App Service apps should not allow CORS access from every resource
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app. Allow only required domains to interact with your app. The Azure Policy check applies to Microsoft.Web/sites resources whose kind does not contain functionapp.
Cross-Origin Resource Sharing (CORS) should not allow all domains to access your app.
What this control checks
App Service apps should not allow CORS access from every resource
Common pitfalls
Function apps are excluded from the check
The policy applies to Microsoft.Web/sites resources whose kind does not contain functionapp.
Effect can be set to Disabled
The effect parameter defaults to AuditIfNotExists. Its allowed values are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should not have CORS configured to allow every resource to access your apps" (5744710e-cc2f-4ee8-8809-3b11e89f4bc9); PowerPipe control azure_compliance.control.appservice_web_app_cors_no_star.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement) and CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- CM-6 Configuration Settings
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- AC-4 Information Flow Enforcement
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_cors_no_star - Powerpipe Control:
azure_compliance.control.appservice_web_app_cors_no_star - Azure Policy Definition:
5744710e-cc2f-4ee8-8809-3b11e89f4bc9
Last reviewed: 2026-10-11