Managed Service Identities Disabled

More Info:

Managed service identity in App Service makes the app more secure by eliminating secrets from the app, such as credentials in the connection strings. When registering with Azure Active Directory in the app service, the app will connect to other Azure services securely without the need of username and passwords.

Risk Level

Medium

Address

Security

Compliance Standards

SOC2, HIPAA, CISAZURE, CBP, HITRUST, NISTCSF, PCIDSS

Triage and Remediation

Remediation

Using Console

Using CLI

Using Python

To remediate the “Managed Service Identities Disabled” misconfiguration in Azure using Python, follow these steps:

Import the necessary libraries:

from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.authorization import AuthorizationManagementClient
from azure.common.credentials import ServicePrincipalCredentials

Set the credentials for your Azure account:

subscription_id = 'your-subscription-id'
tenant_id = 'your-tenant-id'
client_id = 'your-client-id'
client_secret = 'your-client-secret'

credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=client_secret,
    tenant=tenant_id
)

Create a ResourceManagementClient and an AuthorizationManagementClient:

resource_client = ResourceManagementClient(credentials, subscription_id)
auth_client = AuthorizationManagementClient(credentials, subscription_id)

Get the list of resource groups in your subscription:

resource_groups = resource_client.resource_groups.list()

For each resource group, check if managed service identities are enabled for all resources:

for rg in resource_groups:
    rg_name = rg.name
    rg_id = rg.id

    # Check if managed service identities are enabled for all resources in the resource group
    permissions = auth_client.permissions.list_by_resource_group(rg_name)

    for perm in permissions:
        if perm.name == 'Microsoft.ManagedIdentity/userAssignedIdentities':
            if perm.actions == ['*/read']:
                print(f"Managed service identities are enabled for all resources in resource group {rg_name}")
            else:
                print(f"Managed service identities are not enabled for all resources in resource group {rg_name}")

If managed service identities are not enabled for all resources in a resource group, enable them:

for rg in resource_groups:
    rg_name = rg.name
    rg_id = rg.id

    # Check if managed service identities are enabled for all resources in the resource group
    permissions = auth_client.permissions.list_by_resource_group(rg_name)

    for perm in permissions:
        if perm.name == 'Microsoft.ManagedIdentity/userAssignedIdentities':
            if perm.actions != ['*/read']:
                print(f"Enabling managed service identities for all resources in resource group {rg_name}")
                auth_client.permissions.create_or_update(
                    rg_name,
                    'Microsoft.ManagedIdentity/userAssignedIdentities',
                    {
                        'actions': [
                            'Microsoft.ManagedIdentity/userAssignedIdentities/read',
                            'Microsoft.ManagedIdentity/userAssignedIdentities/write',
                            'Microsoft.ManagedIdentity/userAssignedIdentities/delete',
                            'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action'
                        ]
                    }
                )

These steps will enable managed service identities for all resources in all resource groups in your Azure subscription using Python.

Additional Reading:

https://docs.microsoft.com/en-gb/azure/app-service/app-service-web-tutorial-connect-msi

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Managed Service Identities Disabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: