App Service apps should have remote debugging disabled
Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off. The Azure Policy definitions apply to `Microsoft.Web/sites` resources whose kind does not contain `functionapp`.
Remote debugging requires inbound ports to be opened on an App Service app. Remote debugging should be turned off.
What this control checks
App Service apps must have remoteDebuggingEnabled set to false (remote debugging turned off).
Common pitfalls
Missing block passes the Checkov check
Checkov CKV_AZURE_72 passes when the block is missing (missing_block_result is PASSED). It inspects site_config/[0]/remote_debugging_enabled and expects the value False.
Function apps are excluded from the policies
The policy rule applies to Microsoft.Web/sites where kind notContains functionapp.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure App Service apps to turn off remote debugging" (a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b) and "App Service apps should have remote debugging turned off" (cb510bfd-1cba-4d9f-a230-cb0976f4bb71); PowerPipe control azure_compliance.control.appservice_api_app_remote_debugging_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_72.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control) and CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Configuration Settings (CM-6)
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- 3.1.12: Monitor and control remote access sessions.
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 3.1.b Segregation of Functions
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- CM-6 Configuration Settings
- 0912.09s1Organizational.4-09.s 09.08 Exchange of Information
- 1194.01l2Organizational.2-01.l 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_remote_debugging_disabled - Checkov Check:
CKV_AZURE_72 - Powerpipe Control:
azure_compliance.control.appservice_api_app_remote_debugging_disabled - Azure Policy Definitions:
a5e3fe8f-f6cd-4f1d-bbf6-c749754a724b,cb510bfd-1cba-4d9f-a230-cb0976f4bb71
Last reviewed: 2026-10-10