App Configuration access keys are enabled

March 21, 2025 ยท View on GitHub

SYNOPSIS

Access keys allow depersonalized access to App Configuration using a shared secret.

DESCRIPTION

Every request to an Azure App Configuration resource must be authenticated. App Configuration supports authenticating requests using either Entra ID (previously Azure AD) identities or access keys. Using Entra ID identities:

  • Centralizes identity management and auditing.
  • Allows granting of permissions using role-based access control (RBAC).
  • Provides support for advanced security features such as conditional access and multi-factor authentication (MFA) when applicable.

To require clients to use Entra ID to authenticate requests, you can disable the usage of access keys for an Azure App Configuration resource.

When you disable access key authentication for an Azure App Configuration resource, any existing access keys for that resource are deleted. Any subsequent requests to the resource using the previously existing access keys will be rejected. Only requests that are authenticated using Entra ID will succeed.

RECOMMENDATION

Consider only using Entra ID identities to access App Configuration data. Then disable authentication based on access keys or SAS tokens.

EXAMPLES

Configure with Azure template

To deploy configuration stores that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

{
  "type": "Microsoft.AppConfiguration/configurationStores",
  "apiVersion": "2023-03-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "standard"
  },
  "properties": {
    "disableLocalAuth": true,
    "enablePurgeProtection": true,
    "publicNetworkAccess": "Disabled"
  }
}

Configure with Bicep

To deploy configuration stores that pass this rule:

  • Set the properties.disableLocalAuth property to true.

For example:

resource store 'Microsoft.AppConfiguration/configurationStores@2023-03-01' = {
  name: name
  location: location
  sku: {
    name: 'standard'
  }
  properties: {
    disableLocalAuth: true
    enablePurgeProtection: true
    publicNetworkAccess: 'Disabled'
  }
}

Configure with Azure Policy

To address this issue at runtime use the following policies: