disables them).
Network access to the SCM site
The SCM site is both the Web Deploy endpoint and the Kudu console, so it should accept only your management and deployment networks, not everyone who can reach the app.
Where: App > Settings > Networking > Public network access > Access Restrictions > Advanced tool site: untick "Use main site rules" and add Allow rules. CLI: az webapp config access-restriction add ... --scm-site true.
Deny as the default means any source you did not explicitly allow gets HTTP 403.
Where: Access Restrictions > Advanced tool site > Unmatched rule action: Deny. Property: siteConfig.scmIpSecurityRestrictionsDefaultAction = Deny.
A private endpoint with public access disabled removes internet exposure; the SCM host needs its own private DNS record.
Where: App > Settings > Networking > Private endpoints; then turn off public network access. DNS: <app>.scm.privatelink.azurewebsites.net pointing at the private endpoint IP. Note: FTP is not available through a private endpoint.
Identity, roles and secrets
Entra tokens are short-lived and scoped, unlike a publish profile password that works until someone resets it.
Where: GitHub Actions with OpenID Connect or a user-assigned identity, Azure Pipelines with a service connection, or az webapp deploy (Azure CLI 2.48.1+), all of which work with basic auth off.
Contributor-level roles, including Website Contributor, can access app-level publishing credentials; Reader cannot.
Where: App > Access control (IAM) > Role assignments: review Owner, Contributor and Website Contributor, and remove anyone who does not deploy or manage the app.
App settings are encrypted at rest, but Key Vault gives central control, access policy and audit history for secrets.
Where: App setting value @Microsoft.KeyVault(SecretUri=...) with the app’s managed identity granted the Key Vault Secrets User role.
A managed identity removes stored service principal secrets and connection strings from the app’s configuration.
Where: App > Settings > Identity: turn on a system-assigned identity or add a user-assigned one, then grant it only the roles it needs.
Logging and alerting
This log type records login activity via FTP and Kudu, which is the record you need to see who used the SCM site.
Where: App > Monitoring > Diagnostic settings > Add diagnostic setting: tick AppServiceAuditLogs and send it to a Log Analytics workspace.
These logs record requests evaluated by your IP rules, so you can see what reached or was refused by the SCM site.
Where: Diagnostic settings: tick AppServiceIPSecAuditLogs.
This log type records file changes made to the site content, which shows files added outside your normal deployment.
Where: Diagnostic settings: tick AppServiceFileAuditLogs (Windows; available on Premium tier and above).
The activity log records "Get Web App Publishing Profile", "Newpassword Web Apps" and "Publish Web App", so unexpected ones stand out.
Where: Azure Monitor > Alerts > Create an activity log alert on those operations for production apps, routed to whoever owns the app.
Deployment and runtime
When the ZIP package is mounted as a read-only wwwroot, files in the running app cannot be changed in place (not supported for Python or Java apps).
Where: App > Settings > Environment variables > App settings: WEBSITE_RUN_FROM_PACKAGE = 1 (or the package URL).
It is an extra remote entry point; App Service turns it off after 48 hours, but leaving it off is simpler.
Where: App > Settings > Configuration > General settings > Debugging > Remote debugging: Off. CLI: az webapp config set --remote-debugging-enabled false.
Microsoft advises configuring the minimum TLS version for both the web app and the SCM site, not just the app.
Where: App > Settings > Configuration > General settings > Minimum TLS version (and the SCM site’s minimum TLS setting).
Defender for Cloud flags App Service misconfigurations so drift from this list is caught.
Where: Microsoft Defender for Cloud > Recommendations, filtered to App Service resources.
Your answers stay in this browser. Nothing is sent to PlayCISO.
How to use it
- Start with the critical items: basic auth off, separate SCM access rules, Entra ID deployment and audit logs.
- Check deployment slots too. Slots are configured separately and have their own basic-auth and access settings.
- Turning off basic auth breaks FTP, local Git and publish-profile deployments. Move pipelines to Microsoft Entra ID first (see the “Authentication types by deployment methods” link).
- Setting names and paths were checked against Microsoft Learn in November 2026. The portal changes; the linked page is the source of truth.
Questions
What is the Kudu or SCM site in Azure App Service?
Every App Service app has an advanced tool site at <app>.scm.azurewebsites.net. Microsoft describes it as both the Web Deploy endpoint and the Kudu console. Because it is used to deploy and manage the app, it should be reachable only by the people and pipelines that deploy.
How do I disable basic authentication in Azure App Service?
In the app, go to Settings > Configuration > General settings and set SCM Basic Auth Publishing Credentials and FTP Basic Auth Publishing Credentials to Off. The same switches are the basicPublishingCredentialsPolicies "scm" and "ftp" resources with allow set to false. Microsoft documents which deployment methods keep working with Microsoft Entra ID once they are off.
Can I restrict access to the SCM site separately from the app?
Yes. Under Networking > Access Restrictions, the Advanced tool site has its own rule list. Untick "Use main site rules", add Allow rules for your management and deployment networks, and set its unmatched rule action to Deny.
Which logs show Kudu and FTP logins?
AppServiceAuditLogs, which Microsoft lists as "Login activity via FTP and Kudu". Send it to a Log Analytics workspace with a diagnostic setting. AppServiceIPSecAuditLogs records requests evaluated by IP rules, and AppServiceFileAuditLogs records file changes to site content on Premium tier and above.
Who can see an app’s publishing credentials?
Microsoft says a user needs at least Contributor-level permissions on the app, including the built-in Website Contributor role, to access app-level credentials; Reader cannot. Review those role assignments and reset the app-scope password from Deployment Center if a publish profile was ever shared.
How is the score worked out?
Each of the 22 items is weighted: critical 3, high 2, medium 1. The score is the weight you have done divided by the weight of the items that apply to you. Items marked not applicable are left out. "Hardened" needs 90 or more and no open critical item.
Keep going
- Cloud logging gap checker: find the logs you would need in an incident.
- Leaked cloud key lab: respond when a credential gets out.
- Cloud posture lab: practise fixing cloud misconfigurations.
- How autonomous AI pentest frameworks work: the defender’s view.
Sources
- Google Threat Intelligence Group (GTIG) and Mandiant, “ARTEX and Friends: Enter Agentic Offensive Frameworks”, 30 October 2026
- Microsoft Learn: Use basic authentication-related policies
- Microsoft Learn: Deploy content using FTP/S
- Microsoft Learn: Manage deployment credentials
- Microsoft Learn: Change unmatched rule action for advanced tool site
- Microsoft Learn: Use private endpoints for apps
- Microsoft Learn: Authentication types by deployment methods
- Microsoft Learn: Use Key Vault references as app settings
- Microsoft Learn: Secure your App Service deployment
- Microsoft Learn: App Service monitoring data reference
- Microsoft Learn: Run your app from a ZIP package
- Microsoft Learn: Configure an App Service app
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.