cis-azure-compute-2-1-15

name	cis-azure-compute-2.1.15
description	Ensure App Service plan SKU supports private endpoints
category	cis-azure-compute
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","app-service","private-endpoint","sku","app-service-plan","network-security"]
cis_id	2.1.15
cis_benchmark	CIS Microsoft Azure Compute Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure App Service plan SKU supports private endpoints

Description

Ensure that your App Service plan SKU supports private endpoints. Private endpoints provide secure access over Azure Private Link, which keeps traffic on the Microsoft backbone network and eliminates exposure to the public internet. Note that not all SKUs support private endpoints.

Rationale

An appropriately configured private endpoint eliminates public exposure and helps prevent data exfiltration.

Impact

App Service plan costs vary based on the selected SKU.

• App Service on Linux pricing: https://azure.microsoft.com/en-us/pricing/details/app-service/linux/
• App Service on Windows pricing: https://azure.microsoft.com/en-us/pricing/details/app-service/windows/

Audit Procedure

Using Azure Portal

1. Go to App Services.
2. Click the name of an app.
3. In the Properties pane, under Hosting, next to SKU and size, ensure that the plan tier is one of the following: Basic, Standard, ElasticPremium, Premium, PremiumV2, Premium0V3, PremiumV3, PremiumMV3, IsolatedV2, IsolatedMV2, WorkflowStandard, FlexConsumption, and that the plan name is one of the following: B1, B2, B3, S1, S2, S3, EP1, EP2, EP3, P1, P2, P3, P1V2, P2V2, P3V2, P0V3, P1V3, P2V3, P3V3, P1MV3, P2MV3, P3MV3, P4MV3, P5MV3, I1V2, , , , , , , , , , , , , , .