App Service app slots should not have CORS configured to allow every resource to access your apps

Azure BuiltIn Policy definition

Alias

Namespace

ResourceType

Path

PathIsDefault

DefaultPath

Modifiable

Microsoft.Web/sites/slots/config/web.cors.allowedOrigins[*]

Microsoft.Web

sites/slots/config

properties.cors.allowedOrigins[*]

True

False

Rows: 1-1 / 1

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 1

Initiative DisplayName

Initiative Id

Initiative Category

State

Type

polSet in AzUSGov

[Preview]: Control the use of App Service in a Virtual Enclave

528d78c5-246c-4f26-ade6-d30798705411

VirtualEnclaves

Preview

BuiltIn

true

Date/Time (UTC ymd) (i)

Change type

Change detail

2022-09-19 17:41:40

add

cae7c12e-764b-4c87-841a-fdc6675d196f

{

displayName: "App Service app slots should not have CORS configured to allow every resource to access your apps",
policyType: "BuiltIn",
mode: "Indexed",
description: "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app.",
metadata: {2 items
- version: "1.0.0",
- category: "App Service"
},
parameters: {1 item
- effect: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Effect",
    - description: "Enable or disable the execution of the policy"
    },
  - allowedValues: [2 items
    - "AuditIfNotExists",
    - "Disabled"
    ],
  - defaultValue: "AuditIfNotExists"
  }
},
policyRule: {2 items
- if: {1 item
  - allOf: [2 items
    - {2 items
      - field: "type",
      - equals: "Microsoft.Web/sites/slots"
      },
    - {2 items
      - field: "kind",
      - notContains: "functionapp"
      }
    ]
  },
- then: {2 items
  - effect: "[parameters('effect')]",
  - details: {2 items
    - type: "Microsoft.Web/sites/slots/config",
    - existenceCondition: {2 items
      - field: "Microsoft.Web/sites/slots/config/web.cors.allowedOrigins[*]",
      - notEquals: "*"
      }
    }
  }
}

}