VIEW RULE IN DATADOG

Description

A publicly accessible Azure App Service app has an assigned managed identity that can read data from a crown jewel blob container. If the app is compromised, an attacker could use the managed identity to read or exfiltrate business-critical data.

Remediation

1. Restrict public network access to the app by configuring access restrictions or a private endpoint. See Azure App Service access restrictions.
2. Remove unnecessary Blob data read permissions from the managed identity. See Remove Azure role assignments.